CVE-2020-8130 in rake

[andriisoldatenko]

is it possible to upgrade rake version?

tl;dr if you run trivy security scanner you can see:

var/lib/gems/2.5.0/gems/fluent-plugin-detect-exceptions-0.0.13/Gemfile.lock
===========================================================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)
+---------+------------------+----------+-------------------+---------------+------------------------------+
| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |            TITLE             |
+---------+------------------+----------+-------------------+---------------+------------------------------+
| rake    | CVE-2020-8130    | CRITICAL | 10.5.0            | >= 12.3.3     | OS Command Injection in Rake |
+---------+------------------+----------+-------------------+---------------+------------------------------+

https://github.com/GoogleCloudPlatform/fluent-plugin-detect-exceptions/blob/master/fluent-plugin-detect-exceptions.gemspec#L25

[andriisoldatenko]

https://github.com/GoogleCloudPlatform/fluent-plugin-detect-exceptions/blob/master/fluent-plugin-detect-exceptions.gemspec#L25

[yvespp]

Now there are two issues:

usr/lib/ruby/gems/2.5.0/gems/fluent-plugin-detect-exceptions-0.0.13/Gemfile.lock
================================================================================
Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 1)

+---------+------------------+----------+-------------------+---------------+--------------------------------+
| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |             TITLE              |
+---------+------------------+----------+-------------------+---------------+--------------------------------+
| rake    | CVE-2020-8130    | CRITICAL | 10.5.0            | >= 12.3.3     | rake: OS Command Injection via |
|         |                  |          |                   |               | egrep in Rake::FileList        |
+---------+------------------+----------+-------------------+---------------+--------------------------------+
| rubocop | CVE-2017-8418    | LOW      | 0.42.0            | >= 0.49.0     | RuboCop: insecure use of /tmp  |
|         |                  |          |                   |               |                                |
+---------+------------------+----------+-------------------+---------------+--------------------------------+