Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

audited

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 3.1RubyGemsPublished

    Race Condition leading to logging errors

    CVE-2024-22047 · GHSA-hjp3-5g2q-7jww

    Affected
    • RubyGems audited >= 4.0.0, < 5.3.3
    Fixed in
    5.3.3· Vendor fix available
    Issue
    In certain setups with threaded web servers, Audited's use of Thread.current can incorrectly attributed audits to the wrong user. Fixed in 5.3.3. In March, @convisoappsec noticed that the library in question had a Race Condition problem, which caused logs to be registered at times with different users than those who performed the genuine actions. - The first issue we identified was from November 2021: https://github.com/collectiveidea/audited/issues/601 - So the solution was implemented in the following Pull Request: https://github.com/collectiveidea/audited/pull/669 - And the feature was published in version 5.3.3: RELEASE: https://github.com/collectiveidea/audited/pull/671

    Recommended action: Upgrade to 5.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →