Spectra Assure

warningRisk: Vulnerabilities

Scanned:

devfile

latest

Top 10k

Parse and generate kubernetes manifests from a Devfile

License: Permissive (MIT)

Published:

Visit source repository

See on RubyGems

SAFE Assessment

Compliance

Licenses

2 weak copyleft linked components

Secrets

4 debugging symbols found

Security

Vulnerabilities

1 high severity vulnerabilities

Hardening

2 baseline mitigations missing

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

INCIDENTS FOR THIS VERSION:

Overview issues15 vulnerabilities5 malware0 behaviors135 dependencies0 contributors1 versions43

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.

Prevalence in RubyGems community

36 packages

found in

Top 100

157 packages

found in

Top 1k

1717 packages

found in

Top 10k

29.81k packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Operating systems execute application code in multiple privilege access levels. Separation of privileges is designed to protect the stability and integrity of the operating system by shielding it from issues that the user run applications may cause. However, some users may need to interact with higher privilege parts of the operating system to accomplish specific tasks. For this purpose, operating systems provide facilities that users may leverage to temporarily elevate their running privileges. Users with higher privileges can run any application with the same privilege level as their own. Attackers often try to trick privileged users into running malicious code, enabling them to infect the operating system. While the presence of code that elevates user privileges does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that can elevate user privileges. One example of acceptable use for such functions is allowing the users to install software packages and updates.

Prevalence in RubyGems community

1 packages

found in

Top 100

8 packages

found in

Top 1k

60 packages

found in

Top 10k

1.13k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1548 - Abuse Elevation Control Mechanism.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. One or more embedded URLs were discovered to link to raw files hosted on GitHub. Attackers often abuse popular web services to host malicious payloads. Since code-sharing service URLs are typically allowed by security solutions, using them for payload delivery increases the odds that the malicious code will reach the user. While the presence of code-sharing service locations does not imply malicious intent, all of their uses in a software package should be documented and approved. An increasing number of software supply chain attacks in the open source space leverage the GitHub service to deliver malicious payloads.

Prevalence in RubyGems community

8 packages

found in

Top 100

60 packages

found in

Top 1k

609 packages

found in

Top 10k

5.18k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider an alternative delivery mechanism for software packages.

Problem

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Weak copyleft licenses in particular impose requirements that the user must be able to replace or update the code they apply to. In practical terms, that means the object and library files that statically link to weak copyleft code must be made available publicly. For commercial applications, this is typically undesirable. Therefore, statically linking to weak copyleft code is commonly avoided or even prohibited by the organization policy. Instead of linking statically to weak copyleft licensed code, it is recommended to isolate such code into modules that the publisher-developed, first-party code can dynamically link to without the aforementioned obligations.

Prevalence in RubyGems community

0 packages

found in

Top 100

1 packages

found in

Top 1k

7 packages

found in

Top 10k

302 packages

in community

Next steps

Confirm that the software package statically links to a weak copyleft dependency.

Investigate if the software publisher provides this dependency under a non-copyleft license.

Consider replacing the software dependency with an alternative that offers a license compatible with commercial use.

Alternatively, repackage the code so that it dynamically links to a weak copyleft dependency.

Problem

ASLR (address-space layout randomization) is a mitigation technique that increases the difficulty of performing buffer-overflow attacks that require the attacker to know the address of the program in memory. This is done by loading the program at a randomly selected address in the process' address space. ASLR-enabled kernels can choose a random load address only for position-independent executables and code.

Prevalence in RubyGems community

0 packages

found in

Top 100

9 packages

found in

Top 1k

46 packages

found in

Top 10k

2.69k packages

in community

Next steps

To support ASLR, the program must be compiled as position-independent code. In most compilers, this is done by passing the corresponding position-independent flag, such as -fPIC for shared libraries or -fPIE for executables.

Problem

On Linux, external symbols are resolved via the procedure linkage table (PLT) and the global offset table (GOT). The global offset table is split into two tables - one for external data, and one for external functions. Without any protection, both are writable at runtime and thus leave the executable vulnerable to data overwrite attacks and pointer hijacking. Data overwrite attacks can be mitigated by using partial read-only relocations, while pointer hijacking can be mitigated with full read-only relocations. Both approaches have some drawbacks. Partial read-only relocations don't provide full protection, because the external function GOT remains writable. Full read-only relocations require that all external function symbols are resolved at load-time instead of during execution. This may increase loading time for large programs.

Prevalence in RubyGems community

0 packages

found in

Top 100

10 packages

found in

Top 1k

88 packages

found in

Top 10k

1.59k packages

in community

Next steps

In most cases, it's recommended to use full read-only relocations (in GCC: -Wl,-z,relro,-z,now).

If the executable load-time is an issue, you should use partial read-only relocations.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as medium severity.

Prevalence in RubyGems community

28 packages

found in

Top 100

136 packages

found in

Top 1k

1520 packages

found in

Top 10k

27.75k packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Software components contain executable code that performs actions implemented during its development. These actions are called behaviors. In the analysis report, behaviors are presented as human-readable descriptions that best match the underlying code intent. While most behaviors are benign on their own, some might become important for analysis when observed alongside other capabilities the component exhibits. This issue is reported for files that can enumerate user information and make HTTP requests. While presence of this behavior combination does not imply malicious intent, it is advised that the reported files are reviewed. One example of acceptable use for this type of data collection is the opt-in telemetry for software debugging purposes.

Prevalence in RubyGems community

0 packages

found in

Top 100

0 packages

found in

Top 1k

2 packages

found in

Top 10k

143 packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.

Consider limiting the collection of user information to a minimum.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. Attackers often try to trick users into visiting a malicious domain. Users are more likely to click the links they deem trustworthy. To appear trustworthy, attackers may craft URLs that use well-known and trusted domains as subdomains. Subdomains appear first in the browser address bar. Combined with other URL obfuscation techniques, this approach may mislead the users into visiting an attacker-controlled domain. While presence of trusted domains as subdomains does not imply malicious intent, all instances of this issue should be reviewed for spelling mistakes and typos. An attacker could be controlling the domains the application intends to connect to.

Prevalence in RubyGems community

0 packages

found in

Top 100

7 packages

found in

Top 1k

17 packages

found in

Top 10k

117 packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Remove all references to flagged network locations.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. Top-level domains (TLD) are a part of the Domain Name System (DNS), and are used to lookup an Internet Protocol (IP) address of a requested website. There are a few different types of top-level domains. Generic, sponsored and country-code TLDs are generally accessible to the public. Registrars that govern the assignment of domain names within the TLD may choose to sell specific domain names to an interested party. However, some registrars are known to have less strict rules for assigning domain names. Attackers often abuse gaps in governance and actively seek to register their malicious domains in such TLDs. This issue is raised for all domains registered within TLDs that harbor an excessive number of malicious sites. While the presence of suspicious TLDs does not imply malicious intent, all of its uses in a software package should be documented and approved.

Prevalence in RubyGems community

5 packages

found in

Top 100

17 packages

found in

Top 1k

192 packages

found in

Top 10k

2.28k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the top-level domain to avoid being flagged by security solutions.

devfile

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: This package had 3 removal incidents in versions published within 2 years prior to the latestLatest version with removal incident detected: about 1 year agoVersion: 0.4.6

INCIDENTS FOR THIS VERSION:

Did you know...

SQ31105Detected presence of high severity vulnerabilities.Causes risk: high severity vulnerabilitiesvulnerabilities

Problem

Prevalence in RubyGems community

Next steps

TH16120Detected presence of software components that can elevate the user privileges.hunting

Problem

Prevalence in RubyGems community

Next steps

TH17127Detected presence of files containing URLs that link to raw files on GitHub.hunting

Problem

Prevalence in RubyGems community

Next steps

SQ12103Detected presence of statically linked dependencies distributed with weak copyleft licenses.Causes risk: weak copyleft linked componentslicenses

Problem

Prevalence in RubyGems community

Next steps

SQ18111Detected Linux executable files that do not implement the ASLR vulnerability mitigation protection.Causes risk: baseline mitigations missinghardening

Problem

Prevalence in RubyGems community

Next steps

SQ18112Detected Linux executable files that were compiled without any dynamic symbol hijacking protections.Causes risk: execution hijacking concernshardening

Problem

Prevalence in RubyGems community

Next steps

SQ31106Detected presence of medium severity vulnerabilities.Causes risk: medium severity vulnerabilitiesvulnerabilities

Problem

Prevalence in RubyGems community

Next steps

TH16106Detected presence of files that collect and exfiltrate user information.hunting

Problem

Prevalence in RubyGems community

Next steps

TH17114Detected presence of files containing URLs that use trusted domains as subdomains.hunting

Problem

Prevalence in RubyGems community

Next steps

TH17118Detected presence of files containing URLs that use suspicious top-level domains.hunting

Problem

Prevalence in RubyGems community

Next steps