paratrooper-pingdom

Send deploy notifications to Pingdom service when deploying with Paratrooper

View on Rubygems

Activity

Latest release: 13y ago
Total releases: 1
Cadence: —
Last 12 months: 0

Details

First release: Apr 28, 2013

Releases

Version Released

Version	Released
`1.0.0` initial 1 CVE	Apr 28, 2013

1.0.0 initial

1 CVE

CVE-2014-1233 GHSA-fqrr-rrwg-69pv Oct 24, 2017

Local API Login Credentials Disclosure in paratrooper-pingdom

Low

The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process.

Vulnerable Code:

From: paratrooper-pingdom-1.0.0/lib/paratrooper-pingdom.rb

def setup(options = {})
  %x[curl https://api.pingdom.com/api/2.0/checks -X PUT -d "paused=true" -H "App-Key: #{app_key}" -u "#{username}:#{password}"]        
end

def teardown(options = {})
  %x[curl https://api.pingdom.com/api/2.0/checks -X PUT -d "paused=false" -H "App-Key: #{app_key}" -u "#{username}:#{password}"]        
end

A malicious user could monitor the process tree to steal the API key, username and password for the API login.

Affected versions


          1.0.0

References

Updated Dec 08, 2024 · Source: OSV.dev

Apr 28, 2013

Dependencies (4)

Depends on

1.0.0

Supply-chain exposure

Known CVEs (1)

CVE-2014-1233 GHSA-fqrr-rrwg-69pv Oct 24, 2017

Local API Login Credentials Disclosure in paratrooper-pingdom

Low

The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process.

Vulnerable Code:

From: paratrooper-pingdom-1.0.0/lib/paratrooper-pingdom.rb

def setup(options = {}) %x[curl https://api.pingdom.com/api/2.0/checks -X PUT -d "paused=true" -H "App-Key: #{app_key}" -u "#{username}:#{password}"] end def teardown(options = {}) %x[curl https://api.pingdom.com/api/2.0/checks -X PUT -d "paused=false" -H "App-Key: #{app_key}" -u "#{username}:#{password}"] end

A malicious user could monitor the process tree to steal the API key, username and password for the API login.

Affected versions

1.0.0

References

https://nvd.nist.gov/vuln/detail/CVE-2014-1233
https://github.com/advisories/GHSA-fqrr-rrwg-69pv
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/paratrooper-pingdom/CVE-2014-1233.yml
http://openwall.com/lists/oss-security/2014/01/08/1
http://www.vapid.dhs.org/advisories/paratrooper-api-key-pingdom.html

Updated Dec 08, 2024 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

1 releases

Release calendar

2013

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More