bundler-audit 0.4.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/puma/CVE-2020-5247.yml

@@ -0,0 +1,25 @@
+---
+gem: puma
+cve: 2020-5247
+ghsa: 84j7-475p-hp8v
+url: https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v
+date: 2020-02-27
+title: HTTP Response Splitting vulnerability in puma
+description: |-
+  If an application using Puma allows untrusted input in a response header,
+  an attacker can use newline characters (i.e. CR, LF) to end the header and
+  inject malicious content, such as additional headers or an entirely new
+  response body. This vulnerability is known as HTTP Response Splitting.
+
+  While not an attack in itself, response splitting is a vector for several
+  other attacks, such as cross-site scripting (XSS).
+
+cvss_v3: 6.5
+
+patched_versions:
+  - "~> 3.12.4"
+  - ">= 4.3.3"
+
+related:
+  cve:
+    - 2019-16254

data/data/ruby-advisory-db/gems/puma/CVE-2020-5249.yml

@@ -0,0 +1,36 @@
+---
+gem: puma
+cve: 2020-5249
+ghsa: 33vf-4xgg-9r58
+url: https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58
+date: 2020-03-03
+title: HTTP Response Splitting (Early Hints) in Puma
+description: |-
+  ### Impact
+  If an application using Puma allows untrusted input in an early-hints header,
+  an attacker can use a carriage return character to end the header and inject
+  malicious content, such as additional headers or an entirely new response body.
+  This vulnerability is known as [HTTP Response
+  Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)
+
+  While not an attack in itself, response splitting is a vector for several other
+  attacks, such as cross-site scripting (XSS).
+
+  This is related to [CVE-2020-5247](https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v),
+  which fixed this vulnerability but only for regular responses.
+
+  ### Patches
+  This has been fixed in 4.3.3 and 3.12.4.
+
+  ### Workarounds
+  Users can not allow untrusted/user input in the Early Hints response header.
+
+cvss_v3: 6.5
+
+patched_versions:
+  - "~> 3.12.4"
+  - ">= 4.3.3"
+
+related:
+  cve:
+    - 2020-5247

data/data/ruby-advisory-db/gems/quick_magick/OSVDB-106954.yml

@@ -0,0 +1,7 @@
+---
+gem: quick_magick
+osvdb: 106954
+url: http://osvdb.org/show/osvdb/106954
+title: quick_magick Gem for Ruby QuickMagick::Image.read Function Crafted String Handling Remote Command Injection 
+date: 2011-01-12
+description: quick_magick Gem for Ruby contains a flaw in the QuickMagick::Image.read function. The issue is triggered when handling a specially crafted string. This may allow a remote attacker to inject arbitrary commands.

data/data/ruby-advisory-db/gems/rack-attack/OSVDB-132234.yml

@@ -0,0 +1,26 @@
+---
+gem: rack-attack
+osvdb: 132234
+url: https://github.com/kickstarter/rack-attack/releases/tag/v4.3.1
+title: |
+  rack-attack Gem for Ruby missing normalization before request path
+  processing
+date: 2015-12-18
+description: |
+  When using rack-attack with a rails app, developers expect the request
+  path to be normalized. In particular, trailing slashes are stripped so
+  a request path "/login/" becomes "/login" by the time you're in
+  ActionController.
+
+  Since Rack::Attack runs before ActionDispatch, the request path is not
+  yet normalized. This can cause throttles and blacklists to not work as
+  expected.
+
+  E.g., a throttle:
+
+  `throttle('logins', ...) {|req| req.path == "/login" }`
+
+  would not match a request to '/login/', though Rails would route
+  '/login/' to the same '/login' action. 
+patched_versions:
+  - ">= 4.3.1"

data/data/ruby-advisory-db/gems/rack-cache/{OSVDB-83077.yml → CVE-2012-2671.yml}

@@ -2,7 +2,7 @@
 gem: rack-cache
 cve: 2012-2671
 osvdb: 83077
-url: http://osvdb.org/83077
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-2671
 title: rack-cache Rubygem Sensitive HTTP Header Caching Weakness
 date: 2012-06-06
 

data/data/ruby-advisory-db/gems/rack-cors/CVE-2017-11173.yml

@@ -0,0 +1,21 @@
+---
+gem: rack-cors
+cve: 2017-11173
+date: 2015-07-13
+url: https://github.com/cyu/rack-cors/issues/86
+title: rack-cors Gem Missing Anchor permits unauthorized CORS requests
+description: |
+  Missing anchor in generated regex for rack-cors before 0.4.1
+  allows a malicious third-party site to perform CORS requests.
+  If the configuration were intended to allow only the trusted
+  example.com domain name and not the malicious example.net domain name,
+  then example.com.example.net (as well as example.com-example.net) would
+  be inadvertently allowed.
+
+cvss_v2: 6.8
+patched_versions:
+  - ">= 0.4.1"
+related:
+  url:
+    - https://github.com/cyu/rack-cors/issues/86
+    - http://seclists.org/fulldisclosure/2017/Jul/22

data/data/ruby-advisory-db/gems/rack-cors/CVE-2019-18978.yml

@@ -0,0 +1,13 @@
+---
+gem: rack-cors
+cve: 2019-18978
+ghsa: pf8f-w267-mq2h
+url: https://github.com/cyu/rack-cors/commit/e4d4fc362a4315808927011cbe5afcfe5486f17d
+date: 2019-11-15
+title: rack-cors directory traversal via path
+description: |
+  An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem
+  before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources
+  because resource matching does not ensure that pathnames are in a canonical format.
+patched_versions:
+- ">= 1.0.4"

data/data/ruby-advisory-db/gems/rack-mini-profiler/CVE-2016-4442.yml

@@ -0,0 +1,17 @@
+---
+gem: rack-mini-profiler
+cve: 2016-4442
+url: https://github.com/MiniProfiler/rack-mini-profiler/commit/4273771d65f1a7411e3ef5843329308d0e2d257c
+title: rack-mini-profiler may disclose information to unauthorized users
+date: 2016-05-18
+description: >-
+  Carefully crafted requests can expose information about
+  strings and objects allocated during the request for unauthorised
+  users.
+
+patched_versions:
+  - ">= 0.10.1"
+
+related:
+  url:
+    - http://seclists.org/oss-sec/2016/q2/516

data/data/ruby-advisory-db/gems/rack-protection/CVE-2018-1000119.yml

@@ -0,0 +1,18 @@
+---
+gem: rack-protection
+cve: 2018-1000119
+url: https://github.com/sinatra/rack-protection/pull/98
+date: 2018-03-07
+title: rack-protection gem timing attack vulnerability when validating CSRF token
+description: |
+  Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains
+  a timing attack vulnerability in the CSRF token checking that can result in signatures
+  can be exposed. This attack appear to be exploitable via network connectivity to
+  the ruby application.
+
+cvss_v3: 5.9
+cvss_v2: 4.3
+
+patched_versions:
+  - ~> 1.5.5
+  - ">= 2.0.0"

data/data/ruby-advisory-db/gems/rack-protection/CVE-2018-7212.yml

@@ -0,0 +1,12 @@
+---
+gem: rack-protection
+cve: 2018-7212
+url: https://github.com/sinatra/sinatra/pull/1379
+title: Path traversal is possible via backslash characters on Windows.
+date: 2018-02-18
+description: |
+  An issue was discovered in rack-protection 2.x before 2.0.1 on Windows. Path traversal
+  is possible via backslash characters.
+patched_versions:
+  - ">= 2.0.1"
+  - "~> 1.5.4"

data/data/ruby-advisory-db/gems/rack-ssl/CVE-2014-2538.yml

@@ -0,0 +1,11 @@
+---
+gem: rack-ssl
+cve: 2014-2538
+osvdb: 104734
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-2538
+title: rack-ssl Gem for Ruby Error Message Reflected XSS 
+date: 2013-07-09
+description: rack-ssl Gem for Ruby contains a flaw that allows a reflected cross-site scripting (XSS) attack. This flaw exists because the program does not validate input passed via error messages before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
+cvss_v2: 4.3
+patched_versions:
+  - ">= 1.3.4"

data/data/ruby-advisory-db/gems/rack/CVE-2011-5036.yml

@@ -0,0 +1,21 @@
+---
+gem: rack
+cve: 2011-5036
+osvdb: 78121
+url: https://nvd.nist.gov/vuln/detail/CVE-2011-5036
+title: |
+  Rack Hash Collision Form Parameter Parsing Remote DoS
+date: 2011-12-28
+
+description: |
+  Rack contains a flaw that may allow a remote denial of service. The issue is
+  triggered when an attacker sends multiple crafted parameters which trigger
+  hash collisions, and will result in loss of availability for the program via
+  CPU consumption.
+
+cvss_v2: 5.0
+patched_versions:
+  - "~> 1.1.3"
+  - "~> 1.2.5"
+  - "~> 1.3.6"
+  - ">= 1.4.0"

data/data/ruby-advisory-db/gems/rack/CVE-2012-6109.yml

@@ -0,0 +1,21 @@
+---
+gem: rack
+cve: 2012-6109
+osvdb: 89317
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-6109
+title: |
+  Rack Regular Expressions Engine Content-Disposition Header Parsing Infinite Loop Remote DoS
+date: 2012-05-04
+
+description: |
+  Rack contains a flaw in the Regular Expressions Engine that may allow a remote
+  denial of service. The issue is triggered when parsing context-disposition
+  headers. With a specially crafted header, a remote attacker can cause an
+  infinite loop, which will result in a loss of availability for the webserver.
+
+cvss_v2: 4.3
+patched_versions:
+  - "~> 1.1.4"
+  - "~> 1.2.6"
+  - "~> 1.3.7"
+  - ">= 1.4.2"

data/data/ruby-advisory-db/gems/rack/CVE-2013-0183.yml

@@ -0,0 +1,19 @@
+---
+gem: rack
+cve: 2013-0183
+osvdb: 89320
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0183
+title: |
+  Rack Long String Parsing Memory Consumption Remote DoS
+date: 2013-01-07
+
+description: |
+  Rack contains a flaw that may allow a remote denial of service. The issue is
+  triggered when parsing an overly long string. With a specially crafted string,
+  a remote attacker can cause a consumption of memory. This will result in a
+  loss of availability for the webserver.
+
+cvss_v2: 5.0
+patched_versions:
+  - "~> 1.3.8"
+  - ">= 1.4.3"

data/data/ruby-advisory-db/gems/rack/CVE-2013-0184.yml

@@ -0,0 +1,20 @@
+---
+gem: rack
+cve: 2013-0184
+osvdb: 89327
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0184
+title: |
+  Rack Rack::Auth::AbstractRequest Class Unspecified Remote DoS
+date: 2013-01-13
+
+description: |
+  Rack contains a flaw in the Rack::Auth::AbstractRequest class that may allow
+  a remote denial of service. The issue is triggered when an unspecified error
+  occurs, which will result in a loss of availability for the webserver.
+
+cvss_v2: 4.3
+patched_versions:
+  - "~> 1.1.5"
+  - "~> 1.2.7"
+  - "~> 1.3.9"
+  - ">= 1.4.4"

data/data/ruby-advisory-db/gems/rack/CVE-2013-0262.yml

@@ -0,0 +1,18 @@
+---
+gem: rack
+cve: 2013-0262
+osvdb: 89938
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0262
+title: |
+  Rack Rack::File Function Symlink Traversal Arbitrary File Disclosure
+date: 2013-02-07
+
+description: |
+  Rack contains a flaw as the Rack::File function creates temporary files
+  insecurely. It is possible for a local attacker to use a symlink attack to
+  traverse to an arbitrary file and disclose its contents
+
+cvss_v2: 4.3
+patched_versions:
+- "~> 1.4.5"
+- ">= 1.5.2"

data/data/ruby-advisory-db/gems/rack/{OSVDB-89939.yml → CVE-2013-0263.yml}

@@ -1,11 +1,11 @@
---- 
+---
 gem: rack
 cve: 2013-0263
 osvdb: 89939
-url: http://osvdb.org/show/osvdb/89939
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0263
 title: |
-  Rack Rack::Session::Cookie Function Timing Attack Remote Code Execution 
-date: 2009-12-01
+  Rack Rack::Session::Cookie Function Timing Attack Remote Code Execution
+date: 2013-02-07
 
 description: |
   Rack contains a flaw that is due to an error in the Rack::Session::Cookie
@@ -15,9 +15,9 @@ description: |
   latencies are sufficiently low to make the attack viable.
 
 cvss_v2: 5.1
-patched_versions: 
-- ~> 1.1.6
-- ~> 1.2.8
-- ~> 1.3.10
-- ~> 1.4.5
-- ">= 1.5.2"
+patched_versions:
+  - ~> 1.1.6
+  - ~> 1.2.8
+  - ~> 1.3.10
+  - ~> 1.4.5
+  - ">= 1.5.2"

data/data/ruby-advisory-db/gems/rack/CVE-2015-3225.yml

@@ -0,0 +1,18 @@
+---
+gem: rack
+cve: 2015-3225
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/gcUbICUmKMc
+title: |
+  Potential Denial of Service Vulnerability in Rack
+date: 2015-06-16
+
+description: |
+  Carefully crafted requests can cause a `SystemStackError` and potentially 
+  cause a denial of service attack. 
+
+  All users running an affected release should upgrade. 
+
+patched_versions:
+  - ">= 1.6.2"
+  - "~> 1.5.4"
+  - "~> 1.4.6"

data/data/ruby-advisory-db/gems/rack/CVE-2018-16470.yml

@@ -0,0 +1,56 @@
+---
+gem: rack
+cve: 2018-16470
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/Dz4sRl-ktKk
+title: Possible DoS vulnerability in Rack
+date: 2018-11-05
+
+description: |
+  There is a possible DoS vulnerability in the multipart parser in Rack. This
+  vulnerability has been assigned the CVE identifier CVE-2018-16470.
+
+  Versions Affected:  2.0.4, 2.0.5
+  Not affected:       <= 2.0.3
+  Fixed Versions:     2.0.6
+
+  Impact
+  ------
+  There is a possible DoS vulnerability in the multipart parser in Rack.
+  Carefully crafted requests can cause the multipart parser to enter a
+  pathological state, causing the parser to use CPU resources disproportionate to
+  the request size.
+
+  Impacted code can look something like this:
+
+  ```
+  Rack::Request.new(env).params
+  ```
+
+  But any code that uses the multi-part parser may be vulnerable.
+
+  Rack users that have manually adjusted the buffer size in the multipart parser
+  may be vulnerable as well.
+
+  All users running an affected release should either upgrade or use one of the
+  workarounds immediately.
+
+  Releases
+  --------
+  The 2.0.6 release is available at the normal locations.
+
+  Workarounds
+  -----------
+  To work around this issue, the following code can be used:
+
+  ```
+  require "rack/multipart/parser"
+
+  Rack::Multipart::Parser.send :remove_const, :BUFSIZE
+  Rack::Multipart::Parser.const_set :BUFSIZE, 16384
+  ```
+
+unaffected_versions:
+  - "<= 2.0.3"
+
+patched_versions:
+  - ">= 2.0.6"

data/data/ruby-advisory-db/gems/rack/CVE-2018-16471.yml

@@ -0,0 +1,80 @@
+---
+gem: rack
+cve: 2018-16471
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/NAalCee8n6o
+title: Possible XSS vulnerability in Rack
+date: 2018-11-05
+
+description: |
+  There is a possible vulnerability in Rack. This vulnerability has been
+  assigned the CVE identifier CVE-2018-16471.
+
+  Versions Affected:  All.
+  Not affected:       None.
+  Fixed Versions:     2.0.6, 1.6.11
+
+  Impact
+  ------
+  There is a possible XSS vulnerability in Rack.  Carefully crafted requests can
+  impact the data returned by the `scheme` method on `Rack::Request`.
+  Applications that expect the scheme to be limited to "http" or "https" and do
+  not escape the return value could be vulnerable to an XSS attack.
+
+  Vulnerable code looks something like this:
+
+  ```
+  <%= request.scheme.html_safe %>
+  ```
+
+  Note that applications using the normal escaping mechanisms provided by Rails
+  may not impacted, but applications that bypass the escaping mechanisms, or do
+  not use them may be vulnerable.
+
+  All users running an affected release should either upgrade or use one of the
+  workarounds immediately.
+
+  Releases
+  --------
+  The 2.0.6 and 1.6.11 releases are available at the normal locations.
+
+  Workarounds
+  -----------
+  The following monkey patch can be applied to work around this issue:
+
+  ```
+  require "rack"
+  require "rack/request"
+
+  class Rack::Request
+  SCHEME_WHITELIST = %w(https http).freeze
+
+  def scheme
+    if get_header(Rack::HTTPS) == 'on'
+      'https'
+    elsif get_header(HTTP_X_FORWARDED_SSL) == 'on'
+      'https'
+    elsif forwarded_scheme
+      forwarded_scheme
+    else
+      get_header(Rack::RACK_URL_SCHEME)
+    end
+  end
+
+  def forwarded_scheme
+    scheme_headers = [
+      get_header(HTTP_X_FORWARDED_SCHEME),
+      get_header(HTTP_X_FORWARDED_PROTO).to_s.split(',')[0]
+    ]
+
+    scheme_headers.each do |header|
+      return header if SCHEME_WHITELIST.include?(header)
+    end
+
+    nil
+  end
+  end
+  ```
+
+patched_versions:
+  - "~> 1.6.11"
+  - ">= 2.0.6"