Azure / Azure/azure-storage-ruby
Supply-chain security issue: CVE-2021-41098 (CVSS High in stale dependency) || Support for EOL'd ruby versions
- Dominant language
- Ruby
- Stars
- 88
- Forks
- 177
- PR merge metrics
- No merged PRs in 30d
Description
nokogiri <1.12.5 has a vulnerability classified as high-risk: [CVE-2021-41098](https://github.com/advisories/GHSA-2rr5-8q37-2w7h). However, this package is currently bundling nokogiri **v1.11.0.rc2**. That version `1.11.0.rc2` was released in April-2020 and appears to be in-use ONLY to maintain support for ruby v2.3 & 2.4.
Both versions of ruby have been EOL'd for more than a year (https://endoflife.date/ruby):
* ruby 2.3 EOL 3/2019
* ruby 2.4 EOL 3/2020
* Even ruby 2.5 was EOL'd, in 3/2021
**To remediate:**
Could this module be updated to deprecate support for ruby <2.6 & require the secure nokogiri version?
* https://github.com/Azure/azure-storage-ruby/pull/184
* https://github.com/Azure/azure-storage-ruby/pull/199
Contributor guide
Assessment
This issue has not been assessed yet.