From 5a644f3de450865ea58bf8fb911e31bfc303f407 Mon Sep 17 00:00:00 2001 From: cicd Date: Thu, 26 Sep 2024 11:33:40 +0200 Subject: [PATCH] commit by to_remotes 2024-09-26 11:33:40 +0200 from cicd --- bundle-audit-time.txt | 2 +- bundle-audit.json | 2 +- report.txt | 11 +---------- 3 files changed, 3 insertions(+), 12 deletions(-) diff --git a/bundle-audit-time.txt b/bundle-audit-time.txt index f283967..c7d181b 100644 --- a/bundle-audit-time.txt +++ b/bundle-audit-time.txt @@ -1 +1 @@ -2024-09-26T11:32:46+02:00 +2024-09-26T11:33:40+02:00 diff --git a/bundle-audit.json b/bundle-audit.json index 793bad6..dd7bcbb 100644 --- a/bundle-audit.json +++ b/bundle-audit.json @@ -1 +1 @@ -{"version":"0.9.2","created_at":"2024-09-26 11:32:45 +0200","results":[{"type":"unpatched_gem","gem":{"name":"webrick","version":"1.8.1"},"advisory":{"path":"/home/wiseadvice/.local/share/ruby-advisory-db/gems/webrick/CVE-2024-47220.yml","id":"CVE-2024-47220","url":"https://github.com/advisories/GHSA-6f62-3596-g6w7","title":"HTTP Request Smuggling in ruby webrick","date":"2024-09-22","description":"An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby.\nIt allows HTTP request smuggling by providing both a Content-Length\nheader and a Transfer-Encoding header, e.g.,\n\"GET /admin HTTP/1.1\\r\\n\" inside of a \"POST /user HTTP/1.1\\r\\n\"\nrequest.\n\nNOTE: the supplier''s position is \"Webrick should not be used in production.\"\n","cvss_v2":null,"cvss_v3":7.5,"cve":"2024-47220","osvdb":null,"ghsa":"6f62-3596-g6w7","unaffected_versions":[],"patched_versions":[">= 1.8.2"],"criticality":"high"}}]} \ No newline at end of file +{"version":"0.9.2","created_at":"2024-09-26 11:33:40 +0200","results":[]} \ No newline at end of file diff --git a/report.txt b/report.txt index b6f4cee..8900c02 100644 --- a/report.txt +++ b/report.txt @@ -1,10 +1 @@ -Name: webrick -Version: 1.8.1 -CVE: CVE-2024-47220 -GHSA: GHSA-6f62-3596-g6w7 -Criticality: High -URL: https://github.com/advisories/GHSA-6f62-3596-g6w7 -Title: HTTP Request Smuggling in ruby webrick -Solution: update to '>= 1.8.2' - -Vulnerabilities found! +No vulnerabilities found