Skip to content

Échec pipeline audit n°542626

Problème rencontré

Le pipeline 542626 a échoué :

$ bundle exec bundle audit check --update
Download ruby-advisory-db ...
Cloning into '/root/.local/share/ruby-advisory-db'...
ruby-advisory-db:
  advisories:	611 advisories
  last updated:	2022-10-18 16:48:59 -0700
Name: nokogiri
Version: 1.13.7
GHSA: GHSA-2qc6-mcvw-92cw
Criticality: Unknown
URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2qc6-mcvw-92cw
Title: Update bundled libxml2 to v2.10.3 to resolve multiple CVEs
Solution: upgrade to >= 1.13.9
Name: pdfkit
Version: 0.8.4.3.2
CVE: CVE-2022-25765
GHSA: GHSA-rhwx-hjx2-x4qr
Criticality: Unknown
URL: https://github.com/pdfkit/pdfkit/blob/46cdf53ec540da1a1a2e4da979e3e5fe2f92a257/lib/pdfkit/pdfkit.rb#L55-L58
Title: PDFKit vulnerable to Command Injection
Solution: upgrade to >= 0.8.7.2
Vulnerabilities found!

Comment reproduire ?

  1. Considérant le code de Filaé
  2. Lorsque je lance make audit-api
  3. Alors j'ai le message d'erreur ci-dessus

Comportement attendu

  1. Considérant le code de Filaé
  2. Lorsque je lance make audit-api
  3. Alors je n'ai pas de message d'erreur