Vulnerable Dependencies in the Repository

[quantumseclabs]

Pull Request

No response

What happened?

Bug Report: Vulnerable Dependencies in the Repository

Description

Two dependencies in the Gemfile.lock that are affected by known vulnerabilities, which may pose a risk to the security and reliability of the repository.

1. Dependency: webrick@1.8.1

   • Issue: Vulnerable to CVE-2024-47220 (HTTP request smuggling).
   • Recommendation: Update to webrick@1.8.2 or later.

2. Dependency: rexml@3.2.5

   • Issue: Vulnerable to CVE-2024-49761 (Regular Expression Denial of Service - ReDoS).
   • Recommendation: Update to rexml@3.3.9 or later.

File Location

• Gemfile.lock:
  • webrick (1.8.1) at line 288.
  • rexml (3.2.5) at line 260.

Impact

These vulnerabilities could expose the repository to security risks, such as HTTP smuggling attacks and potential Denial of Service (DoS) threats. It is recommended to update these dependencies promptly.

Relevant log output

No response