Skip to content

[Snyk] Fix for 50 vulnerabilities - #28

Open
MatrixAlain wants to merge 1 commit into
masterfrom
snyk-fix-7406c0ed25100c78058ef3d89d467c9a
Open

[Snyk] Fix for 50 vulnerabilities#28
MatrixAlain wants to merge 1 commit into
masterfrom
snyk-fix-7406c0ed25100c78058ef3d89d467c9a

Conversation

@MatrixAlain

@MatrixAlainMatrixAlain commented Oct 5, 2023

Copy link
Copy Markdown
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `rubygems` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • Gemfile
⚠️Warning
Failed to update the Gemfile.lock, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:
SeverityPriority Score (*)IssueBreaking ChangeExploit Maturity
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-ACTIVESUPPORT-3237242		NoNo Known Exploit
medium severity519/1000
Why? Has a fix available, CVSS 6.1		Cross-site Scripting (XSS)
SNYK-RUBY-ACTIVESUPPORT-3360028		NoNo Known Exploit
high severity834/1000
Why? Mature exploit, Has a fix available, CVSS 8.1		Deserialization of Untrusted Data
SNYK-RUBY-ACTIVESUPPORT-569598		NoMature
medium severity424/1000
Why? Has a fix available, CVSS 4.2		Cross-site Scripting (XSS)
SNYK-RUBY-ERUBIS-20482		YesNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-GLOBALID-3237234		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-I18N-72582		NoNo Known Exploit
medium severity519/1000
Why? Has a fix available, CVSS 6.1		Cross-site Scripting (XSS)
SNYK-RUBY-LOOFAH-22023		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-LOOFAH-3168317		NoNo Known Exploit
high severity579/1000
Why? Has a fix available, CVSS 7.3		Cross-site Scripting (XSS)
SNYK-RUBY-LOOFAH-474102		NoNo Known Exploit
medium severity484/1000
Why? Has a fix available, CVSS 5.4		Cross-site Scripting (XSS)
SNYK-RUBY-LOOFAH-72548		NoNo Known Exploit
low severity344/1000
Why? Has a fix available, CVSS 2.6		XML External Entity (XXE) Injection
SNYK-RUBY-NOKOGIRI-1055008		NoNo Known Exploit
high severity696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-NOKOGIRI-1293239		NoProof of Concept
medium severity539/1000
Why? Has a fix available, CVSS 6.5		Denial of Service (DoS)
SNYK-RUBY-NOKOGIRI-1583442		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		XML External Entity (XXE) Injection
SNYK-RUBY-NOKOGIRI-1726792		NoNo Known Exploit
high severity579/1000
Why? Has a fix available, CVSS 7.3		XML External Entity (XXE) Injection
SNYK-RUBY-NOKOGIRI-20299		NoNo Known Exploit
high severity654/1000
Why? Has a fix available, CVSS 8.8		Arbitrary Code Execution
SNYK-RUBY-NOKOGIRI-20367		NoNo Known Exploit
high severity654/1000
Why? Has a fix available, CVSS 8.8		Out of Bounds Memory Write
SNYK-RUBY-NOKOGIRI-20368		NoNo Known Exploit
high severity826/1000
Why? Mature exploit, Has a fix available, CVSS 8.8		Use of vulnerable libxml2
SNYK-RUBY-NOKOGIRI-20432		NoMature
high severity589/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-NOKOGIRI-22013		NoNo Known Exploit
high severity654/1000
Why? Has a fix available, CVSS 8.8		Denial of Service (DoS)
SNYK-RUBY-NOKOGIRI-22014		NoNo Known Exploit
high severity619/1000
Why? Has a fix available, CVSS 8.1		Use After Free
SNYK-RUBY-NOKOGIRI-2413994		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-NOKOGIRI-2620374		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Out-of-bounds Write
SNYK-RUBY-NOKOGIRI-2630623		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-NOKOGIRI-2630898		NoNo Known Exploit
high severity624/1000
Why? Has a fix available, CVSS 8.2		Improper Handling of Unexpected Data Type
SNYK-RUBY-NOKOGIRI-2840634		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		NULL Pointer Dereference
SNYK-RUBY-NOKOGIRI-3052880		NoNo Known Exploit
medium severity529/1000
Why? Has a fix available, CVSS 6.3		Access Control Bypass
SNYK-RUBY-NOKOGIRI-3357693		NoNo Known Exploit
high severity619/1000
Why? Has a fix available, CVSS 8.1		Command Injection
SNYK-RUBY-NOKOGIRI-459107		NoNo Known Exploit
high severity659/1000
Why? Has a fix available, CVSS 8.9		Uncontrolled Memory Allocation
SNYK-RUBY-NOKOGIRI-534637		NoNo Known Exploit
high severity600/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-NOKOGIRI-552159		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-NOKOGIRI-72433		NoNo Known Exploit
medium severity616/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.9		Web Cache Poisoning
SNYK-RUBY-RACK-1061917		YesProof of Concept
critical severity704/1000
Why? Has a fix available, CVSS 9.8		Arbitrary Code Injection
SNYK-RUBY-RACK-2848599		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-RACK-2848600		NoNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3237233		NoNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3237237		NoNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3237240		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-RUBY-RACK-3356639		NoNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3360233		NoNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Information Exposure
SNYK-RUBY-RACK-538324		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Directory Traversal
SNYK-RUBY-RACK-569066		NoNo Known Exploit
medium severity646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		Cross-site Request Forgery (CSRF)
SNYK-RUBY-RACK-572377		NoProof of Concept
medium severity519/1000
Why? Has a fix available, CVSS 6.1		Cross-site Scripting (XSS)
SNYK-RUBY-RACK-72567		NoNo Known Exploit
medium severity519/1000
Why? Has a fix available, CVSS 6.1		Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-22025		NoNo Known Exploit
medium severity531/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.2		Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-2935879		NoProof of Concept
medium severity484/1000
Why? Has a fix available, CVSS 5.4		Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168316		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168646		NoNo Known Exploit
medium severity626/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.1		Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168647		NoProof of Concept
medium severity424/1000
Why? Has a fix available, CVSS 4.2		Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168648		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Directory Traversal
SNYK-RUBY-TZINFO-2958048		NoNo Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note:You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Cross-site Scripting (XSS)
🦉 Deserialization of Untrusted Data
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: Gemfile to reduce vulnerabilities
60a25c5
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-RUBY-ACTIVESUPPORT-3237242
- https://snyk.io/vuln/SNYK-RUBY-ACTIVESUPPORT-3360028
- https://snyk.io/vuln/SNYK-RUBY-ACTIVESUPPORT-569598
- https://snyk.io/vuln/SNYK-RUBY-ERUBIS-20482
- https://snyk.io/vuln/SNYK-RUBY-GLOBALID-3237234
- https://snyk.io/vuln/SNYK-RUBY-I18N-72582
- https://snyk.io/vuln/SNYK-RUBY-LOOFAH-22023
- https://snyk.io/vuln/SNYK-RUBY-LOOFAH-3168317
- https://snyk.io/vuln/SNYK-RUBY-LOOFAH-474102
- https://snyk.io/vuln/SNYK-RUBY-LOOFAH-72548
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-1055008
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-1293239
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-1583442
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-1726792
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20299
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20367
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20368
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20432
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-22013
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-22014
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-2413994
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-2620374
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-2630623
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-2630898
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-2840634
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-3052880
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-3357693
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-459107
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-534637
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-552159
- https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-72433
- https://snyk.io/vuln/SNYK-RUBY-RACK-1061917
- https://snyk.io/vuln/SNYK-RUBY-RACK-2848599
- https://snyk.io/vuln/SNYK-RUBY-RACK-2848600
- https://snyk.io/vuln/SNYK-RUBY-RACK-3237233
- https://snyk.io/vuln/SNYK-RUBY-RACK-3237237
- https://snyk.io/vuln/SNYK-RUBY-RACK-3237240
- https://snyk.io/vuln/SNYK-RUBY-RACK-3356639
- https://snyk.io/vuln/SNYK-RUBY-RACK-3360233
- https://snyk.io/vuln/SNYK-RUBY-RACK-538324
- https://snyk.io/vuln/SNYK-RUBY-RACK-569066
- https://snyk.io/vuln/SNYK-RUBY-RACK-572377
- https://snyk.io/vuln/SNYK-RUBY-RACK-72567
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-22025
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-2935879
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168316
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168646
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168647
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168648
- https://snyk.io/vuln/SNYK-RUBY-TZINFO-2958048
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@MatrixAlain@snyk-bot