jbuilder-2.9.1.gem: 4 vulnerabilities (highest severity is: 9.8)

[mend-for-github-com]

Vulnerable Library - jbuilder-2.9.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /tmp/containerbase/cache/.ruby/cache/activesupport-5.2.3.gem

Found in HEAD commit: 84d8c4c8d5cfac4705d302f9b44c063177f8ae86

Vulnerabilities

Vulnerability	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (jbuilder version)	Remediation Possible**	Reachability
CVE-2020-8165	Critical	9.8	Not Defined	90.100006%	activesupport-5.2.3.gem	Transitive	N/A*	❌
CVE-2023-22796	High	7.5	Not Defined	1.5%	activesupport-5.2.3.gem	Transitive	N/A*	❌
CVE-2022-31163	High	7.5	Not Defined	5.2000003%	tzinfo-1.2.5.gem	Transitive	N/A*	❌
CVE-2023-38037	Medium	5.5	Not Defined	0.1%	activesupport-5.2.3.gem	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-8165

Vulnerable Library - activesupport-5.2.3.gem

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Library home page: https://rubygems.org/gems/activesupport-5.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /tmp/containerbase/cache/.ruby/cache/activesupport-5.2.3.gem

Dependency Hierarchy:

• jbuilder-2.9.1.gem (Root Library)
  • ❌ activesupport-5.2.3.gem (Vulnerable Library)

Found in HEAD commit: 84d8c4c8d5cfac4705d302f9b44c063177f8ae86

Found in base branch: main

Vulnerability Details

A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

Publish Date: 2020-06-19

URL: CVE-2020-8165

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 90.100006%

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2p68-f74v-9wc6

Release Date: 2020-06-19

Fix Resolution: activesupport - 5.2.4.3,activesupport - 6.0.3.1

CVE-2023-22796

Vulnerable Library - activesupport-5.2.3.gem

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Library home page: https://rubygems.org/gems/activesupport-5.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /tmp/containerbase/cache/.ruby/cache/activesupport-5.2.3.gem

Dependency Hierarchy:

• jbuilder-2.9.1.gem (Root Library)
  • ❌ activesupport-5.2.3.gem (Vulnerable Library)

Found in HEAD commit: 84d8c4c8d5cfac4705d302f9b44c063177f8ae86

Found in base branch: main

Vulnerability Details

A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.

Publish Date: 2023-02-09

URL: CVE-2023-22796

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 1.5%

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-j6gc-792m-qgm2

Release Date: 2023-02-09

Fix Resolution: activesupport - 6.1.7.1,7.0.4.1

CVE-2022-31163

Vulnerable Library - tzinfo-1.2.5.gem

TZInfo provides daylight savings aware transformations between times in different time zones.

Library home page: https://rubygems.org/gems/tzinfo-1.2.5.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /tmp/containerbase/cache/.ruby/cache/tzinfo-1.2.5.gem

Dependency Hierarchy:

• jbuilder-2.9.1.gem (Root Library)
  • activesupport-5.2.3.gem
    • ❌ tzinfo-1.2.5.gem (Vulnerable Library)

Found in HEAD commit: 84d8c4c8d5cfac4705d302f9b44c063177f8ae86

Found in base branch: main

Vulnerability Details

TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source, time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with require on demand. In the affected versions, TZInfo::Timezone.get fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, TZInfo::Timezone.get can be made to load unintended files with require, executing them within the Ruby process. Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Versions 2.0.0 and later are not vulnerable. Version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of tzinfo/definition within a directory in the load path. Applications should ensure that untrusted files are not placed in a directory on the load path. As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.

Publish Date: 2022-07-21

URL: CVE-2022-31163

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 5.2000003%

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5cm2-9h8c-rvfx

Release Date: 2022-07-21

Fix Resolution: tzinfo - 0.3.61,tzinfo - 1.2.10

CVE-2023-38037

Vulnerable Library - activesupport-5.2.3.gem

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Library home page: https://rubygems.org/gems/activesupport-5.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /tmp/containerbase/cache/.ruby/cache/activesupport-5.2.3.gem

Dependency Hierarchy:

• jbuilder-2.9.1.gem (Root Library)
  • ❌ activesupport-5.2.3.gem (Vulnerable Library)

Found in HEAD commit: 84d8c4c8d5cfac4705d302f9b44c063177f8ae86

Found in base branch: main

Vulnerability Details

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current "umask" settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it. All users running an affected release should either upgrade or use one of the workarounds immediately.

Publish Date: 2025-01-09

URL: CVE-2023-38037

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cr5q-6q9f-rq6q

Release Date: 2025-01-09

Fix Resolution: activesupport - 6.1.7.5,activesupport - 7.0.7.1