Vulnerabilities

 2 via 3 paths

Dependencies

 39

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 2
Status
  • 2
  • 0
  • 0

high severity
new

Use After Free

  • Vulnerable module: json
  • Introduced through: r10k@5.0.3

Detailed paths

  • Introduced through: shinesolutions/aem-platform-buildenv@shinesolutions/aem-platform-buildenv › r10k@5.0.3 › puppet_forge@6.2.0 › faraday@2.14.3 › json@2.21.1
    Remediation: Upgrade to r10k@5.0.3.
  • Introduced through: shinesolutions/aem-platform-buildenv@shinesolutions/aem-platform-buildenv › r10k@5.0.3 › puppet_forge@6.2.0 › faraday-follow_redirects@0.5.0 › faraday@2.14.3 › json@2.21.1
    Remediation: Upgrade to r10k@5.0.3.

Overview

json is a JSON implementation as a Ruby extension in C.

Affected versions of this package are vulnerable to Use After Free through JSON::ResumableParser#partial_value in ext/json/ext/parser/parser.c. An attacker can crash the Ruby process by supplying truncated streaming JSON with duplicate object keys and causing the application to call partial_value on the incomplete parse. The vulnerable warning path computes a cursor position for resumable-parser deprecation messages after the parser has already cleared and released its input buffer, leaving stale pointers in state.start, state.cursor, and state.end. When that duplicate-key path runs, it dereferences freed memory and terminates the process.

Remediation

Upgrade json to version 2.21.2 or higher.

References

Use After Free vulnerability report

high severity

Improper Authentication

  • Vulnerable module: jwt
  • Introduced through: r10k@5.0.3

Detailed paths

  • Introduced through: shinesolutions/aem-platform-buildenv@shinesolutions/aem-platform-buildenv › r10k@5.0.3 › jwt@2.10.3

Overview

Affected versions of this package are vulnerable to Improper Authentication in the signing and verification logic before applying JWT.decode. An attacker can forge valid JWTs by supplying a crafted token that passes signature verification due to the acceptance of empty keys.

Note: This is only exploitable if the application passes an empty string as the key, or if the keyfinder returns an empty string, nil, or an array containing nil for unknown keys, and the enforce_hmac_key_length option is not enabled.

Remediation

Upgrade jwt to version 3.2.0 or higher.

References

Improper Authentication vulnerability report