Azure / Azure/azure-storage-ruby

Supply-chain security issue: CVE-2021-41098 (CVSS High in stale dependency) || Support for EOL'd ruby versions

Open
#201 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Ruby
Stars
88
Forks
177
PR merge metrics
No merged PRs in 30d

Description

nokogiri <1.12.5 has a vulnerability classified as high-risk: [CVE-2021-41098](https://github.com/advisories/GHSA-2rr5-8q37-2w7h). However, this package is currently bundling nokogiri **v1.11.0.rc2**. That version `1.11.0.rc2` was released in April-2020 and appears to be in-use ONLY to maintain support for ruby v2.3 & 2.4.

Both versions of ruby have been EOL'd for more than a year (https://endoflife.date/ruby):
* ruby 2.3 EOL 3/2019
* ruby 2.4 EOL 3/2020
* Even ruby 2.5 was EOL'd, in 3/2021

**To remediate:**
Could this module be updated to deprecate support for ruby <2.6 & require the secure nokogiri version?
* https://github.com/Azure/azure-storage-ruby/pull/184
* https://github.com/Azure/azure-storage-ruby/pull/199

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.