Vulnerable dependencies

[gfrankliu]

When I do gem install http_parser.rb , I see the file gems/http_parser.rb-0.6.0/Gemfile.lock installed, which has:

...
  specs:
    benchmark_suite (0.8.0)
    diff-lcs (1.1.2)
    ffi (1.0.11)
    ffi (1.0.11-java)
    json (1.8.0)
    json (1.8.0-java)
    rake (0.9.2)
    rake-compiler (0.7.9)
      rake
    rspec (2.4.0)
      rspec-core (~> 2.4.0)
      rspec-expectations (~> 2.4.0)
      rspec-mocks (~> 2.4.0)
    rspec-core (2.4.0)
    rspec-expectations (2.4.0)
      diff-lcs (~> 1.1.2)  
    rspec-mocks (2.4.0)
    yajl-ruby (1.1.0)
...

trivy reports some of those locked old version dependencies need upgrade:

+-----------+------------------+----------+-------------------+---------------+-----------------------------------------+
|  LIBRARY  | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                  TITLE                  |
+-----------+------------------+----------+-------------------+---------------+-----------------------------------------+
| ffi       | CVE-2018-1000201 | HIGH     | 1.0.11            | 1.9.24        | ruby-ffi DDL loading                    |
|           |                  |          |                   |               | issue on Windows OS                     |
|           |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2018-1000201 |
+           +                  +          +-------------------+               +                                         +
|           |                  |          | 1.0.11-java       |               |                                         |
|           |                  |          |                   |               |                                         |
|           |                  |          |                   |               |                                         |
+-----------+------------------+          +-------------------+---------------+-----------------------------------------+
| json      | CVE-2020-10663   |          | 1.8.0             | 2.3.0         | rubygem-json: Unsafe Object             |
|           |                  |          |                   |               | Creation Vulnerability in JSON          |
|           |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2020-10663   |
+           +                  +          +-------------------+               +                                         +
|           |                  |          | 1.8.0-java        |               |                                         |
|           |                  |          |                   |               |                                         |
|           |                  |          |                   |               |                                         |
+-----------+------------------+          +-------------------+---------------+-----------------------------------------+
| rake      | CVE-2020-8130    |          | 0.9.2             | 12.3.3        | rake: OS Command Injection              |
|           |                  |          |                   |               | via egrep in Rake::FileList             |
|           |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2020-8130    |
+-----------+------------------+          +-------------------+---------------+-----------------------------------------+
| yajl-ruby | CVE-2017-16516   |          | 1.1.0             | 1.3.1         | rubygem-yajl-ruby:                      |
|           |                  |          |                   |               | Yajl::Parser.new.parse                  |
|           |                  |          |                   |               | incorrect parsing                       |
|           |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2017-16516   |
+-----------+------------------+----------+-------------------+---------------+-----------------------------------------+

[ashie]

@tmm1 Could you release a new gem which doesn't include Gemfile.lock?
Other gems which depends on http_parser also receive this false positive security reports repeteadly.
e.g.) fluent/fluentd#3374

[ashie]

Already reported at #66