bundler-audit 0.4.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/omniauth/CVE-2017-18076.yml

@@ -0,0 +1,18 @@
+---
+gem: omniauth
+cve: 2017-18076
+url: https://github.com/omniauth/omniauth/pull/867
+title: omniauth leaks authenticity token in callback params
+date: 2017-01-11
+
+description: |
+  In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.
+
+cvss_v2: 6.8
+
+patched_versions:
+  - ">= 1.3.2"
+
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-18076

data/data/ruby-advisory-db/gems/omniauth_amazon/CVE-2019-15224.yml

@@ -0,0 +1,19 @@
+---
+gem: omniauth_amazon
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in omniauth_amazon
+description: |-
+  The omniauth_amazon gem 1.0.1 for Ruby, as distributed on RubyGems.org, included a
+  code-execution backdoor inserted by a third party.
+
+  Users of an affected version should consider downgrading to the last non-affected version of
+  1.0.1.
+unaffected_versions:
+  - "< 1.0.1"
+  - "> 1.0.1"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/open-uri-cached/OSVDB-121701.yml

@@ -0,0 +1,13 @@
+---
+gem: open-uri-cached
+cve: 2015-3649
+osvdb: 121701
+url: http://seclists.org/oss-sec/2015/q2/373
+title: open-uri-cached Gem for Ruby Unsafe Temporary File Creation Local Privilege Escalation
+date: 2015-05-05
+description: |
+  open-uri-cached Gem for Ruby contains a flaw that is due to the
+  program creating temporary files in a predictable, unsafe manner when using
+  YAML. This may allow a local attacker to gain elevated privileges.
+cvss_v2:
+patched_versions:

data/data/ruby-advisory-db/gems/openssl/CVE-2016-7798.yml

@@ -0,0 +1,16 @@
+---
+gem: openssl
+cve: 2016-7798
+url: https://github.com/ruby/openssl/issues/49
+date: 2017-10-24
+title: Incorrect handling of initialization vector in the GCM mode in OpenSSL
+description: |
+  The openssl gem for Ruby uses the same initialization vector (IV) in
+  GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for
+  context-dependent attackers to bypass the encryption protection mechanism.
+
+cvss_v3: 7.5
+cvss_v2: 5.0
+
+patched_versions:
+  - ">= 2.0.0"

data/data/ruby-advisory-db/gems/ox/CVE-2017-15928.yml

@@ -0,0 +1,16 @@
+---
+gem: ox
+cve: 2017-15928
+url: https://github.com/ohler55/ox/issues/194
+date: 2017-10-27
+title: ox ruby gem segmentation fault via parse_obj
+description: |
+  In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation
+  fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated
+  "Ox should handle the error more gracefully" but has not confirmed a security implication.
+
+cvss_v3: 7.5
+cvss_v2: 5.0
+
+patched_versions:
+  - ">= 2.8.1"

data/data/ruby-advisory-db/gems/ox/CVE-2017-16229.yml

@@ -0,0 +1,16 @@
+---
+gem: ox
+cve: 2017-16229
+url: https://github.com/ohler55/ox/issues/195
+date: 2017-10-29
+title: ox ruby gem stack overflow in sax_parse
+description: |
+  In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based
+  buffer over-read in the read_from_str function in sax_buf.c when a crafted input
+  is supplied to sax_parse.
+
+cvss_v3: 5.5
+cvss_v2: 4.3
+
+patched_versions:
+  - ">= 2.8.2"

data/data/ruby-advisory-db/gems/padrino-contrib/CVE-2019-16145.yml

@@ -0,0 +1,11 @@
+---
+gem: padrino-contrib
+cve: 2019-16145
+ghsa: rwpr-83g3-96g7
+url: https://github.com/padrino/padrino-contrib/pull/35
+date: 2019-09-23
+title: padrino-contrib XSS via caption parameter of breadcrumbs helper
+description: |
+  The breadcrumbs contributed module through 0.2.0 for Padrino Framework
+  allows XSS via a caption.
+cvss_v3: 6.1

data/data/ruby-advisory-db/gems/paperclip/CVE-2015-2963.yml

@@ -0,0 +1,16 @@
+---
+gem: paperclip
+cve: 2015-2963
+url: https://robots.thoughtbot.com/paperclip-security-release
+title: |
+  Paperclip Gem for Ruby vulnerable to content type spoofing
+date: 2015-06-05
+description: |
+  There is an issue where if an HTML file is uploaded with a .html
+  extension, but the content type is listed as being `image/jpeg`, this
+  will bypass a validation checking for images. But it will also pass the
+  spoof check, because a file named .html and containing actual HTML
+  passes the spoof check.
+cvss_v2: 4.3
+patched_versions:
+  - ">= 4.2.2"

data/data/ruby-advisory-db/gems/paperclip/CVE-2017-0889.yml

@@ -0,0 +1,23 @@
+---
+gem: paperclip
+cve: 2017-0889
+url: https://github.com/thoughtbot/paperclip/pull/2435
+date: 2018-01-23
+title: |
+  Paperclip ruby gem suffers from a Server-Side Request Forgery (SSRF) vulnerability
+  in the Paperclip::UriAdapter and Paperclip::HttpUrlProxyAdapter class.
+description: |
+  Paperclip gem provides multiple ways a file can be uploaded to a web server.
+  The vulnerability affects two of Paperclip’s IO adapters that accept URLs as
+  attachment data (UriAdapter and HttpUrlProxyAdapter). When these adapters are
+  used, Paperclip acts as a proxy and downloads the file from the website URI
+  that is passed in. The library does not perform any validation to protect
+  against Server Side Request Forgery (SSRF) exploits by default. This may allow
+  a remote attacker to access information about internal network resources.
+cvss_v2: 7.5
+patched_versions:
+  - ">= 5.2.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-0889
+    - https://github.com/thoughtbot/paperclip/commit/4ebedfbd11d20d03ed03a1274ed281eee62715d4

data/data/ruby-advisory-db/gems/paranoid2/CVE-2019-13589.yml

@@ -0,0 +1,16 @@
+---
+gem: paranoid2
+cve: 2019-13589
+ghsa: 4g4c-8gqh-m4vm
+url: https://github.com/rubygems/rubygems.org/issues/2051
+date: 2019-07-16
+title: Code backdoor in paranoid2
+description: |
+  The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included
+  a code-execution backdoor inserted by a third party.
+
+  The current version, without this backdoor, is 1.1.5.
+cvss_v3: 9.8
+unaffected_versions:
+  - "> 1.1.6"
+  - "< 1.1.6"

data/data/ruby-advisory-db/gems/paratrooper-newrelic/CVE-2014-1234.yml

@@ -0,0 +1,13 @@
+---
+gem: paratrooper-newrelic
+cve: 2014-1234
+osvdb: 101839
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-1234
+title: Paratrooper-newrelic Gem for Ruby Process Listing API Key Local Disclosure
+date: 2014-01-08
+description: |
+  Paratrooper-newrelic Gem for Ruby contains a flaw in
+  /lib/paratrooper-newrelic.rb. The issue is triggered when the script exposes
+  the API key, allowing a local attacker to gain access to it by monitoring the
+  process tree.
+cvss_v2: 2.1

data/data/ruby-advisory-db/gems/paratrooper-pingdom/CVE-2014-1233.yml

@@ -0,0 +1,13 @@
+---
+gem: paratrooper-pingdom
+cve: 2014-1233
+osvdb: 101847
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-1233
+title: paratrooper-pingdom Gem for Ruby /lib/paratrooper-pingdom.rb API Login Credentials Local Disclosure
+date: 2013-12-26
+description: |
+  paratrooper-pingdom Gem for Ruby contains a flaw in
+  /lib/paratrooper-pingdom.rb. The issue is triggered when the script exposes
+  API login credentials, allowing a local attacker to gain access to the API
+  key, username, and password for the API login by monitoring the process tree.
+cvss_v2: 2.1

data/data/ruby-advisory-db/gems/passenger/CVE-2013-2119.yml

@@ -0,0 +1,15 @@
+---
+gem: passenger
+cve: 2013-2119
+osvdb: 93752
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-2119
+title: Phusion Passenger Gem for Ruby Predictable Temporary Filename Generation Symlink Local Privilege Escalation
+date: 2013-05-29
+description: Phusion Passenger Gem for Ruby contains a flaw as the program creates
+  temporary files insecurely. It is possible for a local attacker to use a symlink
+  attack against the Nginx config file to cause the program to unexpectedly overwrite
+  the file, allowing a local attacker to execute code with elevated privileges.
+cvss_v2: 4.6
+patched_versions:
+  - "~> 3.0.21"
+  - ">= 4.0.5"

data/data/ruby-advisory-db/gems/passenger/CVE-2013-4136.yml

@@ -0,0 +1,14 @@
+---
+gem: passenger
+cve: 2013-4136
+osvdb: 94074
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-4136
+title: Phusion Passenger Gem for Ruby Utils.cpp Temporary Directory Creation Symlink Local Privilege Escalation
+date: 2013-06-10
+description: Phusion Passenger Gem for Ruby contains a flaw as the program creates
+  temporary directories insecurely. It is possible for a local attacker to use a
+  symlink attack against the Utils.cpp file to allow the attacker to gain elevated
+  privileges.
+cvss_v2: 4.6
+patched_versions:
+  - ">= 4.0.8"

data/data/ruby-advisory-db/gems/passenger/CVE-2014-1831.yml

@@ -0,0 +1,13 @@
+---
+gem: passenger
+cve: 2014-1831
+osvdb: 102613
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-1831
+title: Phusion Passenger Server Instance Directory Creation Local Symlink File Overwrite
+date: 2014-01-28
+description: Phusion Passenger contains a flaw as the program creates the server instance
+  directory insecurely. It is possible for a local attacker to use a symlink attack against
+  the directory to cause the program to unexpectedly overwrite an arbitrary file.
+cvss_v2: 2.1
+patched_versions:
+  - ">= 4.0.37"

data/data/ruby-advisory-db/gems/passenger/CVE-2014-1832.yml

@@ -0,0 +1,13 @@
+---
+gem: passenger
+cve: 2014-1832
+osvdb: 102613
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-1832
+title: Phusion Passenger Server Instance Directory Creation Local Symlink File Overwrite
+date: 2014-01-29
+description: Phusion Passenger contains a flaw as the program creates the server instance
+  directory insecurely. It is possible for a local attacker to use a symlink attack against
+  the directory to cause the program to unexpectedly overwrite an arbitrary file.
+cvss_v2: 2.1
+patched_versions:
+  - ">= 4.0.38"

data/data/ruby-advisory-db/gems/passenger/CVE-2015-7519.yml

@@ -0,0 +1,17 @@
+---
+gem: passenger
+cve: 2015-7519
+url: https://blog.phusion.nl/2015/12/07/cve-2015-7519/
+title: Phusion Passenger Server allows to overwrite headers in some cases
+date: 2015-11-23
+description: It is possible in some cases, for clients to overwrite headers
+  set by the server, resulting in a medium level security issue.
+  Passenger 5 uses an SCGI-inspired format to pass headers to Ruby/Python
+  applications, while Passenger 4 uses an SCGI-inspired format to pass
+  headers to all applications. This implies a conversion to
+  UPPER_CASE_WITH_UNDERSCORES whereby the difference between characters
+  like '-' and '_' is lost.
+
+patched_versions:
+  - "~> 4.0.60"
+  - ">= 5.0.22"

data/data/ruby-advisory-db/gems/passenger/CVE-2016-10345.yml

@@ -0,0 +1,17 @@
+---
+gem: passenger
+cve: 2016-10345
+url: https://blog.phusion.nl/2017/01/10/passenger-5-1-1/
+title:  Predictable tmp File Path Vulnerability in Phusion Passenger
+date: 2016-11-09
+
+description: >-
+  In Phusion Passenger before 5.1.0, a known /tmp filename was used during
+  passenger-install-nginx-module execution, which could allow local attackers
+  to gain the privileges of the passenger user.
+
+cvss_v2: 4.6
+cvss_v3: 7.8
+
+patched_versions:
+  - ">= 5.1.0"

data/data/ruby-advisory-db/gems/passenger/OSVDB-90738.yml

@@ -0,0 +1,16 @@
+---
+gem: passenger
+cve: 2012-6135
+osvdb: 90738
+url: http://old.blog.phusion.nl/2013/03/05/phusion-passenger-4-0-beta-1-and-2-arbitrary-file-deletion-vulnerability/
+title: Phusion Passenger Gem for Ruby Arbitrary File Deletion
+date: 2012-02-01
+description: Phusion Passenger Gem for Ruby contains a flaw that is triggered
+  during application startup. This issue may allow a local attacker to delete
+  arbitrary files via an application process. If the program has completed the
+  start up process this vulnerability is no longer exploitable.
+cvss_v2: 2.1
+patched_versions:
+  - ">= 4.0.0"
+unaffected_versions:
+  - "< 4.0.0"

data/data/ruby-advisory-db/gems/pdfkit/{OSVDB-90867.yml → CVE-2013-1607.yml}

@@ -2,7 +2,7 @@
 gem: pdfkit
 cve: 2013-1607
 osvdb: 90867
-url: http://osvdb.org/show/osvdb/90867
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1607
 title: PDFKit Gem for Ruby PDF File Generation Parameter Handling Remote Code Execution
 date: 2013-02-21
 description: PDFKit Gem for Ruby contains a flaw that is due to the program failing to properly validate input during the handling of parameters when generating PDF files. This may allow a remote attacker to potentially execute arbitrary code via the pdfkit generation options.

data/data/ruby-advisory-db/gems/point-cli/CVE-2014-4997.yml

@@ -0,0 +1,8 @@
+---
+gem: point-cli
+cve: 2014-4997
+osvdb: 108577
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-4997
+title: point-cli Gem for Ruby /lib/commands/setup.rb Process Table Local Plaintext Credential Disclosure
+date: 2014-06-30
+description: point-cli Gem for Ruby contains a flaw in /lib/commands/setup.rb that is due to the application exposing credential information in plaintext in the process table. This may allow a local attacker to gain access to credential information.

data/data/ruby-advisory-db/gems/private_address_check/CVE-2017-0904.yml

@@ -0,0 +1,17 @@
+---
+gem: private_address_check
+cve: 2017-0904
+url: https://github.com/jtdowney/private_address_check/issues/1
+title: private_address_check Ruby Gem Resolv.getaddresses Server-Side Request Forgery
+date: 2017-11-07
+description: |
+  The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's
+  Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security
+  measures, such as when used to blacklist private network addresses to prevent server-side
+  request forgery.
+
+cvss_v2: 6.8
+cvss_v3: 8.1
+
+patched_versions:
+  - ">= 0.4.0"

data/data/ruby-advisory-db/gems/private_address_check/CVE-2017-0909.yml

@@ -0,0 +1,15 @@
+---
+gem: private_address_check
+cve: 2017-0909
+url: https://github.com/jtdowney/private_address_check/pull/3
+title: private_address_check Ruby Gem Blacklist Bypass privilege escalation
+date: 2017-11-09
+description: |
+  The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete
+  blacklist of common private/local network addresses used to prevent server-side request forgery.
+
+cvss_v2: 7.5
+cvss_v3: 9.8
+
+patched_versions:
+  - ">= 0.4.1"

data/data/ruby-advisory-db/gems/private_address_check/CVE-2018-3759.yml

@@ -0,0 +1,14 @@
+---
+gem: private_address_check
+cve: 2018-3759
+url: https://github.com/jtdowney/private_address_check/commit/4068228187db87fea7577f7020099399772bb147
+title: private_address_check Ruby Gem Time-of-check Time-of-use race condition
+date: 2018-05-03
+description: |
+  private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU)
+  race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0
+  can trigger this case where the initial resolution is a public address by the subsequent
+  resolution is a private address.
+
+patched_versions:
+  - ">= 0.5.0"

data/data/ruby-advisory-db/gems/puma/CVE-2019-16770.yml

@@ -0,0 +1,21 @@
+---
+gem: puma
+cve: 2019-16770
+ghsa: 7xx3-m584-x994
+url: https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994
+date: 2019-12-05
+title: Keepalive thread overload/DoS in puma
+description: |
+  A poorly-behaved client could use keepalive requests to monopolize
+  Puma's reactor and create a denial of service attack.
+
+  If more keepalive connections to Puma are opened than there are
+  threads available, additional connections will wait permanently if
+  the attacker sends requests frequently enough.
+
+cvss_v3: 8.8
+cvss_v2: 6.8
+
+patched_versions:
+  - "~> 3.12.2"
+  - ">= 4.3.1"

data/data/ruby-advisory-db/gems/puma/CVE-2020-11076.yml

@@ -0,0 +1,22 @@
+---
+gem: puma
+cve: 2020-11076
+ghsa: x7jg-6pwg-fx5h
+url: https://github.com/puma/puma/security/advisories/GHSA-x7jg-6pwg-fx5h
+date: 2020-05-22
+title: HTTP Smuggling via Transfer-Encoding Header in Puma
+description: |-
+  ### Impact
+
+  By using an invalid transfer-encoding header, an attacker could
+  [smuggle an HTTP response.](https://portswigger.net/web-security/request-smuggling)
+
+  ### Patches
+
+  The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.
+
+cvss_v3: 7.5
+
+patched_versions:
+  - "~> 3.12.5"
+  - ">= 4.3.4"

data/data/ruby-advisory-db/gems/puma/CVE-2020-11077.yml

@@ -0,0 +1,31 @@
+---
+gem: puma
+cve: 2020-11077
+ghsa: w64w-qqph-5gxm
+url: https://github.com/puma/puma/security/advisories/GHSA-w64w-qqph-5gxm
+date: 2020-05-22
+title: HTTP Smuggling via Transfer-Encoding Header in Puma
+description: |-
+  ### Impact
+
+  This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4.
+
+  A client could smuggle a request through a proxy, causing the proxy to send a response
+  back to another unknown client.
+
+  If the proxy uses persistent connections and the client adds another request in via HTTP
+  pipelining, the proxy may mistake it as the first request's body. Puma, however,
+  would see it as two requests, and when processing the second request, send back
+  a response that the proxy does not expect. If the proxy has reused the persistent
+  connection to Puma to send another request for a different client, the second response
+  from the first client will be sent to the second client.
+
+  ### Patches
+
+  The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.
+
+cvss_v3: 6.8
+
+patched_versions:
+- "~> 3.12.6"
+- ">= 4.3.5"