CVE-2015-1820 (Critical) detected in rest-client-1.6.14.gem - autoclosed

[mend-bolt-for-github]

CVE-2015-1820 - Critical Severity Vulnerability

Vulnerable Library - rest-client-1.6.14.gem

A simple HTTP and REST client for Ruby, inspired by the Sinatra microframework style of specifying actions: get, put, post, delete.

Library home page: https://rubygems.org/gems/rest-client-1.6.14.gem

Path to dependency file: /vagrant/chef/cookbooks/java/Gemfile.lock

Path to vulnerable library: /tmp/containerbase/cache/.ruby/cache/rest-client-1.6.14.gem

Dependency Hierarchy:

• chefspec-3.4.0.gem (Root Library)
  • chef-11.6.0.gem
    • ❌ rest-client-1.6.14.gem (Vulnerable Library)

Found in HEAD commit: 4d4d8b25d41ea632109b5a3585587d2bf861b5d6

Found in base branch: master

Vulnerability Details

REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.

Publish Date: 2017-08-09

URL: CVE-2015-1820

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-1820

Release Date: 2017-08-09

Fix Resolution: 1.8.0

---

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.