Skip to content

Échec pipeline audit n°557269

Problème rencontré

Le pipeline 557269 a échoué :

$ bundle exec bundle audit check --update
Download ruby-advisory-db ...
Cloning into '/root/.local/share/ruby-advisory-db'...
ruby-advisory-db:
  advisories:	624 advisories
  last updated:	2022-12-13 14:53:31 -0800
  commit:	398654c20acb016e6b6a931b0f9fdd33f212f7de
Name: loofah
Version: 2.19.0
CVE: CVE-2022-23514
GHSA: GHSA-486f-hjj9-9vhh
Criticality: High
URL: https://github.com/flavorjones/loofah/security/advisories/GHSA-486f-hjj9-9vhh
Title: Inefficient Regular Expression Complexity in Loofah
Solution: upgrade to '>= 2.19.1'
Name: loofah
Version: 2.19.0
CVE: CVE-2022-23515
GHSA: GHSA-228g-948r-83gx
Criticality: Medium
URL: https://github.com/flavorjones/loofah/security/advisories/GHSA-228g-948r-83gx
Title: Improper neutralization of data URIs may allow XSS in Loofah
Solution: upgrade to '>= 2.19.1'
Name: loofah
Version: 2.19.0
CVE: CVE-2022-23516
GHSA: GHSA-3x8r-x6xp-q4vm
Criticality: High
URL: https://github.com/flavorjones/loofah/security/advisories/GHSA-3x8r-x6xp-q4vm
Title: Uncontrolled Recursion in Loofah
Solution: upgrade to '>= 2.19.1'
Name: rails-html-sanitizer
Version: 1.4.3
CVE: CVE-2022-23517
GHSA: GHSA-5x79-w82f-gw8w
Criticality: High
URL: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w
Title: Inefficient Regular Expression Complexity in rails-html-sanitizer
Solution: upgrade to '>= 1.4.4'
Name: rails-html-sanitizer
Version: 1.4.3
CVE: CVE-2022-23518
GHSA: GHSA-mcvf-2q2m-x72m
Criticality: Medium
URL: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-mcvf-2q2m-x72m
Title: Improper neutralization of data URIs may allow XSS in rails-html-sanitizer
Solution: upgrade to '>= 1.4.4'
Name: rails-html-sanitizer
Version: 1.4.3
CVE: CVE-2022-23519
GHSA: GHSA-9h9g-93gc-623h
Criticality: Unknown
URL: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-9h9g-93gc-623h
Title: Possible XSS vulnerability with certain configurations of rails-html-sanitizer
Solution: upgrade to '>= 1.4.4'
Name: rails-html-sanitizer
Version: 1.4.3
CVE: CVE-2022-23520
GHSA: GHSA-rrfc-7g8p-99q8
Criticality: Unknown
URL: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8
Title: Possible XSS vulnerability with certain configurations of rails-html-sanitizer
Solution: upgrade to '>= 1.4.4'
Vulnerabilities found!

Comment reproduire ?

  1. Considérant le code de Filaé
  2. Lorsque je lance make audit-api
  3. Alors j'ai le message d'erreur ci-dessus

Comportement attendu

  1. Considérant le code de Filaé
  2. Lorsque je lance make audit-api
  3. Alors je n'ai pas de message d'erreur