bundler audit confuse loofah gem version 2.10.0 with 2.1
ksenia-sudarikova opened this issue · comments
I have loofah 2.10.0 in my Gemfile.lock and audit reports warning
== Warnings ==
Confidence: Medium
Category: Cross-Site Scripting
Check: SanitizeMethods
Message: loofah gem 2.10.0 is vulnerable (CVE-2018-8048). Upgrade to 2.2.1
File: Gemfile.lock
Line: 379
I believe its confuses 2.10.0 with 2.1 gem version vulnerable to CVE-2018-8048
What version of Ruby, RubyGems, and bundler-audit are you using? I can't reproduce this locally with a simple Gemfile containing gem 'bundler-audit', '0.8.0' and gem 'loofah', '2.10.0' on ruby 3.0.1p64 and rubygems 3.2.15.
Ruby 2.5.3p105, RubyGems 2.7.7, bundler-audit 0.8.0
Still can't reproduce on Ruby 2.5.9 and 2.7.6.3. I'm going to guess this is a bug in an older RubyGems. Maybe try updating to Ruby 2.5.9 (although the 2.5 series is no longer maintained) or RubyGems (gem update --system).
@ksenia-sudarikova Could youd double check if your warning message was from brakeman or bundle-audit? Your warning message looks like from brakeman.
Brakeman had such issue (presidentbeef/brakeman#1603). The newest version should have fixed it.
You right, I mix up bundler-audit message with brakeman, thanks for clarification