afinetooth / coveralls-test-travis / 38
48%
master: 48%

Ran 06 Jun 2020 04:35PM UTC

Jobs 1

Files 9

Run time 2s

Badge

pending completion

Build # 38

Build Type

push

travis-ci

Committed by

Commit Message

Dependabot security update; dependably could not fix. Requesting update to active support, but no Gemfile entry for active support, only Rails. Updating Rails to => 6.0.3.1.

Details
CVE-2020-8165
high severity
Vulnerable versions: >= 6.0.0, <= 6.0.3
Patched version: 6.0.3.1
In ActiveSupport, there is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
untrusted user input is written to the cache store using the raw: true parameter, re-reading the result
from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:

data = cache.fetch("demo", raw: true) { untrusted_string }
Impact
Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.
In addition to upgrading to the latest versions of Rails, developers should ensure that whenever
they are calling Rails.cache.fetch they are using consistent values of the raw parameter for both
reading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,
detect if data was serialized using the raw option upon deserialization.

Workarounds
It is recommended that application developers apply the suggested patch or upgrade to the latest release as
soon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using
the raw argument should be double-checked to ensure that they conform to the expected format.

Run Details

13 of 27 relevant lines covered (48.15%)

0.48 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	38.1 (2.6.3)	06 Jun 2020 04:35PM UTC	0	48.15	Travis Job 38.1

Source Files on build 38

Detailed source file information is not available for this build.