Skip to content

Échec pipeline audit n°567101

Problème rencontré

Le pipeline 567101 a échoué :

$ bundle exec bundle audit check --update
Download ruby-advisory-db ...
Cloning into '/root/.local/share/ruby-advisory-db'...
ruby-advisory-db:
  advisories:	643 advisories
  last updated:	2023-01-19 21:58:44 -0500
  commit:	6a79ac904984dd75c13ace6d5373e727bee52fb8
Name: actionpack
Version: 6.1.7
CVE: CVE-2023-22792
GHSA: GHSA-p84v-45xj-wwqj
Criticality: Unknown
URL: https://github.com/rails/rails/releases/tag/v7.0.4.1
Title: ReDoS based DoS vulnerability in Action Dispatch
Solution: upgrade to '~> 6.1.7, >= 6.1.7.1', '>= 7.0.4.1'
Name: actionpack
Version: 6.1.7
CVE: CVE-2023-22795
GHSA: GHSA-8xww-x3g3-6jcv
Criticality: Unknown
URL: https://github.com/rails/rails/releases/tag/v7.0.4.1
Title: ReDoS based DoS vulnerability in Action Dispatch
Solution: upgrade to '~> 6.1.7, >= 6.1.7.1', '>= 7.0.4.1'
Name: activerecord
Version: 6.1.7
CVE: CVE-2022-44566
GHSA: GHSA-579w-22j4-4749
Criticality: Unknown
URL: https://github.com/rails/rails/releases/tag/v7.0.4.1
Title: Denial of Service Vulnerability in ActiveRecord’s PostgreSQL adapter
Solution: upgrade to '~> 6.1.7, >= 6.1.7.1', '>= 7.0.4.1'
Name: activerecord
Version: 6.1.7
CVE: CVE-2023-22794
GHSA: GHSA-hq7p-j377-6v63
Criticality: Unknown
URL: https://github.com/rails/rails/releases/tag/v7.0.4.1
Title: SQL Injection Vulnerability via ActiveRecord comments
Solution: upgrade to '~> 6.0.6, >= 6.0.6.1', '~> 6.1.7, >= 6.1.7.1', '>= 7.0.4.1'
Name: activesupport
Version: 6.1.7
CVE: CVE-2023-22796
GHSA: GHSA-j6gc-792m-qgm2
Criticality: Unknown
URL: https://github.com/rails/rails/releases/tag/v7.0.4.1
Title: ReDoS based DoS vulnerability in Active Support’s underscore
Solution: upgrade to '~> 6.1.7, >= 6.1.7.1', '>= 7.0.4.1'
Name: globalid
Version: 1.0.0
CVE: CVE-2023-22799
GHSA: GHSA-23c2-gwp5-pxw9
Criticality: Unknown
URL: https://github.com/rails/globalid/releases/tag/v1.0.1
Title: ReDoS based DoS vulnerability in GlobalID
Solution: upgrade to '>= 1.0.1'
Name: rack
Version: 2.2.4
CVE: CVE-2022-44570
GHSA: GHSA-65f5-mfpf-vfhj
Criticality: Unknown
URL: https://github.com/rack/rack/releases/tag/v3.0.4.1
Title: Denial of service via header parsing in Rack
Solution: upgrade to '~> 2.0.9, >= 2.0.9.2', '~> 2.1.4, >= 2.1.4.2', '~> 2.2.6, >= 2.2.6.2', '>= 3.0.4.1'
Name: rack
Version: 2.2.4
CVE: CVE-2022-44571
GHSA: GHSA-93pm-5p5f-3ghx
Criticality: Unknown
URL: https://github.com/rack/rack/releases/tag/v3.0.4.1
Title: Denial of Service Vulnerability in Rack Content-Disposition parsing
Solution: upgrade to '~> 2.0.9, >= 2.0.9.2', '~> 2.1.4, >= 2.1.4.2', '~> 2.2.6, >= 2.2.6.1', '>= 3.0.4.1'
Name: rack
Version: 2.2.4
CVE: CVE-2022-44572
GHSA: GHSA-rqv2-275x-2jq5
Criticality: Unknown
URL: https://github.com/rack/rack/releases/tag/v3.0.4.1
Title: Denial of service via multipart parsing in Rack
Solution: upgrade to '~> 2.0.9, >= 2.0.9.2', '~> 2.1.4, >= 2.1.4.2', '~> 2.2.6, >= 2.2.6.1', '>= 3.0.4.1'
Vulnerabilities found!

Comment reproduire ?

  1. Considérant le code de Filaé
  2. Lorsque je lance make audit-api
  3. Alors j'ai le message d'erreur ci-dessus

Comportement attendu

  1. Considérant le code de Filaé
  2. Lorsque je lance make audit-api
  3. Alors je n'ai pas de message d'erreur