[Snyk] Fix for 3 vulnerabilities#1
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-RUBY-RACK-13378928 - https://snyk.io/vuln/SNYK-RUBY-RACK-13378930 - https://snyk.io/vuln/SNYK-RUBY-RACK-13378932
🎉 Snyk checks have passed. No issues have been found so far.✅ security/snyk check is complete. No issues have been found. (View Details) ✅ license/snyk check is complete. No issues have been found. (View Details) |
| gem 'dotenv-rails' | ||
|
|
||
| gem 'omniauth-salesloft', source: "http://gems.salesloft.com" | ||
| gem 'omniauth-salesloft', '>= 1.0.0', source: "http://gems.salesloft.com" |
Check failure
Code scanning / CodeQL
Dependency download using unencrypted communication channel High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
To fix the vulnerability, change the protocol of the custom gem source URL in the Gemfile from http:// to https://. This way, dependencies are fetched over an encrypted connection, mitigating the risk of MITM attacks during gem installation. Specifically, update line 11 of Gemfile so that "http://gems.salesloft.com" becomes "https://gems.salesloft.com". No additional imports or changes are required, as this is a simple string change within the Gemfile.
| @@ -8,7 +8,7 @@ | ||
|
|
||
| gem 'dotenv-rails' | ||
|
|
||
| gem 'omniauth-salesloft', '>= 1.0.0', source: "http://gems.salesloft.com" | ||
| gem 'omniauth-salesloft', '>= 1.0.0', source: "https://gems.salesloft.com" | ||
|
|
||
| group :development do | ||
| gem 'sqlite3' |
Snyk has created this PR to fix 3 vulnerabilities in the rubygems dependencies of this project.
Snyk changed the following file(s):
GemfileVulnerabilities that will be fixed with an upgrade:
SNYK-RUBY-RACK-13378928
SNYK-RUBY-RACK-13378930
SNYK-RUBY-RACK-13378932
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Allocation of Resources Without Limits or Throttling