bundler-audit 0.4.0 → 0.7.0.1

data/data/ruby-advisory-db/README.md

@@ -1,82 +1,133 @@
 # Ruby Advisory Database
 
-The Ruby Advisory Database aims to compile all advisories that are relevant to Ruby libraries.
+The Ruby Advisory Database is a community effort to compile all security advisories that are relevant to Ruby libraries.
 
-## Goals
+You can check your own Gemfile.locks against this database by using [bundler-audit](https://github.com/rubysec/bundler-audit).
 
-1. Provide advisory **metadata** in a **simple** yet **structured** [YAML]
-   schema for automated tools to consume.
-2. Avoid reinventing [CVE]s.
-3. Avoid duplicating the efforts of the [OSVDB].
+## Support Ruby security!
+
+Do you know about a vulnerability that isn't listed in this database? Open an issue, submit a PR, or [use this form](https://rubysec.com/advisories/new) which will email the maintainers.
 
 ## Directory Structure
 
 The database is a list of directories that match the names of Ruby libraries on
 [rubygems.org]. Within each directory are one or more advisory files
-for the Ruby library. These advisory files are typically named using
-the advisories [OSVDB] identifier number.
+for the Ruby library. These advisory files are named using
+the advisories' [CVE] identifier number.
 
     gems/:
       actionpack/:
-        OSVDB-79727.yml  OSVDB-84513.yml  OSVDB-89026.yml  OSVDB-91454.yml
-        OSVDB-84243.yml  OSVDB-84515.yml  OSVDB-91452.yml
+        CVE-2014-0130.yml  CVE-2014-7818.yml  CVE-2014-7829.yml  CVE-2015-7576.yml
+        CVE-2015-7581.yml  CVE-2016-0751.yml  CVE-2016-0752.yml
 
 ## Format
 
 Each advisory file contains the advisory information in [YAML] format:
 
     ---
-    gem: actionpack
-    framework: rails
+    gem: examplegem
     cve: 2013-0156
-    osvdb: 89026
-    url: http://osvdb.org/show/osvdb/89026
+    date: 2013-05-01
+    url: https://github.com/rubysec/ruby-advisory-db/issues/123456
     title: |
       Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing
-      Remote Code Execution 
-    
+      Remote Code Execution
+
     description: |
       Ruby on Rails contains a flaw in params_parser.rb of the Action Pack.
       The issue is triggered when a type casting error occurs during the parsing
       of parameters. This may allow a remote attacker to potentially execute
       arbitrary code.
-    
+
     cvss_v2: 10.0
-    
+    cvss_v3: 9.8
+
     patched_versions:
       - ~> 2.3.15
       - ~> 3.0.19
       - ~> 3.1.10
       - ">= 3.2.11"
+    unaffected_versions:
+      - ~> 2.4.3
+
+    related:
+      cve:
+        - 2013-1234567
+        - 2013-1234568
+      url:
+        - https://github.com/rubysec/ruby-advisory-db/issues/123457
+
 
 ### Schema
 
-* `gem` \[String\]: Name of the affected gem.
-* `framework` \[String\] (optional): Name of framework gem belongs to.
-* `platform` \[String\] (optional): If this vulnerability is platform-specific, name of platform this vulnerability affects (e.g. JRuby)
-* `cve` \[String\]: CVE id.
-* `osvdb` \[Fixnum\]: OSVDB id.
-* `url` \[String\]: The URL to the full advisory.
-* `title` \[String\]: The title of the advisory.
-* `date` \[Date\]: Disclosure date of the advisory.
-* `description` \[String\]: Multi-paragraph description of the vulnerability.
-* `cvss_v2` \[Float\]: The [CVSSv2] score for the vulnerability.
+* `gem` \[String\] (required): Name of the affected gem.
+* `framework` \[String\] (optional): Name of the framework which the affected
+  gem belongs to.
+* `platform` \[String\] (optional): If this vulnerability is platform-specific, name of platform this vulnerability affects (e.g. jruby)
+* `cve` \[String\] (optional): Common Vulnerabilities and Exposures (CVE) ID.
+* `osvdb` \[Integer\] (optional): Open Sourced Vulnerability Database (OSVDB) ID.
+* `ghsa` \[String\] (optional): GitHub Security Advisory (GHSA) ID.
+* `url` \[String\] (required): The URL to the full advisory.
+* `title` \[String\] (required): The title of the advisory or individual vulnerability.
+* `date` \[Date\] (required): The public disclosure date of the advisory.
+* `description` \[String\] (required): One or more paragraphs describing the vulnerability.
+* `cvss_v2` \[Float\] (optional): The [CVSSv2] score for the vulnerability.
+* `cvss_v3` \[Float\] (optional): The [CVSSv3] score for the vulnerability.
 * `unaffected_versions` \[Array\<String\>\] (optional): The version requirements for the
   unaffected versions of the Ruby library.
-* `patched_versions` \[Array\<String\>\]: The version requirements for the
+* `patched_versions` \[Array\<String\>\] (optional): The version requirements for the
   patched versions of the Ruby library.
+* `related` \[Hash\<Array\<String\>\>\] (optional): Sometimes an advisory references many urls and other identifiers. Supported keys: `cve`, `ghsa`, `osvdb`, and `url`
+
+### Tests
+Prior to submitting a pull request, run the tests:
+
+```
+bundle install
+bundle exec rspec
+```
+
+### GitHub Advisory Sync
+
+There is a script that will create initial yaml files for RubyGem advisories which
+are in the [GitHub Security Advisory API](https://developer.github.com/v4/object/securityadvisory/),
+but are not already in this dataset.  This script can be periodically run to ensure
+this repo has all the data that is present in the GitHub Advisory data.
+
+The GitHub Advisory API requires a token to access it.
+- It can be a completely scopeless token (recommended); it does not require any permissions at all.
+- Get yours at https://github.com/settings/tokens
+
+To run the GitHub Advisory sync, start by executing the rake task:
+```
+GH_API_TOKEN=<your GitHub API Token> bundle exec rake sync_github_advisories
+```
+
+- The rake task will write yaml files for any missing advisories.
+- Those files must be further edited.
+  - Fill in `cvss_v3` field by following the CVE link and getting it from page
+  - Fill in `patched_versions` field, using the comments at the bottom of the file
+  - Fill in `unaffected_versions`, optional, if there are unaffected_versions
+  - delete the GitHub data at the bottom of the yaml file
+  - double check all the data, commit it, and make a PR
+    - *The GitHub Advisory data is structured opposite of RubySec unfortunately:
+       GitHub identifies version range which are vulnerable; RubySec identifies
+      version ranges which are not vulnerable.  This is why some manual
+      work to translate is needed.*
+
 
 ## Credits
 
 Please see [CONTRIBUTORS.md].
 
-This database also includes data from the [Open Source Vulnerability Database][OSVDB]
+This database also includes data from the [Open Sourced Vulnerability Database][OSVDB]
 developed by the Open Security Foundation (OSF) and its contributors.
 
 [rubygems.org]: https://rubygems.org/
-[CVE]: http://cve.mitre.org/
-[OSVDB]: http://www.osvdb.org/
-[CVSSv2]: http://www.first.org/cvss/cvss-guide.html
+[CVE]: https://cve.mitre.org/
 [OSVDB]: http://www.osvdb.org/
+[GHSA]: https://help.github.com/en/articles/about-maintainer-security-advisories
+[CVSSv2]: https://www.first.org/cvss/v2/guide
+[CVSSv3]: https://www.first.org/cvss/user-guide
 [YAML]: http://www.yaml.org/
 [CONTRIBUTORS.md]: https://github.com/rubysec/ruby-advisory-db/blob/master/CONTRIBUTORS.md

data/data/ruby-advisory-db/Rakefile

@@ -2,7 +2,6 @@ require 'yaml'
 
 namespace :lint do
   begin
-    gem 'rspec', '~> 2.4'
     require 'rspec/core/rake_task'
 
     RSpec::Core::RakeTask.new(:yaml)
@@ -11,17 +10,13 @@ namespace :lint do
       abort "Please run `gem install rspec` to install RSpec."
     end
   end
+end
 
-  task :cve do
-    Dir.glob('gems/*/*.yml') do |path|
-      advisory = YAML.load_file(path)
-
-      unless advisory['cve']
-        puts "Missing CVE: #{path}"
-      end
-    end
-  end
+desc "Sync GitHub RubyGem Advisories into this project"
+task :sync_github_advisories do
+  require_relative "lib/github_advisory_sync"
+  GitHub::GitHubAdvisorySync.sync
 end
 
-task :lint    => ['lint:yaml', 'lint:cve']
+task :lint    => ['lint:yaml']
 task :default => :lint

data/data/ruby-advisory-db/gems/{arabic-prawn/OSVDB-104365.yml → Arabic-Prawn/CVE-2014-2322.yml}

@@ -1,15 +1,12 @@
 ---
 gem: Arabic-Prawn
+cve: 2014-2322
 osvdb: 104365
-url: http://osvdb.org/show/osvdb/104365
-title: Arabic-Prawn Gem for Ruby contains a flaw
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-2322
+title: Arabic Prawn Gem for Ruby lib/string_utf_support.rb User Input Handling Remote Command Injection
 date: 2014-03-10
-
 description: |
   Arabic Prawn Gem for Ruby contains a flaw in the lib/string_utf_support.rb
   file. The issue is due to the program failing to sanitize user input. This may
   allow a remote attacker to inject arbitrary commands.
-
-cvss_v2:
-
-patched_versions:
+cvss_v2: 7.5

data/data/ruby-advisory-db/gems/RedCloth/CVE-2012-6684.yml

@@ -0,0 +1,21 @@
+---
+gem: RedCloth
+cve: 2012-6684
+osvdb: 115941
+url: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6684
+title: RedCloth Gem for Ruby Textile Link Parsing XSS
+date: 2012-02-29
+description: |
+  RedCloth Gem for Ruby contains a flaw that allows a cross-site scripting (XSS)
+  attack. This flaw exists because the program does not validate input when
+  parsing textile links before returning it to users. This may allow a remote
+  attacker to create a specially crafted request that would execute arbitrary
+  script code in a user's browser session within the trust relationship between
+  their browser and the server.
+cvss_v2: 4.3
+patched_versions:
+  - ">= 4.3.0"
+related:
+  url:
+    - https://github.com/jgarber/redcloth/commit/2f6dab4d6aea5cee778d2f37a135637fe3f1573c
+    - http://co3k.org/blog/redcloth-unfixed-xss-en

data/data/ruby-advisory-db/gems/VladTheEnterprising/CVE-2014-4995.yml

@@ -0,0 +1,13 @@
+---
+gem: VladTheEnterprising
+cve: 2014-4995
+osvdb: 108728
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-4995
+title: VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} Symlink Multiple Impact
+date: 2014-06-30
+description: |
+  VladTheEnterprising Gem for Ruby contains a flaw as the program creates
+  temporary files insecurely. It is possible for a local attacker to use
+  a symlink attack against the /tmp/my.cnf.#{target_host} file they can
+  overwrite arbitrary files, gain access to the MySQL root password,
+  or inject arbitrary commands.

data/data/ruby-advisory-db/gems/VladTheEnterprising/CVE-2014-4996.yml

@@ -0,0 +1,13 @@
+---
+gem: VladTheEnterprising
+cve: 2014-4996
+osvdb: 108728
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-4996
+title: VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} Symlink Multiple Impact 
+date: 2014-06-30
+description: |
+  VladTheEnterprising Gem for Ruby contains a flaw as the program creates
+  temporary files insecurely. It is possible for a local attacker to use
+  a symlink attack against the /tmp/my.cnf.#{target_host} file they can
+  overwrite arbitrary files, gain access to the MySQL root password,
+  or inject arbitrary commands.

data/data/ruby-advisory-db/gems/actionmailer/{OSVDB-98629.yml → CVE-2013-4389.yml}

@@ -2,7 +2,7 @@
 gem: actionmailer
 cve: 2013-4389
 osvdb: 98629
-url: http://www.osvdb.org/show/osvdb/98629
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-4389
 title: Action Mailer Gem for Ruby contains a possible DoS Vulnerability
 date: 2013-10-16
 description: Action Mailer Gem for Ruby contains a format string flaw in

data/data/ruby-advisory-db/gems/actionpack-page_caching/CVE-2020-8159.yml

@@ -0,0 +1,40 @@
+---
+gem: actionpack-page_caching
+cve: 2020-8159
+url: https://groups.google.com/forum/#!topic/rubyonrails-security/CFRVkEytdP8
+date: 2020-05-06
+title: Arbitrary file write/potential remote code execution in actionpack-page_caching
+description: |
+  There is a vulnerability in the actionpack-page_caching gem that allows an attacker
+  to write arbitrary files to a web server, potentially resulting in remote code execution
+  if the attacker can write unescaped ERB to a view.
+
+  Versions Affected:  All versions of actionpack-page_caching (part of Rails prior to Rails 4.0)
+  Not affected:       Applications not using actionpack-page_caching
+  Fixed Versions:     actionpack-page_caching >= 1.2.1
+
+  Impact
+  ------
+
+  The Action Pack Page Caching gem writes cache files to the file system in
+  order for the front end webserver (nginx, Apache, etc) to serve the cached
+  file without making a request to the application server.  Paths contain what
+  is effectively user input can be used to manipulate the location of the cache
+  file.
+
+  For example "/users/123" could be changed to "/users/../../../foo" and this
+  will escape the cache directory.  Attackers can use this technique to
+  springboard to an RCE if they can write arbitrary ERb to a view folder.
+
+  Impacted code looks like this:
+
+  ```
+  class BooksController < ApplicationController
+    caches_page :show
+  end
+  ```
+
+  Where the `show` action of the `BooksController` may be vulnerable.
+
+patched_versions:
+  - ">= 1.2.1"

data/data/ruby-advisory-db/gems/actionpack/{OSVDB-79727.yml → CVE-2012-1099.yml}

@@ -3,7 +3,7 @@ gem: actionpack
 framework: rails
 cve: 2012-1099
 osvdb: 79727
-url: http://www.osvdb.org/show/osvdb/79727
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-1099
 title:
   Ruby on Rails actionpack/lib/action_view/helpers/form_options_helper.rb
   Manually Generated Select Tag Options XSS

data/data/ruby-advisory-db/gems/actionpack/{OSVDB-84243.yml → CVE-2012-3424.yml}

@@ -1,10 +1,10 @@
---- 
+---
 gem: actionpack
 framework: rails
 cve: 2012-3424
 osvdb: 84243
-url: http://www.osvdb.org/show/osvdb/84243
-title: 
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-3424
+title:
   Ruby on Rails actionpack/lib/action_controller/metal/http_authentication.rb
   with_http_digest Helper Method Remote DoS
 date: 2012-07-26
@@ -16,12 +16,12 @@ description: |
   with_http_digest helper method is being used. This may allow a remote
   attacker to cause a loss of availability for the program.
 
-cvss_v2: 4.3
+cvss_v2: 5.0
 
 unaffected_versions:
   - ">= 2.3.5, <= 2.3.14"
 
-patched_versions: 
+patched_versions:
   - ~> 3.0.16
   - ~> 3.1.7
   - ">= 3.2.7"

data/data/ruby-advisory-db/gems/actionpack/{OSVDB-84515.yml → CVE-2012-3463.yml}

@@ -3,7 +3,7 @@ gem: actionpack
 framework: rails
 cve: 2012-3463
 osvdb: 84515
-url: http://osvdb.org/84515
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-3463
 title: Ruby on Rails select_tag Helper Method prompt Value XSS
 date: 2012-08-09
 

data/data/ruby-advisory-db/gems/actionpack/{OSVDB-84513.yml → CVE-2012-3465.yml}

@@ -3,7 +3,7 @@ gem: actionpack
 framework: rails
 cve: 2012-3465
 osvdb: 84513
-url: http://www.osvdb.org/show/osvdb/84513
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-3465
 title: Ruby on Rails strip_tags Helper Method XSS
 date: 2012-08-09
 

data/data/ruby-advisory-db/gems/actionpack/{OSVDB-89026.yml → CVE-2013-0156.yml}

@@ -3,7 +3,7 @@ gem: actionpack
 framework: rails
 cve: 2013-0156
 osvdb: 89026
-url: http://osvdb.org/show/osvdb/89026
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0156
 title:
   Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing
   Remote Code Execution 

data/data/ruby-advisory-db/gems/actionpack/{OSVDB-91452.yml → CVE-2013-1855.yml}

@@ -1,20 +1,20 @@
---- 
+---
 gem: actionpack
 framework: rails
 cve: 2013-1855
 osvdb: 91452
-url: http://www.osvdb.org/show/osvdb/91452
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1855
 title: XSS vulnerability in sanitize_css in Action Pack
 date: 2013-03-19
 
-description: | 
+description: |
   There is an XSS vulnerability in the `sanitize_css` method in Action
   Pack. Carefully crafted text can bypass the sanitization provided in
   the `sanitize_css` method in Action Pack
 
-cvss_v2: 4.0
+cvss_v2: 4.3
 
-patched_versions: 
+patched_versions:
   - ~> 2.3.18
   - ~> 3.1.12
   - ">= 3.2.13"

data/data/ruby-advisory-db/gems/actionpack/{OSVDB-91454.yml → CVE-2013-1857.yml}

@@ -1,13 +1,13 @@
---- 
+---
 gem: actionpack
 framework: rails
 cve: 2013-1857
 osvdb: 91454
-url: http://osvdb.org/show/osvdb/91454
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1857
 title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails
 date: 2013-03-19
 
-description: | 
+description: |
   The sanitize helper in Ruby on Rails is designed to
   filter HTML and remove all tags and attributes which could be
   malicious. The code which ensured that URLs only contain supported
@@ -15,9 +15,9 @@ description: |
   embed a tag containing a URL which executes arbitrary javascript
   code.
 
-cvss_v2: 4.0
+cvss_v2: 4.3
 
-patched_versions: 
+patched_versions:
   - ~> 2.3.18
   - ~> 3.1.12
   - ">= 3.2.13"

data/data/ruby-advisory-db/gems/actionpack/{OSVDB-103439.yml → CVE-2014-0081.yml}

@@ -3,7 +3,7 @@ gem: actionpack
 framework: rails
 cve: 2014-0081
 osvdb: 103439
-url: http://osvdb.org/show/osvdb/103439
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-0081
 title: XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human
 date: 2014-02-18
 
@@ -16,7 +16,7 @@ description: |
   script code in a user's browser session within the trust relationship between
   their browser and the server.
 
-cvss_v2: 
+cvss_v2: 4.3
 
 patched_versions:
   - ~> 3.2.17