{"action":"closed","issue":{"url":"https://api.github.com/repos/jowein/ridemo/issues/585","repository_url":"https://api.github.com/repos/jowein/ridemo","labels_url":"https://api.github.com/repos/jowein/ridemo/issues/585/labels{/name}","comments_url":"https://api.github.com/repos/jowein/ridemo/issues/585/comments","events_url":"https://api.github.com/repos/jowein/ridemo/issues/585/events","html_url":"https://github.com/jowein/ridemo/issues/585","id":378419084,"node_id":"MDU6SXNzdWUzNzg0MTkwODQ=","number":585,"title":"CVE-2013-1856 Medium Severity Vulnerability detected by WhiteSource","user":{"login":"thunderalpha1[bot]","id":42357622,"node_id":"MDM6Qm90NDIzNTc2MjI=","avatar_url":"https://avatars1.githubusercontent.com/u/3177372?v=4","gravatar_id":"","url":"https://api.github.com/users/thunderalpha1%5Bbot%5D","html_url":"https://github.com/apps/thunderalpha1","followers_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/followers","following_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/repos","events_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-11-07T18:43:22Z","updated_at":"2018-11-07T19:13:13Z","closed_at":"2018-11-07T19:13:13Z","author_association":"NONE","body":"## CVE-2013-1856 - Medium Severity Vulnerability\n<details><summary><img src='https://www.whitesourcesoftware.com/wp-content/uploads/2018/10/vulnerability_details.png' width=24 height=25> Vulnerable Library - <b>activesupport-3.0.9.gem</b></p></summary>\n\n<p>A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.</p>\n<p>path: C:\\Users\\YossiW\\AppData\\Local\\Temp\\git\\ridemo\\Gemfile.lock</p>\n<p>\n\n<p>Library home page: <a href=http://rubygems.org/gems/activesupport-3.0.9.gem>http://rubygems.org/gems/activesupport-3.0.9.gem</a></p>\n\nDependency Hierarchy:\n  - rails-3.0.9.gem (Root Library)\n    - actionmailer-3.0.9.gem\n      - actionpack-3.0.9.gem\n        - activemodel-3.0.9.gem\n          - :x: **activesupport-3.0.9.gem** (Vulnerable Library)\n<p>Found in commit: <a href=\"https://github.com/jowein/ridemo/commit/bdcb1249faaed7550379b43a38b85ec18e4762db\">bdcb1249faaed7550379b43a38b85ec18e4762db</a></p>\n</p>\n</details>\n<p></p>\n<details><summary><img src='https://www.whitesourcesoftware.com/wp-content/uploads/2018/10/medium_vul.png' width=24 height=25> Vulnerability Details</summary>\n<p>  \n  \nThe ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.\n\n<p>Publish Date: 2013-03-19\n<p>URL: <a href=https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1856>CVE-2013-1856</a></p>\n</p>\n</details>\n<p></p>\n<details><summary><img src='https://www.whitesourcesoftware.com/wp-content/uploads/2018/10/cvss3.png' width=24 height=25> CVSS 2 Score Details (<b>5.8</b>)</summary>\n<p>\n\nBase Score Metrics not available</p>\n\n</p>\n</details>\n<p></p>\n<details><summary><img src='https://www.whitesourcesoftware.com/wp-content/uploads/2018/10/suggested_fix.png' width=24 height=25> Suggested Fix</summary>\n<p>\n\n<p>Type: Upgrade version</p>\n<p>Origin: <a href=\"https://security.gentoo.org/glsa/201412-28\">https://security.gentoo.org/glsa/201412-28</a></p>\n<p>Release Date: 2014-12-13</p>\n<p>Fix Resolution: All Ruby on Rails 2.x users should upgrade to the latest version >= rails-2.3.18\n</p>\n\n</p>\n</details>\n<p></p>\n\n***\nStep up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)"}}
{"actor":{"display_login":"yoswein"}}