GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → rubysec → Bundler Audit

rubysec / Bundler Audit

Licence: gpl-3.0
Patch-level verification for Bundler

Programming Languages

ruby
36898 projects - #4 most used programming language

Labels

securitysecurity-toolssecurity-auditbundler-auditpatch-managementdependency-checkerruby-advisory-db

Projects that are alternatives of or similar to Bundler Audit

Dockle
Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start
Stars: ✭ 1,713 (-28.42%)
Mutual labels:  security-tools, security-audit
Replica
Ghidra Analysis Enhancer 🐉
Stars: ✭ 194 (-91.89%)
Mutual labels:  security-tools, security-audit
Sippts
Set of tools to audit SIP based VoIP Systems
Stars: ✭ 116 (-95.15%)
Mutual labels:  security-tools, security-audit
Aws Securitygroup Grapher
This ansible role gets information from an AWS VPC and generate a graphical representation of security groups
Stars: ✭ 93 (-96.11%)
Mutual labels:  security-tools, security-audit
Minesweeper
A Burpsuite plugin (BApp) to aid in the detection of scripts being loaded from over 23000 malicious cryptocurrency mining domains (cryptojacking).
Stars: ✭ 162 (-93.23%)
Mutual labels:  security-tools, security-audit
Vsaudit
VOIP Security Audit Framework
Stars: ✭ 97 (-95.95%)
Mutual labels:  security-tools, security-audit
Nosqlmap
Automated NoSQL database enumeration and web application exploitation tool.
Stars: ✭ 1,928 (-19.43%)
Mutual labels:  security-tools, security-audit
Purify
All-in-one tool for managing vulnerability reports from AppSec pipelines
Stars: ✭ 72 (-96.99%)
Mutual labels:  security-tools, security-audit
Nebulousad
NebulousAD automated credential auditing tool.
Stars: ✭ 158 (-93.4%)
Mutual labels:  security-tools, security-audit
Libdiffuzz
Custom memory allocator that helps discover reads from uninitialized memory
Stars: ✭ 147 (-93.86%)
Mutual labels:  security-tools, security-audit
Pentest Notes
Collection of Pentest Notes and Cheatsheets from a lot of repos (SofianeHamlaoui,dostoevsky,mantvydasb,adon90,BriskSec)
Stars: ✭ 89 (-96.28%)
Mutual labels:  security-tools, security-audit
Recsech
Recsech is a tool for doing Footprinting and Reconnaissance on the target web. Recsech collects information such as DNS Information, Sub Domains, HoneySpot Detected, Subdomain takeovers, Reconnaissance On Github and much more you can see in Features in tools .
Stars: ✭ 173 (-92.77%)
Mutual labels:  security-tools, security-audit
Notruler
The opposite of Ruler, provides blue teams with the ability to detect Ruler usage against Exchange.
Stars: ✭ 72 (-96.99%)
Mutual labels:  security-tools, security-audit
Catnip
Cat-Nip Automated Basic Pentest Tool - Designed For Kali Linux
Stars: ✭ 108 (-95.49%)
Mutual labels:  security-tools, security-audit
Gscan
本程序旨在为安全应急响应人员对Linux主机排查时提供便利，实现主机侧Checklist的自动全面化检测，根据检测结果自动数据聚合，进行黑客攻击路径溯源。
Stars: ✭ 1,177 (-50.81%)
Mutual labels:  security-tools, security-audit
Horn3t
Powerful Visual Subdomain Enumeration at the Click of a Mouse
Stars: ✭ 120 (-94.99%)
Mutual labels:  security-tools, security-audit
Lynis
Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
Stars: ✭ 9,137 (+281.82%)
Mutual labels:  security-tools, security-audit
Vuls
Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
Stars: ✭ 8,844 (+269.58%)
Mutual labels:  security-tools, security-audit
Reconnoitre
A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.
Stars: ✭ 1,824 (-23.78%)
Mutual labels:  security-tools, security-audit
Dirsearch
A Go implementation of dirsearch.
Stars: ✭ 164 (-93.15%)
Mutual labels:  security-tools, security-audit
View All Similar Projects ➔

bundler-audit

CI Code Climate Gem Version

Description

Patch-level verification for bundler.

Features

  • Checks for vulnerable versions of gems in Gemfile.lock.
  • Checks for insecure gem sources (http:// and git://).
  • Allows ignoring certain advisories that have been manually worked around.
  • Prints advisory information.
  • Does not require a network connection.

Synopsis

Audit a project's Gemfile.lock:

$ bundle-audit
Name: actionpack
Version: 3.2.10
Advisory: OSVDB-91452
Criticality: Medium
URL: http://www.osvdb.org/show/osvdb/91452
Title: XSS vulnerability in sanitize_css in Action Pack
Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13

Name: actionpack
Version: 3.2.10
Advisory: OSVDB-91454
Criticality: Medium
URL: http://osvdb.org/show/osvdb/91454
Title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails
Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13

Name: actionpack
Version: 3.2.10
Advisory: OSVDB-89026
Criticality: High
URL: http://osvdb.org/show/osvdb/89026
Title: Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing Remote Code Execution
Solution: upgrade to ~> 2.3.15, ~> 3.0.19, ~> 3.1.10, >= 3.2.11

Name: activerecord
Version: 3.2.10
Advisory: OSVDB-91453
Criticality: High
URL: http://osvdb.org/show/osvdb/91453
Title: Symbol DoS vulnerability in Active Record
Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13

Name: activerecord
Version: 3.2.10
Advisory: OSVDB-90072
Criticality: Medium
URL: http://direct.osvdb.org/show/osvdb/90072
Title: Ruby on Rails Active Record attr_protected Method Bypass
Solution: upgrade to ~> 2.3.17, ~> 3.1.11, >= 3.2.12

Name: activerecord
Version: 3.2.10
Advisory: OSVDB-89025
Criticality: High
URL: http://osvdb.org/show/osvdb/89025
Title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass
Solution: upgrade to ~> 2.3.16, ~> 3.0.19, ~> 3.1.10, >= 3.2.11

Name: activesupport
Version: 3.2.10
Advisory: OSVDB-91451
Criticality: High
URL: http://www.osvdb.org/show/osvdb/91451
Title: XML Parsing Vulnerability affecting JRuby users
Solution: upgrade to ~> 3.1.12, >= 3.2.13

Unpatched versions found!

Update the ruby-advisory-db that bundle audit uses:

$ bundle-audit update
Updating ruby-advisory-db ...
remote: Counting objects: 44, done.
remote: Compressing objects: 100% (24/24), done.
remote: Total 39 (delta 19), reused 29 (delta 10)
Unpacking objects: 100% (39/39), done.
From https://github.com/rubysec/ruby-advisory-db
 * branch            master     -> FETCH_HEAD
Updating 5f8225e..328ca86
Fast-forward
 CONTRIBUTORS.md                    |  1 +
 gems/actionmailer/OSVDB-98629.yml  | 17 +++++++++++++++++
 gems/cocaine/OSVDB-98835.yml       | 15 +++++++++++++++
 gems/fog-dragonfly/OSVDB-96798.yml | 13 +++++++++++++
 gems/sounder/OSVDB-96278.yml       | 13 +++++++++++++
 gems/wicked/OSVDB-98270.yml        | 14 ++++++++++++++
 6 files changed, 73 insertions(+)
 create mode 100644 gems/actionmailer/OSVDB-98629.yml
 create mode 100644 gems/cocaine/OSVDB-98835.yml
 create mode 100644 gems/fog-dragonfly/OSVDB-96798.yml
 create mode 100644 gems/sounder/OSVDB-96278.yml
 create mode 100644 gems/wicked/OSVDB-98270.yml
ruby-advisory-db: 64 advisories

Update the ruby-advisory-db and check Gemfile.lock (useful for CI runs):

$ bundle-audit check --update

Checking the Gemfile.lock without updating the ruby-advisory-db:

$ bundle-audit check --no-update

Ignore specific advisories:

$ bundle-audit check --ignore OSVDB-108664

Checking a custom Gemfile.lock file:

$ bundle-audit check --gemfile Gemfile.custom.lock

Output the audit's results in JSON:

$ bundle-audit check --format json

Output the audit's results in JSON, to a file:

$ bundle-audit check --format json --output bundle-audit.json

Rake Tasks

Bundler-audit provides Rake tasks for checking the code and for updating its vulnerability database:

rake bundle:audit
rake bundle:audit:update

Configuration File

bundler-audit also supports a per-project configuration file:

.bundler-audit.yml:

---
ignore:
  - CVE-YYYY-XXXX
  - ...
  • ignore: [Array<String>] - A list of advisory IDs to ignore.

You can provide a path to a config file using the --config flag:

$ bundle-audit check --config bundler-audit.custom.yaml

Requirements

Install

$ [sudo] gem install bundler-audit

Git

  • Debian / Ubuntu:

    $ sudo apt install git

  • RedHat / Fedora:

    $ sudo dnf install git

  • Alpine Linux:

    $ apk add git

  • macOS:

    $ brew install git

Contributing

  1. https://github.com/rubysec/bundler-audit/fork
  2. git clone YOUR_FORK_URI
  3. cd bundler-audit/
  4. bundle install
  5. bundle exec rake spec
  6. git checkout -b YOUR_FEATURE
  7. Make your changes
  8. bundle exec rake spec
  9. git commit -a
  10. git push origin YOUR_FEATURE

License

Copyright (c) 2013-2021 Hal Brodigan (postmodern.mod3 at gmail.com)

bundler-audit is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

bundler-audit is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with bundler-audit. If not, see https://www.gnu.org/licenses/.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].