manageiq / amazon_ssa_support Goto Github PK

View Code? Open in Web Editor NEW

2.0 2.0 24.0 181 KB

Supporting files and libraries for SmartSmate Analysis on Amazon EC2

License: MIT License

Ruby 99.71% Shell 0.29%

amazon_ssa_support's Introduction

ManageIQ

Discover, Optimize, and Control your Hybrid IT

Manage containers, virtual machines, networks, and storage from a single platform

ManageIQ is an open-source Management Platform that delivers the insight, control, and automation that enterprises need to address the challenges of managing hybrid IT environments. It has the following feature sets:

Insight: Discovery, Monitoring, Utilization, Performance, Reporting, Analytics, Chargeback, and Trending.
Control: Security, Compliance, Alerting, Policy-Based Resource and Configuration Management.
Automate: IT Process, Task and Event, Provisioning, Workload Management and Orchestration.
Integrate: Systems Management, Tools and Processes, Event Consoles, CMDB, RBA, and Web Services.

Get Started

Learn more

We respectfully ask that you do not directly email any manageiq committers with questions or problems. The community is best served when discussions are held in public.

Licensing

See LICENSE.txt.

Except where otherwise noted, all ManageIQ source files are covered by the following copyright and license notice:

Export Notice

By downloading ManageIQ software, you acknowledge that you understand all of the following: ManageIQ software and technical information may be subject to the U.S. Export Administration Regulations (the "EAR") and other U.S. and foreign laws and may not be exported, re-exported or transferred (a) to any country listed in Country Group E:1 in Supplement No. 1 to part 740 of the EAR (currently, Cuba, Iran, North Korea, Sudan & Syria); (b) to any prohibited destination or to any end user who has been prohibited from participating in U.S. export transactions by any federal agency of the U.S. government; or (c) for use in connection with the design, development or production of nuclear, chemical or biological weapons, or rocket systems, space launch vehicles, or sounding rockets, or unmanned air vehicle systems. You may not download ManageIQ software or technical information if you are located in one of these countries or otherwise subject to these restrictions. You may not provide ManageIQ software or technical information to individuals or entities located in one of these countries or otherwise subject to these restrictions. You are also responsible for compliance with foreign law requirements applicable to the import, export and use of ManageIQ software and technical information.

amazon_ssa_support's People

Contributors

Stargazers

Watchers

amazon_ssa_support's Issues

WS-2022-0334 (Medium) detected in nokogiri-1.13.3-x86_64-linux.gem - autoclosed

WS-2022-0334 - Medium Severity Vulnerability

Vulnerable Library - nokogiri-1.13.3-x86_64-linux.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).

Library home page: https://rubygems.org/gems/nokogiri-1.13.3-x86_64-linux.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/nokogiri-1.13.3-x86_64-linux.gem

Dependency Hierarchy:

handsoap-0.2.5.5.gem (Root Library)
- ❌ nokogiri-1.13.3-x86_64-linux.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

nokogiri up to and including 1.13.8 is affected by several vulnerabilities (CVE-2022-40303, CVE-2022-40304 and CVE-2022-2309) in the dependency bundled libxml2 library. Version 1.13.9 of nokogiri contains a patch where the dependency is upgraded with the patches as well.

Publish Date: 2022-10-18

URL: WS-2022-0334

CVSS 3 Score Details (5.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2qc6-mcvw-92cw

Release Date: 2022-10-18

Fix Resolution: nokogiri - 1.13.9

Step up your Open Source Security Game with Mend here

CVE-2023-27530 (High) detected in rack-2.2.3.gem - autoclosed

CVE-2023-27530 - High Severity Vulnerability

Vulnerable Library - rack-2.2.3.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

manageiq-style-1.3.1.gem (Root Library)
- rubocop-rails-2.14.1.gem
  - ❌ rack-2.2.3.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.

Publish Date: 2023-03-10

URL: CVE-2023-27530

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-03-10

Fix Resolution: rack - 2.0.9.3,2.1.4.3,2.2.6.3,3.0.4.2

Step up your Open Source Security Game with Mend here

CVE-2024-25126 (Medium) detected in rack-2.2.3.gem - autoclosed

CVE-2024-25126 - Medium Severity Vulnerability

Vulnerable Library - rack-2.2.3.gem

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

manageiq-style-1.3.1.gem (Root Library)
- rubocop-rails-2.14.1.gem
  - ❌ rack-2.2.3.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.

Publish Date: 2024-02-29

URL: CVE-2024-25126

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-22f2-v57c-j9cx

Release Date: 2024-02-29

Fix Resolution: rack - 2.2.8.1,3.0.9.1

Step up your Open Source Security Game with Mend here

CVE-2024-26146 (Medium) detected in rack-2.2.3.gem - autoclosed

CVE-2024-26146 - Medium Severity Vulnerability

Vulnerable Library - rack-2.2.3.gem

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

manageiq-style-1.3.1.gem (Root Library)
- rubocop-rails-2.14.1.gem
  - ❌ rack-2.2.3.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.

Publish Date: 2024-02-29

URL: CVE-2024-26146

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-26146

Release Date: 2024-02-29

Fix Resolution: rack - 2.0.9.4,2.1.4.4,2.2.8.1,3.0.9.1

Step up your Open Source Security Game with Mend here

Replace YAML safe_load with load(content, :safe => true)

YAML safe_load will fail when deserializing a hash object with Symbol type of values. Replace it with load by enabling safe attribute.

CVE-2024-41123 (Medium) detected in rexml-3.2.8.gem

CVE-2024-41123 - Medium Severity Vulnerability

Vulnerable Library - rexml-3.2.8.gem

An XML toolkit for Ruby

Library home page: https://rubygems.org/gems/rexml-3.2.8.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/3.2.0/cache/rexml-3.2.8.gem

Dependency Hierarchy:

manageiq-style-1.5.1.gem (Root Library)
- rubocop-rails-2.25.0.gem
  - rubocop-1.56.3.gem
    - ❌ rexml-3.2.8.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, >] and ]>. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.

Publish Date: 2024-08-01

URL: CVE-2024-41123

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r55c-59qm-vjw6

Release Date: 2024-08-01

Fix Resolution: rexml - 3.3.3

Step up your Open Source Security Game with Mend here

CVE-2022-29181 (High) detected in nokogiri-1.13.3-x86_64-linux.gem

CVE-2022-29181 - High Severity Vulnerability

Vulnerable Library - nokogiri-1.13.3-x86_64-linux.gem

Library home page: https://rubygems.org/gems/nokogiri-1.13.3-x86_64-linux.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/nokogiri-1.13.3-x86_64-linux.gem

Dependency Hierarchy:

handsoap-0.2.5.5.gem (Root Library)
- ❌ nokogiri-1.13.3-x86_64-linux.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a String by calling #to_s or equivalent.

Publish Date: 2022-05-20

URL: CVE-2022-29181

CVSS 3 Score Details (8.2)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29181

Release Date: 2022-05-20

Fix Resolution: nokogiri - 1.13.6

Step up your Open Source Security Game with Mend here

CVE-2024-39908 (Medium) detected in rexml-3.2.8.gem

CVE-2024-39908 - Medium Severity Vulnerability

Vulnerable Library - rexml-3.2.8.gem

An XML toolkit for Ruby

Library home page: https://rubygems.org/gems/rexml-3.2.8.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/3.2.0/cache/rexml-3.2.8.gem

Dependency Hierarchy:

manageiq-style-1.5.1.gem (Root Library)
- rubocop-rails-2.25.0.gem
  - rubocop-1.56.3.gem
    - ❌ rexml-3.2.8.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as <, 0 and %>. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.

Publish Date: 2024-07-16

URL: CVE-2024-39908

CVSS 3 Score Details (4.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4xqq-m2hx-25v8

Release Date: 2024-07-16

Fix Resolution: rexml - 3.3.2

Step up your Open Source Security Game with Mend here

CVE-2022-44570 (High) detected in rack-2.2.3.gem - autoclosed

CVE-2022-44570 - High Severity Vulnerability

Vulnerable Library - rack-2.2.3.gem

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

manageiq-style-1.3.1.gem (Root Library)
- rubocop-rails-2.14.1.gem
  - ❌ rack-2.2.3.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.

Publish Date: 2023-02-09

URL: CVE-2022-44570

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-65f5-mfpf-vfhj

Release Date: 2023-02-09

Fix Resolution: rack - 2.0.9.2,2.1.4.2,2.2.6.2,3.0.4.1

Step up your Open Source Security Game with Mend here

Extraction Request ID Tag Name Mismatch

in the SsaQueue method requeue_request, there is a mismatch between two tags that are obviously meant to be identical - body[:original_request_id] and body[:original_req_id]. In method send_ers_reply :original_req_id is used so I assume that is what they should all be named.

@hsong-rh @roliveri we should update this.

CVE-2024-26141 (Medium) detected in rack-2.2.3.gem - autoclosed

CVE-2024-26141 - Medium Severity Vulnerability

Vulnerable Library - rack-2.2.3.gem

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

manageiq-style-1.3.1.gem (Root Library)
- rubocop-rails-2.14.1.gem
  - ❌ rack-2.2.3.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the Rack::File middleware or the Rack::Utils.byte_ranges methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.

Publish Date: 2024-02-29

URL: CVE-2024-26141

CVSS 3 Score Details (5.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-26141

Release Date: 2024-02-29

Fix Resolution: rack - 2.2.8.1,3.0.9.1

Step up your Open Source Security Game with Mend here

CVE-2022-44571 (High) detected in rack-2.2.3.gem - autoclosed

CVE-2022-44571 - High Severity Vulnerability

Vulnerable Library - rack-2.2.3.gem

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

manageiq-style-1.3.1.gem (Root Library)
- rubocop-rails-2.14.1.gem
  - ❌ rack-2.2.3.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-Disposition header parsing in Rackto take an unexpected amount of time, possibly resulting in a denial ofservice attack vector. This header is used typically used in multipartparsing. Any applications that parse multipart posts using Rack (virtuallyall Rails applications) are impacted.

Publish Date: 2023-02-09

URL: CVE-2022-44571

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-93pm-5p5f-3ghx

Release Date: 2023-02-09

Fix Resolution: rack - 2.0.9.2,2.1.4.2,2.2.6.2,3.0.4.1

Step up your Open Source Security Game with Mend here

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

Update dependency handsoap to v1

Detected dependencies

bundler

Gemfile

handsoap "=0.2.5.5"

github-actions

.github/workflows/ci.yaml

actions/checkout v4

ruby/setup-ruby v1

paambaati/codeclimate-action v8

Check this box to trigger a request for Renovate to run again on this repository

Remove "evm" from code.

Remove references to "evm" from class, module, and method names.

Don't Require extractor_id to create a new EvmQueue object

@hsong-rh @roliveri this tracks our discussion about removing the raised exception when EvmQueue.new does not specify the extractor_id. This is needed for the [WIP] PR for submitting AWS SSA requests.

Use log_decorator to do logging

Replace the current $log with _log via using log_decorator gem;
Add a new logic in agent: will automated power off if no requests in the request queue for a certain time period: DEFAULT_REQUEST_TIMEOUT (default: 15 min)

CVE-2022-44572 (High) detected in rack-2.2.3.gem - autoclosed

CVE-2022-44572 - High Severity Vulnerability

Vulnerable Library - rack-2.2.3.gem

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

manageiq-style-1.3.1.gem (Root Library)
- rubocop-rails-2.14.1.gem
  - ❌ rack-2.2.3.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.

Publish Date: 2023-02-09

URL: CVE-2022-44572

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rqv2-275x-2jq5

Release Date: 2023-02-09

Fix Resolution: rack - 2.0.9.2,2.1.4.2,2.2.6.2,3.0.4.1

Step up your Open Source Security Game with Mend here

Separate one single log file into multiples based on the scanning requests.

Currently the agent in Amazon environment will generate one log file in S3 bucket. It won't work if multiple appliances share this agent. This one single file need to be separated based on the scanning request.

CVE-2022-30123 (High) detected in rack-2.2.3.gem

CVE-2022-30123 - High Severity Vulnerability

Vulnerable Library - rack-2.2.3.gem

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

manageiq-style-1.3.1.gem (Root Library)
- rubocop-rails-2.14.1.gem
  - ❌ rack-2.2.3.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.

Publish Date: 2022-12-05

URL: CVE-2022-30123

CVSS 3 Score Details (10.0)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wq4h-7r42-5hrr

Release Date: 2022-12-05

Fix Resolution: rack - 2.0.9.1,2.1.4.1,2.2.3.1

Step up your Open Source Security Game with Mend here

CVE-2022-30122 (High) detected in rack-2.2.3.gem

CVE-2022-30122 - High Severity Vulnerability

Vulnerable Library - rack-2.2.3.gem

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

manageiq-style-1.3.1.gem (Root Library)
- rubocop-rails-2.14.1.gem
  - ❌ rack-2.2.3.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.

Publish Date: 2022-12-05

URL: CVE-2022-30122

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hxqx-xwvh-44m2

Release Date: 2022-12-05

Fix Resolution: rack - 2.0.9.1,2.1.4.1,2.2.3.1

Step up your Open Source Security Game with Mend here

CVE-2023-38037 (Medium) detected in activesupport-6.1.5.gem - autoclosed

CVE-2023-38037 - Medium Severity Vulnerability

Vulnerable Library - activesupport-6.1.5.gem

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Library home page: https://rubygems.org/gems/activesupport-6.1.5.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/activesupport-6.1.5.gem

Dependency Hierarchy:

manageiq-style-1.3.1.gem (Root Library)
- rubocop-rails-2.14.1.gem
  - ❌ activesupport-6.1.5.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Active Support Possibly Discloses Locally Encrypted Files

Publish Date: 2023-07-12

URL: CVE-2023-38037

CVSS 3 Score Details (4.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cr5q-6q9f-rq6q

Release Date: 2023-07-12

Fix Resolution: activesupport - 6.1.7.5,7.0.7.1

Step up your Open Source Security Game with Mend here

Use the proper region.

Check usage of DEFAULT_REGION. Ensure we're using the proper region in all cases.
See: mv_bucket.rb

CVE-2023-22796 (High) detected in activesupport-6.1.5.gem - autoclosed

CVE-2023-22796 - High Severity Vulnerability

Vulnerable Library - activesupport-6.1.5.gem

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Library home page: https://rubygems.org/gems/activesupport-6.1.5.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/activesupport-6.1.5.gem

Dependency Hierarchy:

manageiq-style-1.3.1.gem (Root Library)
- rubocop-rails-2.14.1.gem
  - ❌ activesupport-6.1.5.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.

Publish Date: 2023-02-09

URL: CVE-2023-22796

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-j6gc-792m-qgm2

Release Date: 2023-02-09

Fix Resolution: activesupport - 6.1.7.1,7.0.4.1

Step up your Open Source Security Game with Mend here

Add startup script in tools directory

Add a ruby file amazon_ssa_extract.rb into gem's tools directory, which will be call to start agents.

AWS-SDK Version 1 Calls

There is at least one cases of an AWS-SDK version 1 call still in the code.
SsaQueue.get_reply calls read on an S3 Object, which is outdated.

@hsong-rh @roliveri FYI.

CVE-2022-24836 (High) detected in nokogiri-1.13.3-x86_64-linux.gem

CVE-2022-24836 - High Severity Vulnerability

Vulnerable Library - nokogiri-1.13.3-x86_64-linux.gem

Library home page: https://rubygems.org/gems/nokogiri-1.13.3-x86_64-linux.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/nokogiri-1.13.3-x86_64-linux.gem

Dependency Hierarchy:

handsoap-0.2.5.5.gem (Root Library)
- ❌ nokogiri-1.13.3-x86_64-linux.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri < v1.13.4 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri >= 1.13.4. There are no known workarounds for this issue.

Publish Date: 2022-04-11

URL: CVE-2022-24836

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-crjr-9rc5-ghw8

Release Date: 2022-04-11

Fix Resolution: nokogiri - 1.13.4

Step up your Open Source Security Game with Mend here

CVE-2024-41946 (Medium) detected in rexml-3.2.8.gem

CVE-2024-41946 - Medium Severity Vulnerability

Vulnerable Library - rexml-3.2.8.gem

An XML toolkit for Ruby

Library home page: https://rubygems.org/gems/rexml-3.2.8.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/3.2.0/cache/rexml-3.2.8.gem

Dependency Hierarchy:

manageiq-style-1.5.1.gem (Root Library)
- rubocop-rails-2.25.0.gem
  - rubocop-1.56.3.gem
    - ❌ rexml-3.2.8.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.

Publish Date: 2024-08-01

URL: CVE-2024-41946

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5866-49gr-22v4

Release Date: 2024-08-01

Fix Resolution: rexml - 3.3.3

Step up your Open Source Security Game with Mend here

README needs update

The README is still the default gem TODO...it should at least be updated with a proper description and basic usage.

SsaQueue should contain :job_id

The current SsaReply class under the SsaQueue shows a :job_id element but the actual reply SQS messages do not contain the element. This should be fixed so that in the case of missing S3 reply objects the job id can be pulled out of the SQS message in order to handle errors for the appropriate job.

@roliveri @hsong-rh FYI.

CVE-2023-27539 (High) detected in rack-2.2.3.gem - autoclosed

CVE-2023-27539 - High Severity Vulnerability

Vulnerable Library - rack-2.2.3.gem

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

manageiq-style-1.3.1.gem (Root Library)
- rubocop-rails-2.14.1.gem
  - ❌ rack-2.2.3.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

There is a denial of service vulnerability in the header parsing component of Rack. Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted. The issue is fixed versions 2.2.6.4 and 3.0.6.1

Publish Date: 2023-03-03

URL: CVE-2023-27539

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466

Release Date: 2023-03-03

Fix Resolution: rack - 2.2.6.4,3.0.6.1

Step up your Open Source Security Game with Mend here

manageiq / amazon_ssa_support Goto Github PK

amazon_ssa_support's Introduction

ManageIQ

Discover, Optimize, and Control your Hybrid IT

Manage containers, virtual machines, networks, and storage from a single platform

Get Started

Learn more

Licensing

Export Notice

amazon_ssa_support's People

Contributors

Stargazers

Watchers

Forkers

amazon_ssa_support's Issues

WS-2022-0334 - Medium Severity Vulnerability

CVE-2023-27530 - High Severity Vulnerability

CVE-2024-25126 - Medium Severity Vulnerability

CVE-2024-26146 - Medium Severity Vulnerability

CVE-2024-41123 - Medium Severity Vulnerability

CVE-2022-29181 - High Severity Vulnerability

CVE-2024-39908 - Medium Severity Vulnerability

CVE-2022-44570 - High Severity Vulnerability

CVE-2024-26141 - Medium Severity Vulnerability

CVE-2022-44571 - High Severity Vulnerability

Ignored or Blocked

Detected dependencies

CVE-2022-44572 - High Severity Vulnerability

CVE-2022-30123 - High Severity Vulnerability

CVE-2022-30122 - High Severity Vulnerability

CVE-2023-38037 - Medium Severity Vulnerability

CVE-2023-22796 - High Severity Vulnerability

CVE-2022-24836 - High Severity Vulnerability

CVE-2024-41946 - Medium Severity Vulnerability

CVE-2023-27539 - High Severity Vulnerability

Recommend Projects

Recommend Topics

Recommend Org