security: v2 CVE-2024-22191

[Paul-Bob]

Description

Addresses GHSA-ghjv-mh6x-7q6h

Fixes a security issue where the output for the key_value field is not sanitized.

[tamaloa]

Hi, i just stumbled across here because my updated avo (2.47) is still reported as vulnerable. I assume it takes some time for the ruby-vulnerability-db to pick up the change but maybe the avo security-advisory should be updated to reflect that only <= 2.46.0 is affected?

[adrianthedev]

Hey @tamaloa.
I updated it now with <= 2.46.
Please let me know if that fixes it.

[tamaloa]

First off: Thanks for backporting the fix - we are just not yet ready for 2 -> 3 upgrade :)

I am also a bit confused regarding what path a security-advisory takes until it ends up in the tool you are using (bundler-audit in our case which uses ruby-advisory-db which uses github-advisories). But it seems it worked out for this CVE :)

Regarding ruby-advisory-db: I noticed they have the next advisory which would affect the avo 2.x branch lined up (rubysec/ruby-advisory-db#736) -> "Possible XSS in Action messages". This is taken from the linked github-advisory (GHSA-g8vp-2v5p-9qfh) which also flags avo 2.x as vulnerable (affected versions: < 3.0.2). But your own security-advisory (GHSA-g8vp-2v5p-9qfh) only mentions one specific release (3.0.0.pre12) to be vulnerable.

So is the 2.x branch vulnerable to "Possible XSS in Action messages"? If not it would be great if the advisories were changed :)

Sorry this does not really belong into this PR but i could not find a better place to comment on this.