{"action":"opened","issue":{"url":"https://api.github.com/repos/jowein/ridemo/issues/315","repository_url":"https://api.github.com/repos/jowein/ridemo","labels_url":"https://api.github.com/repos/jowein/ridemo/issues/315/labels{/name}","comments_url":"https://api.github.com/repos/jowein/ridemo/issues/315/comments","events_url":"https://api.github.com/repos/jowein/ridemo/issues/315/events","html_url":"https://github.com/jowein/ridemo/issues/315","id":375550648,"node_id":"MDU6SXNzdWUzNzU1NTA2NDg=","number":315,"title":"CVE-2013-0155 Medium Severity Vulnerability detected by WhiteSource","user":{"login":"thunderalpha1[bot]","id":42357622,"node_id":"MDM6Qm90NDIzNTc2MjI=","avatar_url":"https://avatars1.githubusercontent.com/u/3177372?v=4","gravatar_id":"","url":"https://api.github.com/users/thunderalpha1%5Bbot%5D","html_url":"https://github.com/apps/thunderalpha1","followers_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/followers","following_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/repos","events_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-10-30T15:29:18Z","updated_at":"2018-10-30T15:29:18Z","closed_at":null,"author_association":"NONE","body":"## CVE-2013-0155 - Medium Severity Vulnerability\n<details><summary><img src='https://www.whitesourcesoftware.com/wp-content/uploads/2018/10/vulnerability_details.png' width=24 height=25> Vulnerable Library - <b>activerecord-3.0.9.gem</b></p></summary>\n\n<p>Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.</p>\n<p>path: C:\\Users\\YossiW\\AppData\\Local\\Temp\\git\\ridemo\\Gemfile.lock</p>\n<p>\n\n<p>Library home page: <a href=http://rubygems.org/gems/activerecord-3.0.9.gem>http://rubygems.org/gems/activerecord-3.0.9.gem</a></p>\n\nDependency Hierarchy:\n  - rails-3.0.9.gem (Root Library)\n    - :x: **activerecord-3.0.9.gem** (Vulnerable Library)\n<p>Found in commit: <a href=\"https://github.com/jowein/ridemo/commit/7b3c1a14cf83529655b4aa48b9129aa950f30585\">7b3c1a14cf83529655b4aa48b9129aa950f30585</a></p>\n</p>\n</details>\n<p></p>\n<details><summary><img src='https://www.whitesourcesoftware.com/wp-content/uploads/2018/10/medium_vul.png' width=24 height=25> Vulnerability Details</summary>\n<p>  \n  \nRuby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2660 and CVE-2012-2694.\n\n<p>Publish Date: 2013-01-13\n<p>URL: <a href=https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0155>CVE-2013-0155</a></p>\n</p>\n</details>\n<p></p>\n<details><summary><img src='https://www.whitesourcesoftware.com/wp-content/uploads/2018/10/cvss3.png' width=24 height=25> CVSS 2 Score Details (<b>6.4</b>)</summary>\n<p>\n\nBase Score Metrics not available</p>\n\n</p>\n</details>\n<p></p>\n<details><summary><img src='https://www.whitesourcesoftware.com/wp-content/uploads/2018/10/suggested_fix.png' width=24 height=25> Suggested Fix</summary>\n<p>\n\n<p>Type: Upgrade version</p>\n<p>Origin: <a href=\"https://security.gentoo.org/glsa/201412-28\">https://security.gentoo.org/glsa/201412-28</a></p>\n<p>Release Date: 2014-12-13</p>\n<p>Fix Resolution: All Ruby on Rails 2.x users should upgrade to the latest version >= rails-2.3.18\n</p>\n\n</p>\n</details>\n<p></p>\n\n***\nStep up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)"}}
{"actor":{"display_login":"thunderalpha1"}}