Vulnerable Library - github-pages-207.gem Path to dependency file: /docs/Gemfile.lock Path to vulnerable library: /docs/Gemfile.lock ## Vulnerabilities | CVE | Severity | CVSS | Dependency | Type | Fixed in (github-pages version) | Remediation Possible** | | ------------- | ------------- | ----- | ----- | ----- | ------------- | --- | | [WS-2022-0093](https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3) | High | 8.8 | commonmarker-0.17.13.gem | Transitive | N/A* | ❌ | | [WS-2022-0089](https://github.com/sparklemotion/nokogiri/commit/472913378794b8cae21751b0777205e7c0606a95) | High | 8.8 | nokogiri-1.11.1.gem | Transitive | N/A* | ❌ | | [CVE-2022-29181](https://www.mend.io/vulnerability-database/CVE-2022-29181) | High | 8.2 | nokogiri-1.11.1.gem | Transitive | N/A* | ❌ | | [WS-2023-0095](https://github.com/gjtorikian/commonmarker/commit/42cfc90251353f9fceda91b884d0ded8d3da0bcf) | High | 7.5 | commonmarker-0.17.13.gem | Transitive | N/A* | ❌ | | [WS-2022-0320](https://github.com/gjtorikian/commonmarker/commit/a8f8d76fbc8c92ddb2e539a06bd93c5f8326705e) | High | 7.5 | commonmarker-0.17.13.gem | Transitive | N/A* | ❌ | | [CVE-2023-26485](https://www.mend.io/vulnerability-database/CVE-2023-26485) | High | 7.5 | commonmarker-0.17.13.gem | Transitive | N/A* | ❌ | | [CVE-2023-24824](https://www.mend.io/vulnerability-database/CVE-2023-24824) | High | 7.5 | commonmarker-0.17.13.gem | Transitive | N/A* | ❌ | | [CVE-2023-22796](https://www.mend.io/vulnerability-database/CVE-2023-22796) | High | 7.5 | activesupport-6.0.3.5.gem | Transitive | N/A* | ❌ | | [CVE-2022-24836](https://www.mend.io/vulnerability-database/CVE-2022-24836) | High | 7.5 | nokogiri-1.11.1.gem | Transitive | N/A* | ❌ | | [CVE-2021-41098](https://www.mend.io/vulnerability-database/CVE-2021-41098) | High | 7.5 | nokogiri-1.11.1.gem | Transitive | N/A* | ❌ | | [CVE-2023-38037](https://www.mend.io/vulnerability-database/CVE-2023-38037) | Medium | 4.3 | activesupport-6.0.3.5.gem | Transitive | N/A* | ❌ | *For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation ## Details WS-2022-0093 ### Vulnerable Library - commonmarker-0.17.13.gem A fast, safe, extensible parser for CommonMark. This wraps the official libcmark library. Library home page: https://rubygems.org/gems/commonmarker-0.17.13.gem Path to dependency file: /docs/Gemfile.lock Path to vulnerable library: /docs/Gemfile.lock Dependency Hierarchy: - github-pages-207.gem (Root Library) - jekyll-commonmark-ghpages-0.1.6.gem - :x: **commonmarker-0.17.13.gem** (Vulnerable Library) Found in base branch: gh-pages ### Vulnerability Details commonmarker versions prior to 0.23.4 are vulnerable to heap memory corruption when parsing tables whose marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution. Publish Date: 2022-02-03 URL: WS-2022-0093 ### CVSS 3 Score Details (8.8) Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High For more information on CVSS3 Scores, click here. ### Suggested Fix Type: Upgrade version Origin: https://github.com/advisories/GHSA-fmx4-26r3-wxpf Release Date: 2022-02-03 Fix Resolution: commonmarker - 0.23.4 Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github) WS-2022-0089 ### Vulnerable Library - nokogiri-1.11.1.gem Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java). Library home page: https://rubygems.org/gems/nokogiri-1.11.1.gem Path to dependency file: /docs/Gemfile.lock Path to vulnerable library: /docs/Gemfile.lock Dependency Hierarchy: - github-pages-207.gem (Root Library) - :x: **nokogiri-1.11.1.gem** (Vulnerable Library) Found in base branch: gh-pages ### Vulnerability Details Nokogiri before version 1.13.2 is vulnerable. Publish Date: 2022-03-01 URL: WS-2022-0089 ### CVSS 3 Score Details (8.8) Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High For more information on CVSS3 Scores, click here. ### Suggested Fix Type: Upgrade version Origin: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2 Release Date: 2022-03-01 Fix Resolution: nokogiri - v1.13.2 Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github) CVE-2022-29181 ### Vulnerable Library - nokogiri-1.11.1.gem Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java). Library home page: https://rubygems.org/gems/nokogiri-1.11.1.gem Path to dependency file: /docs/Gemfile.lock Path to vulnerable library: /docs/Gemfile.lock Dependency Hierarchy: - github-pages-207.gem (Root Library) - :x: **nokogiri-1.11.1.gem** (Vulnerable Library) Found in base branch: gh-pages ### Vulnerability Details Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent. Publish Date: 2022-05-20 URL: CVE-2022-29181 ### CVSS 3 Score Details (8.2) Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: High For more information on CVSS3 Scores, click here. ### Suggested Fix Type: Upgrade version Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29181 Release Date: 2022-05-20 Fix Resolution: nokogiri - 1.13.6 Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github) WS-2023-0095 ### Vulnerable Library - commonmarker-0.17.13.gem A fast, safe, extensible parser for CommonMark. This wraps the official libcmark library. Library home page: https://rubygems.org/gems/commonmarker-0.17.13.gem Path to dependency file: /docs/Gemfile.lock Path to vulnerable library: /docs/Gemfile.lock Dependency Hierarchy: - github-pages-207.gem (Root Library) - jekyll-commonmark-ghpages-0.1.6.gem - :x: **commonmarker-0.17.13.gem** (Vulnerable Library) Found in base branch: gh-pages ### Vulnerability Details Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of service Publish Date: 2023-04-12 URL: WS-2023-0095 ### CVSS 3 Score Details (7.5) Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High For more information on CVSS3 Scores, click here. ### Suggested Fix Type: Upgrade version Origin: https://github.com/advisories/GHSA-48wp-p9qv-4j64 Release Date: 2023-04-12 Fix Resolution: commonmarker - 0.23.9 Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github) WS-2022-0320 ### Vulnerable Library - commonmarker-0.17.13.gem A fast, safe, extensible parser for CommonMark. This wraps the official libcmark library. Library home page: https://rubygems.org/gems/commonmarker-0.17.13.gem Path to dependency file: /docs/Gemfile.lock Path to vulnerable library: /docs/Gemfile.lock Dependency Hierarchy: - github-pages-207.gem (Root Library) - jekyll-commonmark-ghpages-0.1.6.gem - :x: **commonmarker-0.17.13.gem** (Vulnerable Library) Found in base branch: gh-pages ### Vulnerability Details Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service Publish Date: 2022-09-21 URL: WS-2022-0320 ### CVSS 3 Score Details (7.5) Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High For more information on CVSS3 Scores, click here. ### Suggested Fix Type: Upgrade version Origin: https://github.com/advisories/GHSA-4qw4-jpp4-8gvp Release Date: 2022-09-21 Fix Resolution: commonmarker - 0.23.6 Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github) CVE-2023-26485 ### Vulnerable Library - commonmarker-0.17.13.gem A fast, safe, extensible parser for CommonMark. This wraps the official libcmark library. Library home page: https://rubygems.org/gems/commonmarker-0.17.13.gem Path to dependency file: /docs/Gemfile.lock Path to vulnerable library: /docs/Gemfile.lock Dependency Hierarchy: - github-pages-207.gem (Root Library) - jekyll-commonmark-ghpages-0.1.6.gem - :x: **commonmarker-0.17.13.gem** (Vulnerable Library) Found in base branch: gh-pages ### Vulnerability Details cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `_` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources. ### Impact A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. ### Proof of concept ``` $ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad, end="")' | time ./build/src/cmark-gfm --to plaintext ``` Increasing the number 10000 in the above commands causes the running time to increase quadratically. ### Patches This vulnerability have been patched in 0.29.0.gfm.10. ### Note on cmark and cmark-gfm XXX: TBD [cmark-gfm](https://github.com/github/cmark-gfm) is a fork of [cmark](https://github.com/commonmark/cmark) that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both `cmark` and `cmark-gfm`. ### Credit We would like to thank @gravypod for reporting this vulnerability. ### References https://en.wikipedia.org/wiki/Time_complexity ### For more information If you have any questions or comments about this advisory: * Open an issue in [github/cmark-gfm](https://github.com/github/cmark-gfm) Publish Date: 2023-03-31 URL: CVE-2023-26485 ### CVSS 3 Score Details (7.5) Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High For more information on CVSS3 Scores, click here. ### Suggested Fix Type: Upgrade version Origin: https://github.com/advisories/GHSA-48wp-p9qv-4j64 Release Date: 2023-03-31 Fix Resolution: commonmarker - 0.23.9 Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github) CVE-2023-24824 ### Vulnerable Library - commonmarker-0.17.13.gem A fast, safe, extensible parser for CommonMark. This wraps the official libcmark library. Library home page: https://rubygems.org/gems/commonmarker-0.17.13.gem Path to dependency file: /docs/Gemfile.lock Path to vulnerable library: /docs/Gemfile.lock Dependency Hierarchy: - github-pages-207.gem (Root Library) - jekyll-commonmark-ghpages-0.1.6.gem - :x: **commonmarker-0.17.13.gem** (Vulnerable Library) Found in base branch: gh-pages ### Vulnerability Details cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources. Publish Date: 2023-03-31 URL: CVE-2023-24824 ### CVSS 3 Score Details (7.5) Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High For more information on CVSS3 Scores, click here. ### Suggested Fix Type: Upgrade version Origin: https://github.com/advisories/GHSA-48wp-p9qv-4j64 Release Date: 2023-03-31 Fix Resolution: commonmarker - 0.23.9 Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github) CVE-2023-22796 ### Vulnerable Library - activesupport-6.0.3.5.gem A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing. Library home page: https://rubygems.org/gems/activesupport-6.0.3.5.gem Path to dependency file: /docs/Gemfile.lock Path to vulnerable library: /docs/Gemfile.lock Dependency Hierarchy: - github-pages-207.gem (Root Library) - jekyll-mentions-1.5.1.gem - html-pipeline-2.14.0.gem - :x: **activesupport-6.0.3.5.gem** (Vulnerable Library) Found in base branch: gh-pages ### Vulnerability Details A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability. Publish Date: 2023-02-09 URL: CVE-2023-22796 ### CVSS 3 Score Details (7.5) Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High For more information on CVSS3 Scores, click here. ### Suggested Fix Type: Upgrade version Origin: https://github.com/advisories/GHSA-j6gc-792m-qgm2 Release Date: 2023-02-09 Fix Resolution: activesupport - 6.1.7.1,7.0.4.1 Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github) CVE-2022-24836 ### Vulnerable Library - nokogiri-1.11.1.gem Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java). Library home page: https://rubygems.org/gems/nokogiri-1.11.1.gem Path to dependency file: /docs/Gemfile.lock Path to vulnerable library: /docs/Gemfile.lock Dependency Hierarchy: - github-pages-207.gem (Root Library) - :x: **nokogiri-1.11.1.gem** (Vulnerable Library) Found in base branch: gh-pages ### Vulnerability Details Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue. Publish Date: 2022-04-11 URL: CVE-2022-24836 ### CVSS 3 Score Details (7.5) Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High For more information on CVSS3 Scores, click here. ### Suggested Fix Type: Upgrade version Origin: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8 Release Date: 2022-04-11 Fix Resolution: nokogiri - 1.13.4 Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github) CVE-2021-41098 ### Vulnerable Library - nokogiri-1.11.1.gem Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java). Library home page: https://rubygems.org/gems/nokogiri-1.11.1.gem Path to dependency file: /docs/Gemfile.lock Path to vulnerable library: /docs/Gemfile.lock Dependency Hierarchy: - github-pages-207.gem (Root Library) - :x: **nokogiri-1.11.1.gem** (Vulnerable Library) Found in base branch: gh-pages ### Vulnerability Details Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected. Publish Date: 2021-09-27 URL: CVE-2021-41098 ### CVSS 3 Score Details (7.5) Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None For more information on CVSS3 Scores, click here. ### Suggested Fix Type: Upgrade version Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41098 Release Date: 2021-09-27 Fix Resolution: nokogiri - 1.12.5 Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github) CVE-2023-38037 ### Vulnerable Library - activesupport-6.0.3.5.gem A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing. Library home page: https://rubygems.org/gems/activesupport-6.0.3.5.gem Path to dependency file: /docs/Gemfile.lock Path to vulnerable library: /docs/Gemfile.lock Dependency Hierarchy: - github-pages-207.gem (Root Library) - jekyll-mentions-1.5.1.gem - html-pipeline-2.14.0.gem - :x: **activesupport-6.0.3.5.gem** (Vulnerable Library) Found in base branch: gh-pages ### Vulnerability Details Active Support Possibly Discloses Locally Encrypted Files Publish Date: 2023-07-12 URL: CVE-2023-38037 ### CVSS 3 Score Details (4.3) Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None For more information on CVSS3 Scores, click here. ### Suggested Fix Type: Upgrade version Origin: https://github.com/advisories/GHSA-cr5q-6q9f-rq6q Release Date: 2023-07-12 Fix Resolution: activesupport - 6.1.7.5,7.0.7.1 Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)