Skip to content

Échec pipeline audit n°584746

Problème rencontré

Le pipeline 584746 a échoué :

$ bundle exec bundle audit check --update
Download ruby-advisory-db ...
Cloning into '/root/.local/share/ruby-advisory-db'...
ruby-advisory-db:
  advisories:	689 advisories
  last updated:	2023-03-17 16:41:49 -0700
  commit:	d15c57b99d90f5db77f9a42978aec3f086f4add5
Name: activesupport
Version: 6.1.7.1
CVE: CVE-2023-28120
Criticality: Unknown
URL: https://discuss.rubyonrails.org/t/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice/82469
Title: Possible XSS Security Vulnerability in SafeBuffer#bytesplice
Solution: upgrade to '~> 6.1.7, >= 6.1.7.3', '>= 7.0.4.3'
Name: rack
Version: 2.2.6.3
CVE: CVE-2023-27539
Criticality: Unknown
URL: https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466
Title: Possible Denial of Service Vulnerability in Rack’s header parsing
Solution: upgrade to '~> 2.0, >= 2.2.6.4', '>= 3.0.6.1'
Vulnerabilities found!
Cleaning up project directory and file based variables 00:00
ERROR: Job failed: exit code 1

Comment reproduire ?

  1. Considérant le code de Filaé
  2. Lorsque je lance make audit-api
  3. Alors j'ai le message d'erreur ci-dessus

Comportement attendu

  1. Considérant le code de Filaé
  2. Lorsque je lance make audit-api
  3. Alors je n'ai pas de message d'erreur