turkdevops / ruby Goto Github PK

Thank you forking ruby/ruby.

We, probably who are watching ruby/ruby, receive GitHub Actions failure mails everyday recently.

The failures are:

actions/checkout@v3, actions/cache@v3, github/codeql-action/init@v2, github/codeql-action/autobuild@v2, and github/codeql-action/analyze@v2 are not allowed to be used in turkdevops/ruby. Actions in this workflow must be: within a repository owned by turkdevops.

Please stop failure mails to us, stop CIs if you are not using them, or fix the failures as https://github.com/orgs/community/discussions/25488.

Regards,

CVE-2019-16162 - High Severity Vulnerability

Vulnerable Library - rubyv3_1_0_preview1

The Ruby Programming Language [mirror]

Library home page: https://github.com/ruby/ruby.git

Found in HEAD commit: 396187518e4aba07d41e7e5eb3f5abc9e9b567c7

Found in base branch: master

Vulnerable Source Files (1)

/regenc.c

Vulnerability Details

Onigmo through 6.2.0 has an out-of-bounds read in parse_char_class because of missing codepoint validation in regenc.c.

Publish Date: 2019-09-09

URL: CVE-2019-16162

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here