bundler-audit 0.6.1 → 0.7.0.1

data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16255.yml

@@ -0,0 +1,20 @@
+---
+engine: ruby
+cve: 2019-16255
+url: https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255/
+title: A code injection vulnerability of Shell#[] and Shell#test
+date: 2019-10-01
+description: |
+  Shell#[] and its alias Shell#test defined in lib/shell.rb allow code
+  injection if the first argument (aka the “command” argument) is untrusted
+  data. An attacker can exploit this to call an arbitrary Ruby method.
+
+  Note that passing untrusted data to methods of Shell is dangerous in general.
+  Users must never do it. However, we treat this particular case as a
+  vulnerability because the purpose of Shell#[] and Shell#[] is considered file
+  testing.
+patched_versions:
+  - "~> 2.4.8"
+  - "~> 2.5.7"
+  - "~> 2.6.5"
+  - "> 2.7.0-preview1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2020-10663.yml

@@ -0,0 +1,29 @@
+---
+engine: ruby
+cve: 2020-10663
+url: https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
+title: Unsafe Object Creation Vulnerability in JSON (Additional fix)
+date: 2020-03-19
+description: |
+  When parsing certain JSON documents, the json gem (including the one bundled
+  with Ruby) can be coerced into creating arbitrary objects in the target
+  system.
+
+  This is the same issue as CVE-2013-0269. The previous fix was incomplete, which
+  addressed `JSON.parse(user_input)`, but didn’t address some other styles of JSON
+  parsing including `JSON(user_input)` and `JSON.parse(user_input, nil)`.
+
+  See CVE-2013-0269 in detail. Note that the issue was exploitable to cause a
+  Denial of Service by creating many garbage-uncollectable Symbol objects, but
+  this kind of attack is no longer valid because Symbol objects are now
+  garbage-collectable. However, creating arbitrary objects may cause severe
+  security consequences depending upon the application code.
+
+  Please update the json gem to version 2.3.0 or later. You can use `gem update
+  json` to update it. If you are using bundler, please add `gem "json", ">= 2.3.0"`
+  to your Gemfile
+patched_versions:
+  - "~> 2.4.10"
+  - "~> 2.5.8"
+  - "~> 2.6.6"
+  - ">= 2.7.1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2020-10933.yml

@@ -0,0 +1,25 @@
+---
+engine: ruby
+cve: 2020-10933
+url: https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933/
+title: Heap exposure vulnerability in the socket library
+date: 2020-03-31
+description: |
+  A heap exposure vulnerability was discovered in the socket library. This
+  vulnerability has been assigned the CVE identifier CVE-2020-10933. We
+  strongly recommend upgrading Ruby.
+
+  When `BasicSocket#recv_nonblock` and `BasicSocket#read_nonblock` are invoked with
+  size and buffer arguments, they initially resize the buffer to the specified
+  size. In cases where the operation would block, they return without copying
+  any data. Thus, the buffer string will now include arbitrary data from the
+  heap. This may expose possibly sensitive data from the interpreter.
+
+  This issue is exploitable only on Linux. This issue had been since Ruby
+  2.5.0; 2.4 series is not vulnerable.
+patched_versions:
+  - "~> 2.5.8"
+  - "~> 2.6.6"
+  - ">= 2.7.1"
+unaffected_versions:
+  - "~> 2.4.0"

data/data/ruby-advisory-db/spec/{gems_spec.rb → advisories_spec.rb}

@@ -4,19 +4,19 @@ require 'library_example'
 require 'ruby_example'
 
 describe "gems" do
-  Dir.glob(File.join(File.dirname(__FILE__), '../gems/*/*.yml')) do |path|
+  Dir.glob(File.join(File.dirname(__FILE__), '../gems/*/*')) do |path|
     include_examples 'Gem Advisory', path
   end
 end
 
 describe "libraries" do
-  Dir.glob(File.join(File.dirname(__FILE__), '../libraries/*/*.yml')) do |path|
+  Dir.glob(File.join(File.dirname(__FILE__), '../libraries/*/*')) do |path|
     include_examples 'Libraries Advisory', path
   end
 end
 
 describe "rubies" do
-  Dir.glob(File.join(File.dirname(__FILE__), '../rubies/*/*.yml')) do |path|
+  Dir.glob(File.join(File.dirname(__FILE__), '../rubies/*/*')) do |path|
     include_examples 'Rubies Advisory', path
   end
 end

data/data/ruby-advisory-db/spec/advisory_example.rb

@@ -5,7 +5,7 @@ shared_examples_for 'Advisory' do |path|
   advisory = YAML.load_file(path)
 
   describe path do
-    let(:filename) { File.basename(path).chomp('.yml') }
+    let(:filename) { File.basename(path) }
 
     let(:filename_cve) do
       if filename.start_with?('CVE-')
@@ -18,13 +18,20 @@ shared_examples_for 'Advisory' do |path|
         filename.gsub('OSVDB-','')
       end
     end
+    
+    let(:filename_ghsa) do
+      if filename.start_with?('GHSA-')
+        filename.gsub('GHSA-','')
+      end
+    end
 
-    it "should be correctly named CVE-XXX or OSVDB-XXX" do
-      expect(filename).to match(/^(CVE-\d{4}-(0\d{3}|[1-9]\d{3,})|OSVDB-\d+)$/)
+    it "should be correctly named CVE-XXX or OSVDB-XXX or GHSA-XXX" do
+      expect(filename).
+        to match(/^(CVE-\d{4}-(0\d{3}|[1-9]\d{3,})|OSVDB-\d+|GHSA(-[a-z0-9]{4}){3})\.yml$/)
     end
 
-    it "should have CVE or OSVDB" do
-      expect(advisory['cve'] || advisory['osvdb']).not_to be_nil
+    it "should have CVE or OSVDB or GHSA" do
+      expect(advisory['cve'] || advisory['osvdb'] || advisory['ghsa']).not_to be_nil
     end
 
     describe "framework" do
@@ -51,7 +58,7 @@ shared_examples_for 'Advisory' do |path|
       end
       it "should be id in filename if filename is CVE-XXX" do
         if filename_cve
-          is_expected.to eq(filename_cve)
+          is_expected.to eq(filename_cve.chomp('.yml'))
         end
       end
     end
@@ -69,6 +76,19 @@ shared_examples_for 'Advisory' do |path|
         end
       end
     end
+    
+    describe "ghsa" do
+      subject { advisory['ghsa'] }
+
+      it "may be nil or a String" do
+        expect(subject).to be_kind_of(String).or(be_nil)
+      end
+      it "should be id in filename if filename is GHSA-XXX" do
+        if filename_ghsa
+          is_expected.to eq(filename_ghsa.chomp('.yml'))
+        end
+      end
+    end
 
     describe "url" do
       subject { advisory['url'] }
@@ -125,6 +145,12 @@ shared_examples_for 'Advisory' do |path|
           it { expect((0.0)..(10.0)).to include(subject) }
         end
       end
+
+      if advisory['cvss_v2']
+        it "should also provide a cvss_v2 score" do
+          expect(advisory['cvss_v2']).to_not be_nil
+        end
+      end
     end
 
     describe "patched_versions" do
@@ -185,8 +211,8 @@ shared_examples_for 'Advisory' do |path|
       when Hash
         advisory["related"].each_pair do |name, values|
           describe name do
-            it "should be either a cve, an osvdb or a url" do
-              expect(["cve", "osvdb", "url"]).to include(name)
+            it "should be either a cve, an osvdb, a ghsa, or a url" do
+              expect(["cve", "osvdb", "ghsa", "url"]).to include(name)
             end
 
             it "should always contain an array" do

data/data/ruby-advisory-db/spec/gem_example.rb

@@ -3,7 +3,7 @@ require 'advisory_example'
 
 shared_examples_for "Gem Advisory" do |path|
   include_examples 'Advisory', path
-  
+
   advisory = YAML.load_file(path)
 
   describe path do
@@ -17,6 +17,28 @@ shared_examples_for "Gem Advisory" do |path|
         expect(subject.downcase).to eq(gem.downcase)
       end
     end
-  end
 
+    describe "versions" do
+      it "assumes that future versions will be patched" do
+        unaffected_versions = advisory['unaffected_versions'] || []
+        patched_versions    = advisory['patched_versions'] || []
+
+        versions = (unaffected_versions + patched_versions).sort_by do |v|
+          Gem::Version.new(v.match(/[0-9.]+\.\d+/)[0])
+        end
+
+        # If a gem is unpatched this test makes no sense
+        unless patched_versions.none?
+          expect(versions.last.match(/^>=|^>/)).to be_truthy
+        end
+      end
+    end
+
+    it "should have valid schema" do
+      schema = YAML.load_file(File.join(File.dirname(__FILE__), 'schemas/gem.yml'))
+      validator = Kwalify::Validator.new(schema)
+      errors = validator.validate(advisory)
+      expect(errors).to be_empty
+    end
+  end
 end

data/data/ruby-advisory-db/spec/ruby_example.rb

@@ -3,7 +3,7 @@ require 'advisory_example'
 
 shared_examples_for "Rubies Advisory" do |path|
   include_examples 'Advisory', path
-  
+
   advisory = YAML.load_file(path)
 
   describe path do
@@ -17,7 +17,13 @@ shared_examples_for "Rubies Advisory" do |path|
         expect(subject.downcase).to eq(engine.downcase)
       end
     end
-  end
 
+    it "should have valid schema" do
+      schema = YAML.load_file(File.join(File.dirname(__FILE__), 'schemas/ruby.yml'))
+      validator = Kwalify::Validator.new(schema)
+      errors = validator.validate(advisory)
+      expect(errors).to be_empty
+    end
+  end
 end
 

data/data/ruby-advisory-db/spec/schemas/gem.yml

@@ -0,0 +1,71 @@
+type: map
+mapping:
+  "gem":
+    type: str
+    required: yes
+  "library":
+    type: str
+  "framework":
+    type: str
+  "platform":
+    type: str
+  "cve":
+    type: str
+    pattern: /\d+-\d+/
+  "osvdb":
+    type: int
+  "ghsa":
+    type: str
+    pattern: /[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}/
+  "url":
+    type: str
+    required: true
+    pattern: /https?:\/\//
+  "title":
+    type: str
+    required: true
+  "date":
+    type: date
+    required: true
+  "description":
+    type: str
+    required: true
+  "cvss_v2":
+    type: float
+  "cvss_v3":
+    type: float
+  "unaffected_versions":
+    type: seq
+    sequence:
+      - type: str
+  "patched_versions":
+    type: seq
+    sequence:
+      - type: str
+  "vendor_patch":
+    type: seq
+    sequence:
+      - type: str
+        pattern: /https?:\/\//
+  "related":
+    type: map
+    mapping:
+      "cve":
+        type: seq
+        sequence:
+          - type: str
+            pattern: /\d+-\d+/
+      "ghsa":
+        type: seq
+        sequence:
+          - type: str
+            pattern: /[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}/
+      "osvdb":
+        type: seq
+        sequence:
+          - type: int
+      "url":
+        type: seq
+        sequence:
+          - type: str
+            pattern: /https?:\/\//

data/data/ruby-advisory-db/spec/schemas/ruby.yml

@@ -0,0 +1,36 @@
+type: map
+mapping:
+  "engine":
+    type: str
+    required: yes
+    enum: [jruby, rbx, ruby]
+  "cve":
+    type: str
+    pattern: /\d+-\d+/
+  "osvdb":
+    type: int
+  "url":
+    type: str
+    required: true
+    pattern: /https?:\/\//
+  "title":
+    type: str
+    required: true
+  "date":
+    type: date
+    required: true
+  "description":
+    type: str
+    required: true
+  "cvss_v2":
+    type: float
+  "cvss_v3":
+    type: float
+  "unaffected_versions":
+    type: seq
+    sequence:
+      - type: str
+  "patched_versions":
+    type: seq
+    sequence:
+      - type: str

data/data/ruby-advisory-db/spec/spec_helper.rb

@@ -1 +1,2 @@
+require 'kwalify'
 require 'rspec'

data/gemspec.yml

@@ -10,5 +10,5 @@ required_ruby_version: ">= 1.9.3"
 required_rubygems_version: ">= 1.8.0"
 
 dependencies:
-  thor: ~> 0.18
+  thor: ">= 0.18, < 2"
   bundler: ">= 1.2.0, < 3"

data/lib/bundler/audit.rb

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2013-2019 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Copyright (c) 2013-2020 Hal Brodigan (postmodern.mod3 at gmail.com)
 #
 # bundler-audit is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by

data/lib/bundler/audit/advisory.rb

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2013-2019 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Copyright (c) 2013-2020 Hal Brodigan (postmodern.mod3 at gmail.com)
 #
 # bundler-audit is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -26,8 +26,10 @@ module Bundler
                                 :date,
                                 :description,
                                 :cvss_v2,
+                                :cvss_v3,
                                 :cve,
                                 :osvdb,
+                                :ghsa,
                                 :unaffected_versions,
                                 :patched_versions)
 
@@ -63,8 +65,10 @@ module Bundler
           data['date'],
           data['description'],
           data['cvss_v2'],
+          data['cvss_v3'],
           data['cve'],
           data['osvdb'],
+          data['ghsa'],
           parse_versions[data['unaffected_versions']],
           parse_versions[data['patched_versions']]
         )
@@ -88,17 +92,53 @@ module Bundler
         "OSVDB-#{osvdb}" if osvdb
       end
 
+      #
+      # The GHSA (GitHub Security Advisory) identifier
+      #
+      # @return [String, nil]
+      #
+      # @since 0.7.0
+      #
+      def ghsa_id
+        "GHSA-#{ghsa}" if ghsa
+      end
+
+      #
+      # Return a compacted list of all ids
+      #
+      # @return [Array<String>]
+      #
+      # @since 0.7.0
+      #
+      def identifiers
+        [
+          cve_id,
+          osvdb_id,
+          ghsa_id
+        ].compact
+      end
+
       #
       # Determines how critical the vulnerability is.
       #
-      # @return [:low, :medium, :high]
-      #   The criticality of the vulnerability based on the CVSSv2 score.
+      # @return [:none, :low, :medium, :high, :critical]
+      #   The criticality of the vulnerability based on the CVSS score.
       #
       def criticality
-        case cvss_v2
-        when 0.0..3.3  then :low
-        when 3.3..6.6  then :medium
-        when 6.6..10.0 then :high
+        if cvss_v3
+          case cvss_v3
+          when 0.0       then :none
+          when 0.1..3.9  then :low
+          when 4.0..6.9  then :medium
+          when 7.0..8.9  then :high
+          when 9.0..10.0 then :critical
+          end
+        elsif cvss_v2
+          case cvss_v2
+          when 0.0..3.9  then :low
+          when 4.0..6.9  then :medium
+          when 7.0..10.0 then :high
+          end
         end
       end