[Snyk] Fix for 5 vulnerabilities - #53
Open
busterb wants to merge 5294 commits into
Open
Conversation
Fix frozen string crash
…de that may require
…d_credential, TMP_PASSWORD option
…ve on patched targets
… generated suffix
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
…xploit does not work if you remove the 'find' option
Rpc creds reports domain
…otes-json-data Notes returned as valid json instead of inspected string over RPC
…-rpc-new-report-approach RPC vulns and services reports resources and parents (service only)
update dependencies for Sinatra, Rack, and Thin to support rails 8 upgrade
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Tenable Security Center post gather module
This reverts commit 28814ed.
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
applied 4 of the changes, will look at the other suggestions manually Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
- Switch Unix targets from file-based payload to base64-encoded inline
in the branch name (--exec=echo${IFS}<b64>|base64${IFS}-d|sh).
File-based delivery broke fetch payloads because colons and special
characters in the staged command are invalid in git ref names.
Windows targets keep the file-based approach since NTFS forbids pipes.
- Re-pad base64 output to avoid '//' sequences (forbidden in git refs).
- Remove unused include_malicious param from setup_branches_via_git.
- Add report_gogs_service helper for report_vuln service linking.
- Add NOTE comment above version check threshold for maintainers.
- Update module description to reflect Unix (inline b64) vs Windows
(committed script file) delivery methods.
- Update docs: cache-clearing guidance for existing_repo re-exploitation,
fix check output in existing_repo scenario.
OpenSSL renders Microsoft AD CS enrollment extensions (Application Policies, AD DS SID extension, etc.) as a lossy byte dump - raw bytes on OpenSSL, non-printables collapsed to '.' on LibreSSL - which surfaced as unreadable mojibake at the bottom of the certificate trace. Decide rendering by OID class instead of inspecting the lossy string: decode the MS template name/info extensions we recognise, defer to OpenSSL for the standard PKIX extensions it renders cleanly (allowlist), and hex-encode the raw extnValue bytes of everything else so the output stays unambiguous and copy-pasteable. Adds spec coverage for the binary-extension and labeled-MS-extension hex paths (43 presenter examples, 0 failures).
fix gitlab version errors
Default to the most recent session
IPMI Scanner Bug Fixes
Fixes two bugs in the single shell riscv payloads
…trace-as-tgs-ap Kerberos-trace
…ken-169-fix fixes the "unsupported token: 169" error that occurs when executing stored procedures against Microsoft SQL
clickfix server
Add Missing EDB References
…cePresenter The ms-app-policies extension (OID 1.3.6.1.4.1.311.21.10) was previously hex-encoded because it hit the unrecognised-extension fallback. For ESC workflows the policy OIDs (e.g. Client Authentication) are the operationally meaningful part, so decode them instead. Uses Rex::Proto::CryptoAsn1::X509::CertificatePolicies and the framework OID table (Rex::Proto::CryptoAsn1::OIDs) — the same path cert_request.rb already uses — so output matches what icpr_cert prints in its Certificate Policies block. Falls back to the bare OID string when no friendly label is registered, and falls back to hex on any decode failure. Validated against a live AD CS lab (Server 2022, kerberos-DC1-CA) with a TraceTest template carrying msPKI-Certificate-Application-Policy set to clientAuth (1.3.6.1.5.5.7.3.2). Trace output now reads: Application Policies : 1.3.6.1.5.5.7.3.2 (Client Authentication) instead of: Application Policies : 30:0C:30:0A:06:08:2B:06:01:05:05:07:03:02
Add CertificateTracePresenter and certificate/CSR tracing support
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-RUBY-ERB-16636179 - https://snyk.io/vuln/SNYK-RUBY-JSON-15692503 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-16438970 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-15315717 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-16438967
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to fix 5 vulnerabilities in the rubygems dependencies of this project.
Snyk changed the following file(s):
GemfileVulnerabilities that will be fixed with an upgrade:
SNYK-RUBY-ERB-16636179
SNYK-RUBY-JSON-15692503
SNYK-RUBY-NOKOGIRI-16438970
SNYK-RUBY-NOKOGIRI-15315717
SNYK-RUBY-NOKOGIRI-16438967
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Use of Externally-Controlled Format String
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Missing Release of Memory after Effective Lifetime