Issues - herb - RubyGems | ReversingLabs Spectra Assure Community

List of software quality issues with the number of affected components.

Policies

Info

Problem

On Linux, external symbols are resolved via the procedure linkage table (PLT) and the global offset table (GOT). Without any protection, both are writable at runtime and thus leave the executable vulnerable to pointer hijacking - an attack where the function address is overwritten with an address of a malicious function. Pointer hijacking can be mitigated by using full read-only relocations, which instruct the compiler to unify global offset tables into a single read-only table. This requires that all external function symbols are resolved at load-time instead of during execution, and may increase loading time for large programs.

Prevalence in RubyGems community

3 packages

found in

Top 100

12 packages

found in

Top 1k

95 packages

found in

Top 10k

2.46k packages

in community

Next steps

In most cases, it's recommended to use full read-only relocations (in GCC: -Wl,-z,relro,-z,now).

If the executable load-time is an issue, you should use partial read-only relocations.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. A port number is associated with a network address of a host, such as an IP address, and the type of network protocol used for communication. Within URLs, the ports are optional. Ports can be specified in a URL immediately following the domain name. Each network protocol, or schema, has a set of standard ports on which the service operates. This issue is raised when a mismatch between a network protocol and its expected port number is detected. While the presence of non-standard ports does not imply malicious intent, all of their uses in a software package should be documented and approved.

Prevalence in RubyGems community

27 packages

found in

Top 100

376 packages

found in

Top 1k

1577 packages

found in

Top 10k

20k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the port to one that is standard for the networking protocol.

herb

SAFE Assessment

Compliance

Security

Threats

INCIDENTS FOR THIS VERSION:

Problem

Prevalence in RubyGems community

Next steps

Problem

Prevalence in RubyGems community

Next steps

Did you know...

Problem

Prevalence in RubyGems community

Next steps

Problem

Prevalence in RubyGems community

Next steps

herb

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: This package had 3 removal incidents in versions published within 2 years prior to the latestLatest version with removal incident detected: 5 months agoVersion: 0.8.1

INCIDENTS FOR THIS VERSION:

SQ18113Detected Linux executable files that were compiled without the recommended dynamic symbol hijacking protections.Causes risk: execution hijacking concernshardening

Problem

Prevalence in RubyGems community

Next steps

TH17115Detected presence of files containing URLs that use non-standard ports.hunting

Problem

Prevalence in RubyGems community

Next steps

Did you know...

SQ18113Detected Linux executable files that were compiled without the recommended dynamic symbol hijacking protections.Causes risk: execution hijacking concernshardening

Problem

Prevalence in RubyGems community

Next steps

TH17115Detected presence of files containing URLs that use non-standard ports.hunting

Problem

Prevalence in RubyGems community

Next steps