Skip to content

[Snyk] Fix for 79 vulnerabilities - #26

Open
MatrixAlain wants to merge 1 commit into
masterfrom
snyk-fix-e2bc01330cc2e160823fe7e6fb28f9b4
Open

[Snyk] Fix for 79 vulnerabilities#26
MatrixAlain wants to merge 1 commit into
masterfrom
snyk-fix-e2bc01330cc2e160823fe7e6fb28f9b4

Conversation

@MatrixAlain

@MatrixAlainMatrixAlain commented Apr 5, 2023

Copy link
Copy Markdown
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `rubygems` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • Gemfile
⚠️Warning
Failed to update the Gemfile.lock, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:
SeverityPriority Score (*)IssueBreaking ChangeExploit Maturity
medium severity586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		Information Exposure
SNYK-RUBY-ACTIONPACK-1290051		NoProof of Concept
high severity589/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-ACTIONPACK-1290052		NoNo Known Exploit
high severity584/1000
Why? Has a fix available, CVSS 7.4		Information Exposure
SNYK-RUBY-ACTIONPACK-2400638		NoNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-ACTIONPACK-3237231		YesNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-ACTIONPACK-3237232		YesNo Known Exploit
medium severity646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		Cross-site Request Forgery (CSRF)
SNYK-RUBY-ACTIONPACK-569599		NoProof of Concept
medium severity646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		Information Exposure
SNYK-RUBY-ACTIONPACK-569600		NoProof of Concept
medium severity519/1000
Why? Has a fix available, CVSS 6.1		Cross-site Scripting (XSS)
SNYK-RUBY-ACTIONVIEW-20271		NoNo Known Exploit
medium severity591/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.4		Cross-site Scripting (XSS)
SNYK-RUBY-ACTIONVIEW-2803851		NoProof of Concept
medium severity646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		Cross-site Scripting (XSS)
SNYK-RUBY-ACTIONVIEW-560837		NoProof of Concept
critical severity876/1000
Why? Mature exploit, Has a fix available, CVSS 9.8		Remote Code Execution (RCE)
SNYK-RUBY-ACTIONVIEW-569156		NoMature
medium severity586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		Cross-site Request Forgery (CSRF)
SNYK-RUBY-ACTIONVIEW-569601		NoProof of Concept
medium severity449/1000
Why? Has a fix available, CVSS 4.7		Cross-site Scripting (XSS)
SNYK-RUBY-ACTIONVIEW-632514		NoNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Access Restriction Bypass
SNYK-RUBY-ACTIVEJOB-72640		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-ACTIVERECORD-1080913		NoNo Known Exploit
critical severity704/1000
Why? Has a fix available, CVSS 9.8		Remote Code Execution (RCE)
SNYK-RUBY-ACTIVERECORD-2960802		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-ACTIVERECORD-3237239		YesNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-ACTIVESUPPORT-3237242		YesNo Known Exploit
medium severity591/1000
Why? Recently disclosed, Has a fix available, CVSS 6.1		Cross-site Scripting (XSS)
SNYK-RUBY-ACTIVESUPPORT-3360028		YesNo Known Exploit
high severity834/1000
Why? Mature exploit, Has a fix available, CVSS 8.1		Deserialization of Untrusted Data
SNYK-RUBY-ACTIVESUPPORT-569598		NoMature
medium severity434/1000
Why? Has a fix available, CVSS 4.4		Time of Check Time of Use (TOCTOU)
SNYK-RUBY-DEVISE-173787		NoNo Known Exploit
medium severity539/1000
Why? Has a fix available, CVSS 6.5		Authentication Bypass
SNYK-RUBY-DEVISE-465098		NoNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-GLOBALID-3237234		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-I18N-72582		NoNo Known Exploit
critical severity679/1000
Why? Has a fix available, CVSS 9.3		Denial of Service (DoS)
SNYK-RUBY-JSON-560838		NoNo Known Exploit
medium severity519/1000
Why? Has a fix available, CVSS 6.1		Cross-site Scripting (XSS)
SNYK-RUBY-LOOFAH-22023		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-LOOFAH-3168317		NoNo Known Exploit
high severity579/1000
Why? Has a fix available, CVSS 7.3		Cross-site Scripting (XSS)
SNYK-RUBY-LOOFAH-474102		NoNo Known Exploit
medium severity484/1000
Why? Has a fix available, CVSS 5.4		Cross-site Scripting (XSS)
SNYK-RUBY-LOOFAH-72548		NoNo Known Exploit
low severity344/1000
Why? Has a fix available, CVSS 2.6		XML External Entity (XXE) Injection
SNYK-RUBY-NOKOGIRI-1055008		NoNo Known Exploit
high severity696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-NOKOGIRI-1293239		NoProof of Concept
medium severity539/1000
Why? Has a fix available, CVSS 6.5		Denial of Service (DoS)
SNYK-RUBY-NOKOGIRI-1583442		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		XML External Entity (XXE) Injection
SNYK-RUBY-NOKOGIRI-1726792		NoNo Known Exploit
high severity579/1000
Why? Has a fix available, CVSS 7.3		XML External Entity (XXE) Injection
SNYK-RUBY-NOKOGIRI-20299		NoNo Known Exploit
high severity654/1000
Why? Has a fix available, CVSS 8.8		Arbitrary Code Execution
SNYK-RUBY-NOKOGIRI-20367		NoNo Known Exploit
high severity654/1000
Why? Has a fix available, CVSS 8.8		Out of Bounds Memory Write
SNYK-RUBY-NOKOGIRI-20368		NoNo Known Exploit
high severity826/1000
Why? Mature exploit, Has a fix available, CVSS 8.8		Use of vulnerable libxml2
SNYK-RUBY-NOKOGIRI-20432		NoMature
high severity589/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-NOKOGIRI-22013		NoNo Known Exploit
high severity654/1000
Why? Has a fix available, CVSS 8.8		Denial of Service (DoS)
SNYK-RUBY-NOKOGIRI-22014		NoNo Known Exploit
high severity619/1000
Why? Has a fix available, CVSS 8.1		Use After Free
SNYK-RUBY-NOKOGIRI-2413994		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-NOKOGIRI-2620374		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Out-of-bounds Write
SNYK-RUBY-NOKOGIRI-2630623		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-NOKOGIRI-2630898		NoNo Known Exploit
high severity624/1000
Why? Has a fix available, CVSS 8.2		Improper Handling of Unexpected Data Type
SNYK-RUBY-NOKOGIRI-2840634		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		NULL Pointer Dereference
SNYK-RUBY-NOKOGIRI-3052880		NoNo Known Exploit
medium severity414/1000
Why? Has a fix available, CVSS 4		Out-of-Bounds
SNYK-RUBY-NOKOGIRI-3357692		NoNo Known Exploit
medium severity529/1000
Why? Has a fix available, CVSS 6.3		Access Control Bypass
SNYK-RUBY-NOKOGIRI-3357693		NoNo Known Exploit
high severity619/1000
Why? Has a fix available, CVSS 8.1		Command Injection
SNYK-RUBY-NOKOGIRI-459107		NoNo Known Exploit
high severity659/1000
Why? Has a fix available, CVSS 8.9		Uncontrolled Memory Allocation
SNYK-RUBY-NOKOGIRI-534637		NoNo Known Exploit
high severity600/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-NOKOGIRI-552159		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-NOKOGIRI-72433		NoNo Known Exploit
high severity654/1000
Why? Has a fix available, CVSS 8.8		Cross-site Request Forgery (CSRF)
SNYK-RUBY-OMNIAUTH-174820		YesNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Information Exposure
SNYK-RUBY-OMNIAUTH-22012		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Improper Authentication
SNYK-RUBY-OMNIAUTH-2987513		NoNo Known Exploit
medium severity616/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.9		Web Cache Poisoning
SNYK-RUBY-RACK-1061917		YesProof of Concept
critical severity704/1000
Why? Has a fix available, CVSS 9.8		Arbitrary Code Injection
SNYK-RUBY-RACK-2848599		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-RACK-2848600		NoNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3237233		NoNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3237237		NoNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3237240		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-RACK-3356639		NoNo Known Exploit
medium severity551/1000
Why? Recently disclosed, Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3360233		NoNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Information Exposure
SNYK-RUBY-RACK-538324		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Directory Traversal
SNYK-RUBY-RACK-569066		NoNo Known Exploit
medium severity646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		Cross-site Request Forgery (CSRF)
SNYK-RUBY-RACK-572377		NoProof of Concept
medium severity519/1000
Why? Has a fix available, CVSS 6.1		Cross-site Scripting (XSS)
SNYK-RUBY-RACK-72567		NoNo Known Exploit
high severity696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-RAILS-1071903		NoProof of Concept
medium severity519/1000
Why? Has a fix available, CVSS 6.1		Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-22025		NoNo Known Exploit
medium severity531/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.2		Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-2935879		NoProof of Concept
medium severity484/1000
Why? Has a fix available, CVSS 5.4		Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168316		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168646		NoNo Known Exploit
medium severity626/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.1		Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168647		NoProof of Concept
medium severity424/1000
Why? Has a fix available, CVSS 4.2		Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168648		NoNo Known Exploit
high severity686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		Arbitrary Code Injection
SNYK-RUBY-RAKE-552000		NoProof of Concept
high severity619/1000
Why? Has a fix available, CVSS 8.1		Command Injection
SNYK-RUBY-RDOC-1279617		YesNo Known Exploit
high severity564/1000
Why? Has a fix available, CVSS 7		Command Injection
SNYK-RUBY-RDOC-1316279		YesNo Known Exploit
high severity696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		Directory Traversal
SNYK-RUBY-SPROCKETS-22032		NoProof of Concept
high severity589/1000
Why? Has a fix available, CVSS 7.5		Directory Traversal
SNYK-RUBY-TZINFO-2958048		NoNo Known Exploit
high severity731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-WEBSOCKETEXTENSIONS-570830		NoProof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note:You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)
🦉 Cross-site Request Forgery (CSRF)
🦉 Cross-site Scripting (XSS)
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: Gemfile to reduce vulnerabilities
2dc634e
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-1290051
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-1290052
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-2400638
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-3237231
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-3237232
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-569599
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-569600
- https://snyk.io/vuln/SNYK-RUBY-ACTIONVIEW-20271
- https://snyk.io/vuln/SNYK-RUBY-ACTIONVIEW-2803851
- https://snyk.io/vuln/SNYK-RUBY-ACTIONVIEW-560837
- https://snyk.io/vuln/SNYK-RUBY-ACTIONVIEW-569156
- https://snyk.io/vuln/SNYK-RUBY-ACTIONVIEW-569601
- https://snyk.io/vuln/SNYK-RUBY-ACTIONVIEW-632514
- https://snyk.io/vuln/SNYK-RUBY-ACTIVEJOB-72640
- https://snyk.io/vuln/SNYK-RUBY-ACTIVERECORD-1080913
- https://snyk.io/vuln/SNYK-RUBY-ACTIVERECORD-2960802
- https://snyk.io/vuln/SNYK-RUBY-ACTIVERECORD-3237239
- https://snyk.io/vuln/SNYK-RUBY-ACTIVESUPPORT-3237242
- https://snyk.io/vuln/SNYK-RUBY-ACTIVESUPPORT-3360028
- https://snyk.io/vuln/SNYK-RUBY-ACTIVESUPPORT-569598
- https://snyk.io/vuln/SNYK-RUBY-DEVISE-173787
- https://snyk.io/vuln/SNYK-RUBY-DEVISE-465098
- https://snyk.io/vuln/SNYK-RUBY-GLOBALID-3237234
- https://snyk.io/vuln/SNYK-RUBY-I18N-72582
- https://snyk.io/vuln/SNYK-RUBY-JSON-560838
- https://snyk.io/vuln/SNYK-RUBY-LOOFAH-22023
- https://snyk.io/vuln/SNYK-RUBY-LOOFAH-3168317
- https://snyk.io/vuln/SNYK-RUBY-LOOFAH-474102
- https://snyk.io/vuln/SNYK-RUBY-LOOFAH-72548
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-1055008
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-1293239
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-1583442
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-1726792
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20299
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20367
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20368
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20432
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-22013
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-22014
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-2413994
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-2620374
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-2630623
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-2630898
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-2840634
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-3052880
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-3357692
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-3357693
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-459107
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-534637
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-552159
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-72433
- https://snyk.io/vuln/SNYK-RUBY-OMNIAUTH-174820
- https://snyk.io/vuln/SNYK-RUBY-OMNIAUTH-22012
- https://snyk.io/vuln/SNYK-RUBY-OMNIAUTH-2987513
- https://snyk.io/vuln/SNYK-RUBY-RACK-1061917
- https://snyk.io/vuln/SNYK-RUBY-RACK-2848599
- https://snyk.io/vuln/SNYK-RUBY-RACK-2848600
- https://snyk.io/vuln/SNYK-RUBY-RACK-3237233
- https://snyk.io/vuln/SNYK-RUBY-RACK-3237237
- https://snyk.io/vuln/SNYK-RUBY-RACK-3237240
- https://snyk.io/vuln/SNYK-RUBY-RACK-3356639
- https://snyk.io/vuln/SNYK-RUBY-RACK-3360233
- https://snyk.io/vuln/SNYK-RUBY-RACK-538324
- https://snyk.io/vuln/SNYK-RUBY-RACK-569066
- https://snyk.io/vuln/SNYK-RUBY-RACK-572377
- https://snyk.io/vuln/SNYK-RUBY-RACK-72567
- https://snyk.io/vuln/SNYK-RUBY-RAILS-1071903
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-22025
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-2935879
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168316
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168646
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168647
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168648
- https://snyk.io/vuln/SNYK-RUBY-RAKE-552000
- https://snyk.io/vuln/SNYK-RUBY-RDOC-1279617
- https://snyk.io/vuln/SNYK-RUBY-RDOC-1316279
- https://snyk.io/vuln/SNYK-RUBY-SPROCKETS-22032
- https://snyk.io/vuln/SNYK-RUBY-TZINFO-2958048
- https://snyk.io/vuln/SNYK-RUBY-WEBSOCKETEXTENSIONS-570830
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@MatrixAlain@snyk-bot