-
Notifications
You must be signed in to change notification settings - Fork 1.9k
Bundler Audit Parser - Support for GHSA-Only Findings #9649
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
6 commits
Select commit
Hold shift + click to select a range
2d125c8
Add support for findings with a GHSA but no CVE
rh0dy 2f7fe9e
Update unit test to handle case with GHSA but no CVE
rh0dy 26051c8
Format JSON so it's human readable
rh0dy 626defd
Also populate the CVE field to be as flexible as possible
rh0dy b325c3a
Unit tests to check cve value
rh0dy d03f3ae
Add new line at bottom of file to fix linting issue
rh0dy File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1,118 @@ | ||
| {"version":"0.9.0.1","created_at":"2021-09-16 19:25:23 +0200","results":[{"type":"unpatched_gem","gem":{"name":"rack","version":"1.6.13"},"advisory":{"path":"/home/damien/.local/share/ruby-advisory-db/gems/rack/CVE-2020-8161.yml","id":"CVE-2020-8161","url":"https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA","title":"Directory traversal in Rack::Directory app bundled with Rack","date":"2020-05-12","description":"There was a possible directory traversal vulnerability in the Rack::Directory app\nthat is bundled with Rack.\n\nVersions Affected: rack < 2.2.0\nNot affected: Applications that do not use Rack::Directory.\nFixed Versions: 2.1.3, >= 2.2.0\n\nImpact\n------\n\nIf certain directories exist in a director that is managed by\n`Rack::Directory`, an attacker could, using this vulnerability, read the\ncontents of files on the server that were outside of the root specified in the\nRack::Directory initializer.\n\nWorkarounds\n-----------\n\nUntil such time as the patch is applied or their Rack version is upgraded,\nwe recommend that developers do not use Rack::Directory in their\napplications.\n","cvss_v2":null,"cvss_v3":null,"cve":"2020-8161","osvdb":null,"ghsa":"5f9h-9pjv-v6j7","unaffected_versions":[],"patched_versions":["~> 2.1.3",">= 2.2.0"],"criticality":null}},{"type":"unpatched_gem","gem":{"name":"rack","version":"1.6.13"},"advisory":{"path":"/home/damien/.local/share/ruby-advisory-db/gems/rack/CVE-2020-8184.yml","id":"CVE-2020-8184","url":"https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak","title":"Percent-encoded cookies can be used to overwrite existing prefixed cookie names","date":"2020-06-15","description":"It is possible to forge a secure or host-only cookie prefix in Rack using\nan arbitrary cookie write by using URL encoding (percent-encoding) on the\nname of the cookie. This could result in an application that is dependent on\nthis prefix to determine if a cookie is safe to process being manipulated\ninto processing an insecure or cross-origin request.\nThis vulnerability has been assigned the CVE identifier CVE-2020-8184.\n\nVersions Affected: rack < 2.2.3, rack < 2.1.4\nNot affected: Applications which do not rely on __Host- and __Secure- prefixes to determine if a cookie is safe to process\nFixed Versions: rack >= 2.2.3, rack >= 2.1.4\n\nImpact\n------\n\nAn attacker may be able to trick a vulnerable application into processing an\ninsecure (non-SSL) or cross-origin request if they can gain the ability to write\narbitrary cookies that are sent to the application.\n\nWorkarounds\n-----------\n\nIf your application is impacted but you cannot upgrade to the released versions or apply\nthe provided patch, this issue can be temporarily addressed by adding the following workaround:\n\n```\nmodule Rack\n module Utils\n module_function def parse_cookies_header(header)\n return {} unless header\n header.split(/[;] */n).each_with_object({}) do |cookie, cookies|\n next if cookie.empty?\n key, value = cookie.split('=', 2)\n cookies[key] = (unescape(value) rescue value) unless cookies.key?(key)\n end\n end\n end\nend\n```\n","cvss_v2":null,"cvss_v3":null,"cve":"2020-8184","osvdb":null,"ghsa":"j6w9-fv6q-3q52","unaffected_versions":[],"patched_versions":["~> 2.1.4",">= 2.2.3"],"criticality":null}},{"type":"unpatched_gem","gem":{"name":"sprockets","version":"2.2.3"},"advisory":{"path":"/home/damien/.local/share/ruby-advisory-db/gems/sprockets/CVE-2018-3760.yml","id":"CVE-2018-3760","url":"https://groups.google.com/forum/#!topic/ruby-security-ann/2S9Pwz2i16k","title":"Path Traversal in Sprockets","date":"2018-06-19","description":"Specially crafted requests can be used to access files that exist on\nthe filesystem that is outside an application's root directory, when the\nSprockets server is used in production.\n\nAll users running an affected release should either upgrade or use one of the work arounds immediately.\n\nWorkaround:\nIn Rails applications, work around this issue, set `config.assets.compile = false` and\n`config.public_file_server.enabled = true` in an initializer and precompile the assets.\n\n This work around will not be possible in all hosting environments and upgrading is advised.\n","cvss_v2":null,"cvss_v3":null,"cve":"2018-3760","osvdb":null,"ghsa":"pr3h-jjhj-573x","unaffected_versions":[],"patched_versions":[">= 2.12.5, < 3.0.0",">= 3.7.2, < 4.0.0",">= 4.0.0.beta8"],"criticality":null}}]} | ||
| { | ||
| "version":"0.9.0.1", | ||
| "created_at":"2021-09-16 19:25:23 +0200", | ||
| "results":[ | ||
| { | ||
| "type":"unpatched_gem", | ||
| "gem":{ | ||
| "name":"rack", | ||
| "version":"1.6.13" | ||
| }, | ||
| "advisory":{ | ||
| "path":"/home/damien/.local/share/ruby-advisory-db/gems/rack/CVE-2020-8161.yml", | ||
| "id":"CVE-2020-8161", | ||
| "url":"https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA", | ||
| "title":"Directory traversal in Rack::Directory app bundled with Rack", | ||
| "date":"2020-05-12", | ||
| "description":"There was a possible directory traversal vulnerability in the Rack::Directory app\nthat is bundled with Rack.\n\nVersions Affected: rack < 2.2.0\nNot affected: Applications that do not use Rack::Directory.\nFixed Versions: 2.1.3, >= 2.2.0\n\nImpact\n------\n\nIf certain directories exist in a director that is managed by\n`Rack::Directory`, an attacker could, using this vulnerability, read the\ncontents of files on the server that were outside of the root specified in the\nRack::Directory initializer.\n\nWorkarounds\n-----------\n\nUntil such time as the patch is applied or their Rack version is upgraded,\nwe recommend that developers do not use Rack::Directory in their\napplications.\n", | ||
| "cvss_v2":null, | ||
| "cvss_v3":null, | ||
| "cve":"2020-8161", | ||
| "osvdb":null, | ||
| "ghsa":"5f9h-9pjv-v6j7", | ||
| "unaffected_versions":[ | ||
|
|
||
| ], | ||
| "patched_versions":[ | ||
| "~> 2.1.3", | ||
| ">= 2.2.0" | ||
| ], | ||
| "criticality":null | ||
| } | ||
| }, | ||
| { | ||
| "type":"unpatched_gem", | ||
| "gem":{ | ||
| "name":"rack", | ||
| "version":"1.6.13" | ||
| }, | ||
| "advisory":{ | ||
| "path":"/home/damien/.local/share/ruby-advisory-db/gems/rack/CVE-2020-8184.yml", | ||
| "id":"CVE-2020-8184", | ||
| "url":"https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak", | ||
| "title":"Percent-encoded cookies can be used to overwrite existing prefixed cookie names", | ||
| "date":"2020-06-15", | ||
| "description":"It is possible to forge a secure or host-only cookie prefix in Rack using\nan arbitrary cookie write by using URL encoding (percent-encoding) on the\nname of the cookie. This could result in an application that is dependent on\nthis prefix to determine if a cookie is safe to process being manipulated\ninto processing an insecure or cross-origin request.\nThis vulnerability has been assigned the CVE identifier CVE-2020-8184.\n\nVersions Affected: rack < 2.2.3, rack < 2.1.4\nNot affected: Applications which do not rely on __Host- and __Secure- prefixes to determine if a cookie is safe to process\nFixed Versions: rack >= 2.2.3, rack >= 2.1.4\n\nImpact\n------\n\nAn attacker may be able to trick a vulnerable application into processing an\ninsecure (non-SSL) or cross-origin request if they can gain the ability to write\narbitrary cookies that are sent to the application.\n\nWorkarounds\n-----------\n\nIf your application is impacted but you cannot upgrade to the released versions or apply\nthe provided patch, this issue can be temporarily addressed by adding the following workaround:\n\n```\nmodule Rack\n module Utils\n module_function def parse_cookies_header(header)\n return {} unless header\n header.split(/[;] */n).each_with_object({}) do |cookie, cookies|\n next if cookie.empty?\n key, value = cookie.split('=', 2)\n cookies[key] = (unescape(value) rescue value) unless cookies.key?(key)\n end\n end\n end\nend\n```\n", | ||
| "cvss_v2":null, | ||
| "cvss_v3":null, | ||
| "cve":"2020-8184", | ||
| "osvdb":null, | ||
| "ghsa":"j6w9-fv6q-3q52", | ||
| "unaffected_versions":[ | ||
|
|
||
| ], | ||
| "patched_versions":[ | ||
| "~> 2.1.4", | ||
| ">= 2.2.3" | ||
| ], | ||
| "criticality":null | ||
| } | ||
| }, | ||
| { | ||
| "type":"unpatched_gem", | ||
| "gem":{ | ||
| "name":"sprockets", | ||
| "version":"2.2.3" | ||
| }, | ||
| "advisory":{ | ||
| "path":"/home/damien/.local/share/ruby-advisory-db/gems/sprockets/CVE-2018-3760.yml", | ||
| "id":"CVE-2018-3760", | ||
| "url":"https://groups.google.com/forum/#!topic/ruby-security-ann/2S9Pwz2i16k", | ||
| "title":"Path Traversal in Sprockets", | ||
| "date":"2018-06-19", | ||
| "description":"Specially crafted requests can be used to access files that exist on\nthe filesystem that is outside an application's root directory, when the\nSprockets server is used in production.\n\nAll users running an affected release should either upgrade or use one of the work arounds immediately.\n\nWorkaround:\nIn Rails applications, work around this issue, set `config.assets.compile = false` and\n`config.public_file_server.enabled = true` in an initializer and precompile the assets.\n\n This work around will not be possible in all hosting environments and upgrading is advised.\n", | ||
| "cvss_v2":null, | ||
| "cvss_v3":null, | ||
| "cve":"2018-3760", | ||
| "osvdb":null, | ||
| "ghsa":"pr3h-jjhj-573x", | ||
| "unaffected_versions":[ | ||
|
|
||
| ], | ||
| "patched_versions":[ | ||
| ">= 2.12.5, < 3.0.0", | ||
| ">= 3.7.2, < 4.0.0", | ||
| ">= 4.0.0.beta8" | ||
| ], | ||
| "criticality":null | ||
| } | ||
| }, | ||
| { | ||
| "type":"unpatched_gem", | ||
| "gem":{ | ||
| "name":"nokogiri", | ||
| "version":"1.15.2" | ||
| }, | ||
| "advisory":{ | ||
| "path":"/home/damien/.local/share/ruby-advisory-db/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml", | ||
| "id":"GHSA-xc9x-jj77-9p9j", | ||
| "url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j", | ||
| "title":"Improper Handling of Unexpected Data Type in Nokogiri", | ||
| "date":"2024-02-04", | ||
| "description":"Nokogiri updates packaged libxml2 to v2.12.5 to resolve CVE-2024-25062.\n", | ||
| "cvss_v2":null, | ||
| "cvss_v3":null, | ||
| "cve":null, | ||
| "osvdb":null, | ||
| "ghsa":"GHSA-xc9x-jj77-9p9j", | ||
| "unaffected_versions":[ | ||
|
|
||
| ], | ||
| "patched_versions":[ | ||
| ">= 1.16.2" | ||
| ], | ||
| "criticality":null | ||
| } | ||
| } | ||
| ] | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.