resque 1.22.0

3 security vulnerabilities found in version 1.22.0

Resque vulnerable to reflected XSS in Queue Endpoint

medium severity CVE-2023-50727
medium severity CVE-2023-50727
Patched versions: >= 2.6.0

Impact

Reflected XSS can be performed using the current_queue portion of the path on the /queues endpoint of resque-web.

Patches

v2.6.0

Workarounds

No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.

References

https://github.com/resque/resque/pull/1865

Resque vulnerable to reflected XSS in resque-web failed and queues lists

medium severity CVE-2023-50725
medium severity CVE-2023-50725
Patched versions: >= 2.2.1

Impact

The following paths in resque-web have been found to be vulnerable to reflected XSS:

/failed/?class=<script>alert(document.cookie)</script>
/queues/><img src=a onerror=alert(document.cookie)>

Patches

v2.2.1

Workarounds

No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.

References

https://github.com/resque/resque/pull/1790

Resque vulnerable to Reflected Cross Site Scripting through pathnames

medium severity CVE-2023-50724
medium severity CVE-2023-50724
Patched versions: >= 2.1.0

Impact

resque-web in resque versions before 2.1.0 is vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint.

Patches

v2.1.0

Workarounds

No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.

References

https://github.com/resque/resque/issues/1679 https://github.com/resque/resque/pull/1687

No officially reported memory leakage issues detected.


This gem version does not have any officially reported memory leaked issues.

Author did not declare license for this gem in the gemspec.


This gem version has a MIT license in the source code, however it was not declared in the gemspec file.

This gem version is available.


This gem version has not been yanked and is still available for usage.