Vulnerability in ruby-sidekiq - security update
Summary
DLA-2943-1: ruby-sidekiq - security update. Affects ruby-sidekiq versions < 4.2.3+dfsg-1+deb9u1. Fixed in 4.2.3+dfsg-1+deb9u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ruby-sidekiq is a simple and efficient background processing library for Ruby. It provides a framework for executing background jobs asynchronously, allowing developers to offload time-consuming tasks from the main application thread. This vulnerability affects version 4.2.3+dfsg-1+deb9u1 of the package in Debian 9 stretch.
Vulnerability Detail
The vulnerability in ruby-sidekiq consists of two separate issues:
-
CVE-2021-30151: Sidekiq allows cross-site scripting (XSS) attacks via the queue name of the live-poll feature when Internet Explorer is used. This means that an attacker can inject malicious code into the queue name, which will be executed when viewed by a user using Internet Explorer.
-
CVE-2022-23837: In api.rb in Sidekiq, there is no limit on the number of days when requesting stats for the graph. This can lead to system overload, affecting the Web UI and making it unavailable to users. An attacker can exploit this vulnerability by repeatedly requesting stats for a large number of days, causing a denial-of-service (DoS) condition.
How To Fix
Minimum fixed version
4.2.3+dfsg-1+deb9u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby-sidekiqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the vulnerabilities in ruby-sidekiq can lead to cross-site scripting (XSS) attacks and denial-of-service (DoS) conditions. To mitigate these risks, it is crucial to upgrade to version 4.2.3+dfsg-1+deb9u1 or later. If you need further assistance or support in addressing these vulnerabilities, please contact DevNack.com.
See every vulnerability recorded for ruby-sidekiq →
FAQ
ruby-sidekiq is a background processing library for Ruby that allows developers to execute time-consuming tasks asynchronously.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
These vulnerabilities affect version 4.2.3+dfsg-1+deb9u1 of ruby-sidekiq in Debian 9 stretch.
You can check the version of ruby-sidekiq installed on your system by running the following command:
ruby-sidekiq --version
No, there is no known workaround for these vulnerabilities. It is recommended to upgrade to the latest version of ruby-sidekiq.
Related vulnerabilities
Recent vulnerabilities recorded for ruby-sidekiq.
