Vulnerabilities |
1 via 15 paths |
|---|---|
Dependencies |
72 |
Source |
GitHub |
Find, fix and prevent vulnerabilities in your code.
high severity
new
- Vulnerable module: json
- Introduced through: grape-slack-bot@2.1.0, rubocop-rspec@3.8.0 and others
Detailed paths
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › grape-slack-bot@2.1.0 › activesupport@8.1.3 › json@2.20.0-javaRemediation: Upgrade to grape-slack-bot@2.1.0.
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › grape-slack-bot@2.1.0 › faraday@2.14.3 › json@2.20.0-javaRemediation: Upgrade to grape-slack-bot@2.1.0.
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › rubocop-rspec@3.8.0 › rubocop@1.81.7 › json@2.20.0-javaRemediation: Upgrade to rubocop-rspec@3.8.0.
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › rubocop-thread_safety@0.7.3 › rubocop@1.81.7 › json@2.20.0-javaRemediation: Upgrade to rubocop-thread_safety@0.7.3.
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › standard-custom@1.0.2 › rubocop@1.81.7 › json@2.20.0-javaRemediation: Upgrade to standard-custom@1.0.2.
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › standard@1.52.0 › rubocop@1.81.7 › json@2.20.0-javaRemediation: Upgrade to standard@1.52.0.
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › grape-slack-bot@2.1.0 › grape@3.2.1 › activesupport@8.1.3 › json@2.20.0-javaRemediation: Upgrade to grape-slack-bot@2.1.0.
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › standard-rspec@0.3.1 › rubocop-rspec@3.8.0 › rubocop@1.81.7 › json@2.20.0-javaRemediation: Upgrade to standard-rspec@0.3.1.
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › standard@1.52.0 › standard-custom@1.0.2 › rubocop@1.81.7 › json@2.20.0-javaRemediation: Upgrade to standard@1.52.0.
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › standard-performance@1.8.0 › rubocop-performance@1.25.0 › rubocop@1.81.7 › json@2.20.0-javaRemediation: Upgrade to standard-performance@1.8.0.
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › standard-rspec@0.3.1 › rubocop-capybara@2.22.1 › rubocop@1.81.7 › json@2.20.0-javaRemediation: Upgrade to standard-rspec@0.3.1.
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › standard-rspec@0.3.1 › rubocop-factory_bot@2.28.0 › rubocop@1.81.7 › json@2.20.0-javaRemediation: Upgrade to standard-rspec@0.3.1.
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › standard-rspec@0.3.1 › rubocop-rspec_rails@2.32.0 › rubocop@1.81.7 › json@2.20.0-javaRemediation: Upgrade to standard-rspec@0.3.1.
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › standard-rspec@0.3.1 › rubocop-rspec_rails@2.32.0 › rubocop-rspec@3.8.0 › rubocop@1.81.7 › json@2.20.0-javaRemediation: Upgrade to standard-rspec@0.3.1.
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › standard@1.52.0 › standard-performance@1.8.0 › rubocop-performance@1.25.0 › rubocop@1.81.7 › json@2.20.0-javaRemediation: Upgrade to standard@1.52.0.
Overview
json is a JSON implementation as a Ruby extension in C.
Affected versions of this package are vulnerable to Use After Free through JSON::ResumableParser#partial_value in ext/json/ext/parser/parser.c. An attacker can crash the Ruby process by supplying truncated streaming JSON with duplicate object keys and causing the application to call partial_value on the incomplete parse. The vulnerable warning path computes a cursor position for resumable-parser deprecation messages after the parser has already cleared and released its input buffer, leaving stale pointers in state.start, state.cursor, and state.end. When that duplicate-key path runs, it dereferences freed memory and terminates the process.
Remediation
Upgrade json to version 2.21.2 or higher.
References
high severity
- Module: bundler-audit
- Introduced through: bundler-audit@0.9.3
Detailed paths
-
Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb › bundler-audit@0.9.3
GPL-3.0 license