Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

[Snyk] Fix for 27 vulnerabilities #445

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

agup006
Copy link
Member

@agup006 agup006 commented Oct 10, 2023

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `rubygems` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • Gemfile
⚠️ Warning
Failed to update the Gemfile.lock, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Information Exposure
SNYK-RUBY-ACTIONCABLE-20338
Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-ACTIVESUPPORT-3237242
Yes No Known Exploit
medium severity 519/1000
Why? Has a fix available, CVSS 6.1
Cross-site Scripting (XSS)
SNYK-RUBY-ACTIVESUPPORT-3360028
Yes No Known Exploit
medium severity 429/1000
Why? Has a fix available, CVSS 4.3
Information Exposure
SNYK-RUBY-ACTIVESUPPORT-5851458
Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-LOOFAH-3168317
Yes No Known Exploit
medium severity 519/1000
Why? Has a fix available, CVSS 6.1
Cross-site Scripting (XSS)
SNYK-RUBY-LOOFAH-3168318
Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Uncontrolled Recursion
SNYK-RUBY-LOOFAH-3168649
Yes No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1
Use After Free
SNYK-RUBY-NOKOGIRI-2413994
Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-NOKOGIRI-2620374
Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Out-of-bounds Write
SNYK-RUBY-NOKOGIRI-2630623
Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Denial of Service (DoS)
SNYK-RUBY-NOKOGIRI-2630898
Yes No Known Exploit
high severity 624/1000
Why? Has a fix available, CVSS 8.2
Improper Handling of Unexpected Data Type
SNYK-RUBY-NOKOGIRI-2840634
Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5
NULL Pointer Dereference
SNYK-RUBY-NOKOGIRI-3052880
Yes No Known Exploit
medium severity 616/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.9
Web Cache Poisoning
SNYK-RUBY-RACK-1061917
Yes Proof of Concept
critical severity 704/1000
Why? Has a fix available, CVSS 9.8
Arbitrary Code Injection
SNYK-RUBY-RACK-2848599
Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Denial of Service (DoS)
SNYK-RUBY-RACK-2848600
Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3237233
Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3237237
Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3237240
Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Denial of Service (DoS)
SNYK-RUBY-RACK-3356639
Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3360233
Yes No Known Exploit
medium severity 531/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.2
Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-2935879
Yes Proof of Concept
medium severity 484/1000
Why? Has a fix available, CVSS 5.4
Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168316
Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168646
Yes No Known Exploit
medium severity 626/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.1
Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168647
Yes Proof of Concept
medium severity 424/1000
Why? Has a fix available, CVSS 4.2
Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168648
Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Directory Traversal
SNYK-RUBY-TZINFO-2958048
Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Cross-site Scripting (XSS)
🦉 Use After Free
🦉 More lessons are available in Snyk Learn

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants