bundler-audit 0.6.1 → 0.7.0.1

data/data/ruby-advisory-db/gems/codders-dataset/OSVDB-108582.yml

@@ -1,8 +0,0 @@
----
-gem: codders-dataset
-cve: 2014-4991
-osvdb: 108582
-url: http://osvdb.org/show/osvdb/108582
-title: codders-dataset Gem for Ruby /lib/dataset/database/postgresql.rb Process Table Local Plaintext Credential Disclosure
-date: 2014-06-30
-description: codders-dataset Gem for Ruby contains a flaw in /lib/dataset/database/postgresql.rb that is due to the application exposing credential information in plaintext in the process table. This may allow a local attacker to gain access to credential information.

data/data/ruby-advisory-db/gems/codders-dataset/OSVDB-108583.yml

@@ -1,8 +0,0 @@
----
-gem: codders-dataset
-cve: 2014-4991
-osvdb: 108583
-url: http://osvdb.org/show/osvdb/108583
-title: codders-dataset Gem for Ruby /lib/dataset/database/mysql.rb Process Table Local Plaintext Credential Disclosure
-date: 2014-06-30
-description: codders-dataset Gem for Ruby contains a flaw in /lib/dataset/database/mysql.rb that is due to the application exposing credential information in plaintext in the process table. This may allow a local attacker to gain access to credential information.

data/data/ruby-advisory-db/gems/json/OSVDB-101137.yml

@@ -1,17 +0,0 @@
---- 
-gem: json
-cve: 2013-0269
-osvdb: 101137
-url: http://osvdb.org/show/osvdb/101137
-title: json Gem for Ruby JSON::GenericObject Function Arbitrary Addition Creation
-date: 2013-02-04
-description: |
-  json Gem for Ruby contains a flaw in the JSON::GenericObject function. The
-  issue is due to the program failing to restrict users from creating additions
-  regardless of the state of create_additions. This may allow a remote attacker
-  to create arbitrary additions.
-cvss_v2: 9.0
-patched_versions: 
-  - ">= 1.7.7"
-unaffected_versions:
-  - "< 1.7.0"

data/data/ruby-advisory-db/gems/json/OSVDB-90074.yml

@@ -1,23 +0,0 @@
---- 
-gem: json
-cve: 2013-0269
-osvdb: 90074
-url: http://osvdb.org/show/osvdb/90074
-title: Ruby on Rails JSON Gem Arbitrary Symbol Creation Remote DoS
-date: 2013-02-11
-
-description: |
-  Ruby on Rails contains a flaw that may allow a remote denial of service.
-  The issue is due to the JSON gem being tricked in to generating Ruby symbols
-  during the parsing of certain JSON documents. Since Ruby symbols are not
-  garbage collected, a remote attacker can crash a users system. This also may
-  allow the attacker to create arbitrary objects that may be used to bypass
-  certain security mechanisms and potentially allow SQL injection attacks to
-  be conducted.
-
-cvss_v2: 9.0
-
-patched_versions: 
-  - ~> 1.5.5
-  - ~> 1.6.8
-  - ">= 1.7.7"

data/data/ruby-advisory-db/gems/rest-client/OSVDB-117461.yml

@@ -1,13 +0,0 @@
----
-gem: rest-client
-cve: 2015-3448
-osvdb: 117461
-url: http://www.osvdb.org/show/osvdb/117461
-title: Rest-Client Gem for Ruby logs password information in plaintext
-date: 2015-01-12
-description: Rest-Client Ruby Gem contains a flaw that is due to the application
-  logging password information in plaintext. This may allow a local attacker
-  to gain access to password information.
-cvss_v2:
-patched_versions:
-  - ">= 1.7.3"

data/data/ruby-advisory-db/lib/osvdb_scrape.rb

@@ -1,92 +0,0 @@
-require 'pry'
-require 'nokogiri'
-require 'yaml'
-require 'date'
-
-class OSVDB
-  attr_accessor :osvdb, :cve, :title, :description, :date, :cvss_v2, :gem, :url, :patched_versions, :page
-  def initialize(osvdb)
-    self.osvdb = osvdb
-    self.url = "http://osvdb.org/show/osvdb/#{self.osvdb}"
-    scrape!
-    parse!
-  end
-
-  def scrape!
-    html = `bash --login -c "python cf_scrape.py #{self.url}"`
-    doc = Nokogiri::XML(html) do |config|
-      config.nonet.noent
-    end
-
-    self.page = doc
-  end
-
-  def parse!
-    page.search(".show_vuln_table").search("td ul li").each do |li|
-      case li.children[0].text.strip
-      when "CVE ID:"
-        self.cve = li.children[1].text
-      when "Vendor URL:"
-        self.set_gem(li.children[1].text)
-      end
-    end
-
-    self.description = page.search(".show_vuln_table").search("tr td tr .white_content p")[0].text
-    self.date = page.search(".show_vuln_table").search("tr td tr .white_content tr td")[0].text
-    self.title = page.search("title").text.gsub(/\d+: /, "")
-    if cvss_p = page.search(".show_vuln_table").search("tr td tr .white_content div p")[0]
-      self.set_cvss(cvss_p.children[0].text)
-    end
-  end
-
-  def set_gem(vendortext)
-    ["https://rubygems.org/gems/", "http://rubygems.org/gems/"].each do |str|
-      if vendortext.match(str)
-        self.gem = vendortext.gsub(str,"")
-      end
-    end
-  end
-
-  def set_cvss(text)
-    self.cvss_v2 = text.strip.gsub("CVSSv2 Base Score = ", "")
-  end
-
-  def date
-    Date.parse(@date)
-  end
-
-  def cvss_v2
-    @cvss_v2.nil? ? nil : @cvss_v2.to_f
-  end
-
-  def gem
-    @gem.nil? ? "unknown" : @gem
-  end
-
-  def to_yaml
-    { 'gem' => gem,
-      'cve' => cve,
-      'osvdb' => osvdb.to_i,
-      'url' => url,
-      'title' => title,
-      'date' => date,
-      'description' => description,
-      'cvss_v2' => cvss_v2,
-      'patched_versions' => patched_versions
-    }.to_yaml(options = { line_width: 80 })
-  end
-
-  def filename
-    "OSVDB-#{osvdb}.yml"
-  end
-
-  def to_advisory!
-    gems_path = File.join(File.dirname(__FILE__), "..", "gems")
-    adv_path = File.absolute_path(File.join(gems_path, self.gem))
-
-    FileUtils.mkdir(adv_path) unless File.exists?(adv_path)
-    File.open(File.join(adv_path, filename), "w") do |io|
-      io.puts self.to_yaml
-    end
-  end
-end

data/data/ruby-advisory-db/rubies/ruby/OSVDB-120541.yml

@@ -1,22 +0,0 @@
----
-engine: ruby
-cve: 2015-1855
-osvdb: 120541
-url: http://www.osvdb.org/show/osvdb/120541
-title: |
-  Ruby lib/openssl/ssl.rb verify_certificate_identity() Function X.509
-  Certificate Improper Hostname Verification MitM Spoofing
-date: 2014-03-16
-description: |
-  Ruby contains a flaw related to certificate validation in
-  verify_certificate_identity() function in lib/openssl/ssl.rb. The issue is
-  due to the server hostname not being verified to match a domain name in the
-  Subject's Common Name (CN) or SubjectAltName field of the X.509 certificate.
-  By spoofing the TLS/SSL server via a certificate that appears valid, an
-  attacker with the ability to intercept network traffic (e.g. MiTM, DNS cache
-  poisoning) can disclose and optionally manipulate transmitted data.
-cvss_v2: 4.0
-patched_versions:
-  - ~> 2.0.0.645
-  - ~> 2.1.6
-  - ">= 2.2.2"

data/data/ruby-advisory-db/rubies/ruby/OSVDB-87280.yml

@@ -1,17 +0,0 @@
----
-engine: ruby
-cve: 2012-5371
-osvdb: 87280
-url: http://www.osvdb.org/show/osvdb/87280
-title: Ruby String Key Object Hashing Hash Collision Form Parameter Parsing Remote
-  DoS
-date: 2012-11-10
-description: |
-  Ruby contains a flaw that may allow a remote denial of service. The issue
-  is triggered when an error occurs during the parsing of the sequence to create a
-  hash object, by using string keys. This may result in a hash collision, causing
-  a denial of service in the program.
-cvss_v2: 5.0
-patched_versions:
-  - ~> 1.9.3.327
-  - ">= 2.0.0"