Open majormoses opened 6 years ago
If you are using bundler
for dependency management on your production environments please make sure you use bundle install --without development
to avoid installing these on servers. How to evaluate the severity as it impacts you:
This is a high risk as you typically install via bundler and would not use --without development
.
bundler
: High unless you properly use --without development
, otherwise medium. @majormoses thanks for your work here documenting the need to upgrade dependencies and keep our community up-to-date and free of security vulnerabilities.
I think it is important that the work you've described here move forward expeditiously, but I want to chime in to help others who find this issue understand how this vulnerability might affect their systems when installing gem artifacts from these projects.
As you've mentioned, using Bundler to install a defined set of gems will likely pull in these development dependencies. I think the situation is different for those using sensu-install
or the embedded gem
executables to install single gem packages.
In reviewing a sample of sensu-plugin projects described in the Github issue, I have manually installed some of these projects using sensu-install
and I have observed that development dependencies like yard
and rubocop
are not in fact installed as a side-effect of using sensu-install
or gem
commands.
Folks can test this for themselves by installing any of the projects listed in the original post here via /usr/bin/sensu-install
, and then use the /opt/sensu/embedded/bin/gem
executable to list installed gems, e.g.:
root@sensu:~# sensu-install -p sensu-plugins-apache
[SENSU-INSTALL] installing Sensu plugins ...
[SENSU-INSTALL] determining if Sensu gem 'sensu-plugins-apache' is already installed ...
false
[SENSU-INSTALL] Sensu plugin gems to be installed: ["sensu-plugins-apache"]
[SENSU-INSTALL] installing Sensu gem 'sensu-plugins-apache'
Fetching: sensu-plugins-apache-2.0.0.gem (100%)
You can use the embedded Ruby by setting EMBEDDED_RUBY=true in /etc/default/sensu
Successfully installed sensu-plugins-apache-2.0.0
1 gem installed
[SENSU-INSTALL] successfully installed Sensu plugins: ["sensu-plugins-apache"]
root@sensu:~# /opt/sensu/embedded/bin/gem list | grep apache
sensu-plugins-apache (2.0.0)
root@sensu:~# /opt/sensu/embedded/bin/gem list | grep yard
root@sensu:~# /opt/sensu/embedded/bin/gem list | grep rubocop
root@sensu:~#
Update yard gems to 0.9.11+ to mitigate issue: https://nvd.nist.gov/vuln/detail/CVE-2017-17042 This is a high severity largely because it can be exploited over the network and could be used to exfiltrate data by reading sensitive files. It should be a relatively easy to divide and conquer. If anyone would like to help out please comment here claiming which ones you will work on. I will start at the top and work my way down skipping any that are claimed. While we do not explicitly call out the use of ### Security in our changelog guidelines there is mention of such in the keep a changelog guidelines which we are based on.
Github is the best:![image](https://user-images.githubusercontent.com/3145127/35251590-c184f6c6-ff90-11e7-9887-dd0c2b49f6f4.png)
Quick and dirty to find list of affected gems:
Plugins needing updates: