Vulnerabilities

1 via 15 paths

Dependencies

72

Source

GitHub

Find, fix and prevent vulnerabilities in your code.

Issue type
  • 1
  • 1
Severity
  • 2
Status
  • 2
  • 0
  • 0

high severity
new

Use After Free

  • Vulnerable module: json
  • Introduced through: grape-slack-bot@2.1.0, rubocop-rspec@3.8.0 and others

Detailed paths

  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb grape-slack-bot@2.1.0 activesupport@8.1.3 json@2.20.0-java
    Remediation: Upgrade to grape-slack-bot@2.1.0.
  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb grape-slack-bot@2.1.0 faraday@2.14.3 json@2.20.0-java
    Remediation: Upgrade to grape-slack-bot@2.1.0.
  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb rubocop-rspec@3.8.0 rubocop@1.81.7 json@2.20.0-java
    Remediation: Upgrade to rubocop-rspec@3.8.0.
  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb rubocop-thread_safety@0.7.3 rubocop@1.81.7 json@2.20.0-java
    Remediation: Upgrade to rubocop-thread_safety@0.7.3.
  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb standard-custom@1.0.2 rubocop@1.81.7 json@2.20.0-java
    Remediation: Upgrade to standard-custom@1.0.2.
  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb standard@1.52.0 rubocop@1.81.7 json@2.20.0-java
    Remediation: Upgrade to standard@1.52.0.
  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb grape-slack-bot@2.1.0 grape@3.2.1 activesupport@8.1.3 json@2.20.0-java
    Remediation: Upgrade to grape-slack-bot@2.1.0.
  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb standard-rspec@0.3.1 rubocop-rspec@3.8.0 rubocop@1.81.7 json@2.20.0-java
    Remediation: Upgrade to standard-rspec@0.3.1.
  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb standard@1.52.0 standard-custom@1.0.2 rubocop@1.81.7 json@2.20.0-java
    Remediation: Upgrade to standard@1.52.0.
  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb standard-performance@1.8.0 rubocop-performance@1.25.0 rubocop@1.81.7 json@2.20.0-java
    Remediation: Upgrade to standard-performance@1.8.0.
  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb standard-rspec@0.3.1 rubocop-capybara@2.22.1 rubocop@1.81.7 json@2.20.0-java
    Remediation: Upgrade to standard-rspec@0.3.1.
  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb standard-rspec@0.3.1 rubocop-factory_bot@2.28.0 rubocop@1.81.7 json@2.20.0-java
    Remediation: Upgrade to standard-rspec@0.3.1.
  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb standard-rspec@0.3.1 rubocop-rspec_rails@2.32.0 rubocop@1.81.7 json@2.20.0-java
    Remediation: Upgrade to standard-rspec@0.3.1.
  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb standard-rspec@0.3.1 rubocop-rspec_rails@2.32.0 rubocop-rspec@3.8.0 rubocop@1.81.7 json@2.20.0-java
    Remediation: Upgrade to standard-rspec@0.3.1.
  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb standard@1.52.0 standard-performance@1.8.0 rubocop-performance@1.25.0 rubocop@1.81.7 json@2.20.0-java
    Remediation: Upgrade to standard@1.52.0.

Overview

json is a JSON implementation as a Ruby extension in C.

Affected versions of this package are vulnerable to Use After Free through JSON::ResumableParser#partial_value in ext/json/ext/parser/parser.c. An attacker can crash the Ruby process by supplying truncated streaming JSON with duplicate object keys and causing the application to call partial_value on the incomplete parse. The vulnerable warning path computes a cursor position for resumable-parser deprecation messages after the parser has already cleared and released its input buffer, leaving stale pointers in state.start, state.cursor, and state.end. When that duplicate-key path runs, it dereferences freed memory and terminates the process.

Remediation

Upgrade json to version 2.21.2 or higher.

References

high severity

GPL-3.0 license

  • Module: bundler-audit
  • Introduced through: bundler-audit@0.9.3

Detailed paths

  • Introduced through: amkisko/grape-slack-bot.rb@amkisko/grape-slack-bot.rb bundler-audit@0.9.3

GPL-3.0 license