Security issues in dependencies

[yvespp]

There are several security issues in the dependencies and they should be updated:

usr/lib/ruby/gems/2.5.0/gems/http_parser.rb-0.6.0/Gemfile.lock
==============================================================
Total: 8 (UNKNOWN: 1, LOW: 0, MEDIUM: 5, HIGH: 0, CRITICAL: 2)
+-----------+------------------+----------+-------------------+------------------------------+--------------------------------+
|  LIBRARY  | VULNERABILITY ID | SEVERITY | INSTALLED VERSION |        FIXED VERSION         |             TITLE              |
+-----------+------------------+----------+-------------------+------------------------------+--------------------------------+
| ffi       | CVE-2018-1000201 | MEDIUM   | 1.0.11            | >= 1.9.24                    | ruby-ffi DDL loading issue on  |
|           |                  |          |                   |                              | Windows OS                     |
+           +                  +          +-------------------+                              +                                +
|           |                  |          | 1.0.11-java       |                              |                                |
|           |                  |          |                   |                              |                                |
+-----------+------------------+----------+-------------------+------------------------------+--------------------------------+
| json      | CVE-2013-0269    | CRITICAL | 1.8.0-java        | ~> 1.5.5, ~> 1.6.8, >= 1.7.7 | rubygem-json: Denial of        |
|           |                  |          |                   |                              | Service and SQL Injection      |
+           +------------------+----------+-------------------+------------------------------+--------------------------------+
|           | CVE-2020-10663   | MEDIUM   | 1.8.0             | >= 2.3.0                     | rubygem-json: Unsafe Object    |
|           |                  |          |                   |                              | Creation Vulnerability in JSON |
+           +                  +          +-------------------+                              +                                +
|           |                  |          | 1.8.0-java        |                              |                                |
|           |                  |          |                   |                              |                                |
+           +------------------+----------+                   +------------------------------+--------------------------------+
|           | OSVDB-101157     | UNKNOWN  |                   | >= 1.1.0                     | json Gem for Ruby Data         |
|           |                  |          |                   |                              | Handling Stack Buffer Overflow |
+-----------+------------------+----------+-------------------+------------------------------+--------------------------------+
| rake      | CVE-2020-8130    | CRITICAL | 0.9.2             | >= 12.3.3                    | rake: OS Command Injection via |
|           |                  |          |                   |                              | egrep in Rake::FileList        |
+-----------+------------------+----------+-------------------+------------------------------+--------------------------------+
| yajl-ruby | CVE-2017-16516   | MEDIUM   | 1.1.0             | >= 1.3.1                     | rubygem-yajl-ruby:             |
|           |                  |          |                   |                              | Yajl::Parser.new.parse         |
|           |                  |          |                   |                              | incorrect parsing              |
+-----------+------------------+----------+-------------------+------------------------------+--------------------------------+

[tmm1]

Is anyone interested in taking over maintenance of this project?

[ganga1980]

/watch

[ganga1980]

@tmm1 , any plans on addressing vulnerabilities related to dependencies in 0.6.0 version?

[tmm1]

No. As I mentioned, I am looking for someone who is willing to take over maintenance. Are you interested?

[ashie]

@tmm1 Hi, I'm interested in maintaining it.
My account on RubyGems is https://rubygems.org/profiles/ashie

[ashie]

@tmm1 Thanks you for inviting me to this project!
Could you also take over ownership on RubyGems?: https://rubygems.org/gems/http_parser.rb

[ashie]

@tmm1 Again, could you also take over ownership on RubyGems? I wan to release a new gem.

Please add ashie at the following page.
https://rubygems.org/gems/http_parser.rb/owners

[ashie]

Now I've got the ownership. Thanks!

[ashie]

I've released 0.6.1 which fixes this issue.