search

rdp / os

The OS gem allows for some easy telling if you’re on windows or not. OS.windows? as well as some other helper utilities
MIT License
145 stars 33 forks source link

update vulnerable dependency #49

Open gfrankliu opened 3 years ago

gfrankliu commented 3 years ago

Trivy scanner reports os pulls vulnerable rake, probably due to https://github.com/rdp/os/blob/master/Gemfile.lock#L11

==================================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

+---------+------------------+----------+-------------------+---------------+--------------------------------------+
| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                TITLE                 |
+---------+------------------+----------+-------------------+---------------+--------------------------------------+
| rake    | CVE-2020-8130    | HIGH     | 0.9.6             | 12.3.3        | rake: OS Command Injection           |
|         |                  |          |                   |               | via egrep in Rake::FileList          |
|         |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2020-8130 |
+---------+------------------+----------+-------------------+---------------+--------------------------------------+