wiseadvice_public_repos
/
bundle-audit-results
3
0
Fork 0
Code Wiki

commit by to_remotes 2025-02-20 08:06:17 +0100 from cicd

main
cicd 2025-02-20 08:06:17 +01:00
parent c39873f273
commit ac81431937
4 changed files with 19 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bundle-audit-time.txt
View File

@ -1 +1 @@
2025-02-19T14:10:29+01:00 2025-02-20T08:06:16+01:00

2
bundle-audit.json
View File

@ -1 +1 @@
{"version":"0.9.2","created_at":"2025-02-19 14:10:29 +0100","results":[]} {"version":"0.9.2","created_at":"2025-02-20 08:06:16 +0100","results":[{"type":"unpatched_gem","gem":{"name":"nokogiri","version":"1.18.1"},"advisory":{"path":"/home/wiseadvice/.local/share/ruby-advisory-db/gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml","id":"GHSA-vvfq-8hwr-qm4m","url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m","title":"Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171","date":"2025-02-18","description":"## Summary\n\nNokogiri v1.18.3 upgrades its dependency libxml2 to\n[v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).\n\nlibxml2 v2.13.6 addresses:\n\n- CVE-2025-24928\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847\n- CVE-2024-56171\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828\n\n## Impact\n\n### CVE-2025-24928\n\nStack-buffer overflow is possible when reporting DTD validation\nerrors if the input contains a long (~3kb) QName prefix.\n\n### CVE-2024-56171\n\nUse-after-free is possible during validation against untrusted\nXML Schemas (.xsd) and, potentially, validation of untrusted documents\nagainst trusted Schemas if they make use of `xsd:keyref` in combination\nwith recursively defined types that have additional identity constraints.\n","cvss_v2":null,"cvss_v3":null,"cve":null,"osvdb":null,"ghsa":"vvfq-8hwr-qm4m","unaffected_versions":[],"patched_versions":[">= 1.18.3"],"criticality":null}}]}

10
report.txt
View File

@ -1 +1,9 @@
No vulnerabilities found Name: nokogiri
Version: 1.18.1
GHSA: GHSA-vvfq-8hwr-qm4m
Criticality: Unknown
URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m
Title: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171
Solution: update to '>= 1.18.3'
Vulnerabilities found!

12
update-info.txt
View File

@ -1,7 +1,11 @@
Updating ruby-advisory-db ... Updating ruby-advisory-db ...
Already up to date. Updating eb74560..1c7f2a8
Fast-forward
gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml | 39 +++++++++++++++++++++++++++++++++++
1 file changed, 39 insertions(+)
create mode 100644 gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml
Updated ruby-advisory-db Updated ruby-advisory-db
ruby-advisory-db: ruby-advisory-db:
advisories: 958 advisories advisories: 959 advisories
last updated: 2025-02-17 14:45:53 -0800 last updated: 2025-02-19 11:00:04 -0800
commit: eb74560c15577e2cc22d6d260057b5b60d57b18b commit: 1c7f2a870f4bb00120e25ce7301fe5e3f238bd94