search

NixOS / nixpkgs

Nix Packages collection & NixOS
MIT License
18.11k stars 14.15k forks source link

[Draft] Ruby vulnerability roundup 001 #58823

Closed primeos closed 2 weeks ago

primeos commented 5 years ago

Vulnerable packages (more details)

Log output

https://gist.githubusercontent.com/primeos/9eb81de24a1d09230566f74fd476b787/raw/bf84f134e9c1bde9e7ad6b10f01d20af9c6e5f8e/log.txt

Can be searched by the path to the Gemfile.lock in nixpkgs, e.g.:

Gemfile: ./pkgs/applications/networking/instant-messengers/mikutter/Gemfile.lock

TODO

This is only a draft by running something as simple as the following script inside a nixpkgs checkout:

#!/usr/bin/env nix-shell
#!nix-shell -i bash -p bundler-audit

set -o errexit
set -o nounset

bundler-audit update

GEMFILES="$(find -name Gemfile.lock)"

#rm -f /tmp/gemfile-paths.txt

for GEMFILE in $GEMFILES; do
  pushd "$(dirname $GEMFILE)" > /dev/null
  echo "Gemfile: $GEMFILE"
  bundler-audit check || echo "$PWD" >> /tmp/gemfile-paths.txt
  popd > /dev/null
done

It might be a good idea to automate this and cc the maintainers (after some testing and maybe with a better output) but I do not have much time for this at the moment. Maybe someone else is interested and has time?

Feedback is welcome.

aanderse commented 5 years ago

The redmine packages were patched against this. A big :+1: for automatically alerting package maintainers if anyone is able to find the time to finish what @primeos has started.

@manveru Didn't I notice a bunch of ruby related PRs from you recently? Off the top of your head do you know if any of these vulnerabilities have been patched?

manveru commented 5 years ago

I haven't checked for vulnerabilities, only reran bundle lock to fetch the latest valid dependencies. So it might've fixed some of those, but I'll have to check manually. I can probably give it some time tonight.

manveru commented 5 years ago

Will track my progress here:

These packages have some issues I can't resolve:

FliegendeWurst commented 2 weeks ago

That was the only remaining package on the list.

I have rerun the script and opened #351833