bundler-audit 0.4.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2012-2125.yml

@@ -0,0 +1,17 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2012-2125
+osvdb: 85809
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-2125
+title: |
+  RubyGems HTTPS to HTTP Redirection MitM Downloaded Installation File
+  Manipulation
+date: 2012-09-25
+description: |
+  RubyGems contains a flaw that is triggered by the gem fetcher allowing for
+  redirection of HTTPS to HTTP. This may allow a remote attacker to conduct a
+  man-in-the-middle attack to alter downloaded gem installation files.
+cvss_v2: 5.8
+patched_versions:
+  - ">= 1.8.23"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2012-2126.yml

@@ -0,0 +1,15 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2012-2126
+osvdb: 81444
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-2126
+title: RubyGems SSL Certificate Validation MitM Spoofing Weakness
+date: 2012-04-20
+description: |
+  RubyGems contains a flaw related to the validation of SSL certificates when
+  accessing certain services and APIs. This may allow a man-in-the-middle
+  attacker to spoof a valid server.
+cvss_v2: 4.3
+patched_versions:
+  - ">= 1.8.23"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2013-4287.yml

@@ -0,0 +1,20 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2013-4287
+osvdb: 97163
+url: http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html
+title: RubyGems Multiple API Call Version Validation CPU Consumption DoS
+date: 2013-09-09
+description: |
+  RubyGems contains a flaw that may allow a denial of service. The issue is
+  triggered when handling the gem build, Gem::Package, or Gem::PackageTask API
+  calls, which attempt to validate the version of the program. This may allow a
+  context-dependent attacker to cause a consumption of CPU resources and crash
+  the program.
+cvss_v2: 4.3
+patched_versions:
+  - ~> 1.8.23.1
+  - ~> 1.8.26
+  - ~> 2.0.8
+  - ">= 2.1.0"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2013-4363.yml

@@ -0,0 +1,21 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2013-4363
+osvdb: 97163
+url: http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html
+title: RubyGems Multiple API Call Version Validation CPU Consumption DoS
+date: 2013-09-24
+description: |
+  RubyGems contains a flaw that may allow a denial of service. The issue is
+  triggered when handling the gem build, Gem::Package, or Gem::PackageTask API
+  calls, which attempt to validate the version of the program. This may allow a
+  context-dependent attacker to cause a consumption of CPU resources and crash
+  the program. This vulnerability is due to an incomplete fix for
+  CVE-2013-4287, which allowed a denial of service via improper validation.
+cvss_v2: 4.3
+patched_versions:
+  - ~> 1.8.23.2
+  - ~> 1.8.27
+  - ~> 2.0.10
+  - ">= 2.1.5"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2015-3900.yml

@@ -0,0 +1,20 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2015-3900
+osvdb: 122162
+url: https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007/?fid=6356
+title: |
+  RubyGems remote_fetcher.rb api_endpoint() Function Missing SRV Record
+  Hostname Validation Request Hijacking
+date: 2015-05-14
+description: |
+  RubyGems contains a flaw in the api_endpoint() function in remote_fetcher.rb
+  that is triggered when handling hostnames in SRV records. With a specially
+  crafted response, a context-dependent attacker may conduct DNS hijacking
+  attacks.
+cvss_v2: 5.0
+patched_versions:
+  - ~> 2.0.16
+  - ~> 2.2.4
+  - ">= 2.4.7"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2015-4020.yml

@@ -0,0 +1,20 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2015-4020
+url: https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478
+title: |
+  RubyGems remote_fetcher.rb api_endpoint() Function Missing SRV Record
+  Hostname Validation Request Hijacking
+date: 2015-06-08
+description: |
+  RubyGems contains a flaw in the api_endpoint() function in remote_fetcher.rb
+  that is triggered when handling hostnames in SRV records. With a specially
+  crafted response, a context-dependent attacker may conduct DNS hijacking
+  attacks. This vulnerability is due to an incomplete fix for CVE-2015-3900,
+  which allowed redirection to an arbitrary gem server in any security domain. 
+cvss_v2: 5.0
+patched_versions:
+  - ~> 2.0.17
+  - ~> 2.2.5
+  - ">= 2.4.8"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0899.yml

@@ -0,0 +1,16 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2017-0899
+url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
+title: RubyGems ANSI escape sequence vulnerability
+date: 2017-08-29
+description: |
+  RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem
+  specifications that include terminal escape characters. Printing the gem
+  specification would execute terminal escape sequences.
+cvss_v2: 7.5
+patched_versions:
+  - ">= 2.4.5.3"
+  - ">= 2.5.2.1"
+  - ">= 2.6.13"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0900.yml

@@ -0,0 +1,16 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2017-0900
+url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
+title: RubyGems DoS vulnerability in the query command
+date: 2017-08-29
+description: |
+  RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem
+  specifications to cause a denial of service attack against RubyGems clients
+  who have issued a `query` command.
+cvss_v2: 5.0
+patched_versions:
+  - ">= 2.4.5.3"
+  - ">= 2.5.2.1"
+  - ">= 2.6.13"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0901.yml

@@ -0,0 +1,16 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2017-0901
+url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
+title: RubyGems vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files
+date: 2017-08-29
+description: |
+  RubyGems version 2.6.12 and earlier fails to validate specification names,
+  allowing a maliciously crafted gem to potentially overwrite any file on the
+  filesystem.
+cvss_v2: 6.4
+patched_versions:
+  - ">= 2.4.5.3"
+  - ">= 2.5.2.1"
+  - ">= 2.6.13"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0902.yml

@@ -0,0 +1,16 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2017-0902
+url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
+title: RubyGems DNS request hijacking vulnerability
+date: 2017-08-29
+description: |
+  RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking
+  vulnerability that allows a MITM attacker to force the RubyGems client to
+  down load and install gems from a server that the attacker controls.
+cvss_v2: 6.8
+patched_versions:
+  - ">= 2.4.5.3"
+  - ">= 2.5.2.1"
+  - ">= 2.6.13"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0903.yml

@@ -0,0 +1,17 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2017-0903
+url: https://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
+title: Unsafe Object Deserialization Vulnerability in RubyGems
+date: 2017-10-09
+description: |
+  There is a possible unsafe object deserialization vulnerability in RubyGems.
+  It is possible for YAML deserialization of gem specifications to bypass class
+  white lists. Specially crafted serialized objects can possibly be used to
+  escalate to remote code execution.
+cvss_v2: 7.5
+unaffected_versions:
+  - "< 2.0.0"
+patched_versions:
+  - ">= 2.6.14"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8320.yml

@@ -0,0 +1,21 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2019-8320
+url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
+title: Delete directory using symlink when decompressing tar
+date: 2019-03-05
+description: |
+  A Directory Traversal issue was discovered in RubyGems 2.7.6 and later
+  through 3.0.2. Before making new directories or touching files (which now
+  include path-checking code for symlinks), it would delete the target
+  destination. If that destination was hidden behind a symlink, a malicious gem
+  could delete arbitrary files on the user’s machine, presuming the attacker
+  could guess at paths. Given how frequently gem is run as sudo, and how
+  predictable paths are on modern systems (/tmp, /usr, etc.), this could
+  likely lead to data loss or an unusable system.
+unaffected_versions:
+  - "< 2.7.6"
+patched_versions:
+  - ">= 3.0.3"
+  - "~> 2.7.9"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8321.yml

@@ -0,0 +1,16 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2019-8321
+url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
+title: Escape sequence injection vulnerability in verbose
+date: 2019-03-05
+description: |
+  An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since
+  Gem::UserInteraction#verbose calls say without escaping, escape sequence
+  injection is possible.
+unaffected_versions:
+  - "< 2.6"
+patched_versions:
+  - ">= 3.0.3"
+  - "~> 2.7.9"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8322.yml

@@ -0,0 +1,16 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2019-8322
+url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
+title: Escape sequence injection vulnerability in gem owner
+date: 2019-03-05
+description: |
+  An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem
+  owner command outputs the contents of the API response directly to stdout.
+  Therefore, if the response is crafted, escape sequence injection may occur.
+unaffected_versions:
+  - "< 2.6"
+patched_versions:
+  - ">= 3.0.3"
+  - "~> 2.7.9"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8323.yml

@@ -0,0 +1,17 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2019-8323
+url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
+title: Escape sequence injection vulnerability in api response handling
+date: 2019-03-05
+description: |
+  An issue was discovered in RubyGems 2.6 and later through 3.0.2.
+  Gem::GemcutterUtilities#with_response may output the API response to stdout
+  as it is. Therefore, if the API side modifies the response, escape sequence
+  injection may occur.
+unaffected_versions:
+  - "< 2.6"
+patched_versions:
+  - ">= 3.0.3"
+  - "~> 2.7.9"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8324.yml

@@ -0,0 +1,18 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2019-8324
+url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
+title: Installing a malicious gem may lead to arbitrary code execution
+date: 2019-03-05
+description: |
+  An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted
+  gem with a multi-line name is not handled correctly. Therefore, an attacker
+  could inject arbitrary code to the stub line of gemspec, which is eval-ed by
+  code in ensure_loadable_spec during the preinstall check.
+
+unaffected_versions:
+  - "< 2.6"
+patched_versions:
+  - ">= 3.0.3"
+  - "~> 2.7.9"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8325.yml

@@ -0,0 +1,16 @@
+---
+gem: rubygems-update
+library: rubygems
+cve: 2019-8325
+url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
+title: Escape sequence injection vulnerability in errors
+date: 2019-03-05
+description: |
+  An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since
+  Gem::CommandManager#run calls alert_error without escaping, escape sequence
+  injection is possible. (There are many ways to cause an error.)
+unaffected_versions:
+  - "< 2.6"
+patched_versions:
+  - ">= 3.0.3"
+  - "~> 2.7.9"

data/data/ruby-advisory-db/gems/rubyzip/CVE-2017-5946.yml

@@ -0,0 +1,17 @@
+---
+gem: rubyzip
+cve: 2017-5946
+url: https://github.com/rubyzip/rubyzip/issues/315
+title: Directory traversal vulnerability in rubyzip
+date: 2017-02-27
+description: |
+  The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a
+  directory traversal vulnerability. If a site allows uploading of .zip files,
+  an attacker can upload a malicious file that uses "../" pathname substrings to
+  write arbitrary files to the filesystem.
+
+cvss_v2: 7.5
+cvss_v3: 9.8
+
+patched_versions:
+  - ">= 1.2.1"

data/data/ruby-advisory-db/gems/rubyzip/CVE-2018-1000544.yml

@@ -0,0 +1,19 @@
+---
+gem: rubyzip
+date: 2018-06-14
+url: https://github.com/rubyzip/rubyzip/issues/369
+cve: 2018-1000544
+title: Directory Traversal in rubyzip
+description: |
+  rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability
+  in Zip::File component that can result in write arbitrary files to the filesystem.
+  If a site allows uploading of .zip files, an attacker can upload a malicious file
+  which contains symlinks or files with absolute pathnames "../" to write arbitrary
+  files to the filesystem.
+patched_versions:
+  - ">= 1.2.2"
+related:
+  cve:
+    - 2017-5946
+  url:
+    - https://security-tracker.debian.org/tracker/CVE-2018-1000544

data/data/ruby-advisory-db/gems/rubyzip/CVE-2019-16892.yml

@@ -0,0 +1,13 @@
+---
+gem: rubyzip
+cve: 2019-16892
+url: https://github.com/rubyzip/rubyzip/pull/403
+date: 2019-09-12
+title: Denial of Service in rubyzip ("zip bombs")
+description: |
+  In Rubyzip before 1.3.0, a crafted ZIP file can bypass application
+  checks on ZIP entry sizes because data about the uncompressed size
+  can be spoofed. This allows attackers to cause a denial of service
+  (disk consumption).
+patched_versions:
+  - ">= 1.3.0"

data/data/ruby-advisory-db/gems/safemode/CVE-2016-3693.yml

@@ -0,0 +1,13 @@
+---
+gem: safemode
+cve: 2016-3693
+title: Safemode Gem for Ruby is vulnerable to information disclosure
+date: 2016-04-20
+url: http://seclists.org/oss-sec/2016/q2/119
+description: |
+  Safemode is initialised with an optional 'delegate' object.
+  If the delegated object is a Rails controller, 'inspect' could
+  be called which then exposes all informations about the App,
+  including routes, secret tokens, caches and so on.
+patched_versions:
+  - ">= 1.2.4"

data/data/ruby-advisory-db/gems/safemode/CVE-2017-7540.yml

@@ -0,0 +1,16 @@
+---
+gem: safemode
+cve: 2017-7540
+title: Safemode Gem for Ruby is vulnerable to bypassing safe mode limitations
+date: 2017-04-05
+url: https://nvd.nist.gov/vuln/detail/CVE-2017-7540
+description: |
+  Safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable 
+  to bypassing safe mode limitations via special Ruby syntax. This can
+  lead to deletion of objects for which the user does not have delete 
+  permissions or possibly to privilege escalation.
+patched_versions:
+  - ">= 1.3.3"
+related:
+  url:
+    - https://github.com/svenfuchs/safemode/pull/23  

data/data/ruby-advisory-db/gems/samlr/CVE-2018-20857.yml

@@ -0,0 +1,16 @@
+---
+gem: samlr
+cve: 2018-20857
+ghsa: qpxp-5j56-gg3x
+url: https://github.com/zendesk/samlr/pull/29
+date: 2019-07-31
+title: samlr XML nodes comment attack
+description: |
+  Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as
+  a name_id node with user@example.com followed by <!---->. and then the attacker's
+  domain name.
+
+cvss_v3: 7.5
+
+patched_versions:
+- ">= 2.6.2"

data/data/ruby-advisory-db/gems/sanitize/CVE-2018-3740.yml

@@ -0,0 +1,22 @@
+---
+gem: sanitize
+cve: 2018-3740
+date: 2018-03-19
+url: https://github.com/rgrove/sanitize/issues/176
+title: HTML injection/XSS in Sanitize
+description: |
+  When Sanitize gem is used in combination with libxml2 >= 2.9.2,
+  a specially crafted HTML fragment can cause libxml2 to generate
+  improperly escaped output, allowing non-whitelisted attributes to be
+  used on whitelisted elements.
+
+  This can allow HTML and JavaScript injection, which could result in XSS
+  if Sanitize's output is served to browsers.
+unaffected_versions:
+  - "< 1.1.0"
+patched_versions:
+  - "~> 2.1.1"
+  - ">= 4.6.3"
+related:
+  url:
+    - https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e