bundler-audit 0.6.1 → 0.7.0.1

data/data/ruby-advisory-db/gems/administrate/CVE-2020-5257.yml

@@ -0,0 +1,24 @@
+---
+gem: administrate
+cve: 2020-5257
+ghsa: 2p5p-m353-833w
+title: Sort order SQL injection via `direction` parameter in administrate
+date: 2020-03-14
+url: https://github.com/advisories/GHSA-2p5p-m353-833w
+description: |
+  In Administrate (rubygem) before version 0.13.0, when sorting by attributes
+  on a dashboard, the direction parameter was not validated before being
+  interpolated into the SQL query.
+
+  This could present a SQL injection if the attacker were able to modify the
+  direction parameter and bypass ActiveRecord SQL protections.
+
+  Whilst this does have a high-impact, to exploit this you need access to the
+  Administrate dashboards, which should generally be behind authentication.
+
+patched_versions:
+  - ">= 0.13.0"
+
+related:
+  url:
+    - https://github.com/thoughtbot/administrate/commit/3ab838b83c5f565fba50e0c6f66fe4517f98eed3

data/data/ruby-advisory-db/gems/airbrake-ruby/CVE-2019-16060.yml

@@ -0,0 +1,18 @@
+---
+gem: airbrake-ruby
+cve: 2019-16060
+date: 2019-04-10
+url: https://github.com/airbrake/airbrake-ruby/issues/468
+title: Blacklist keys are no longer being filtered in airbrake-ruby
+description: |
+  A flaw in airbrake-ruby v4.2.3 prevented user data from being filtered
+  prior to sending to Airbrake. Such data could be user passwords. Therefore, an app
+  could leak user passwords without knowing it.
+unaffected_versions:
+  - "< 4.2.3"
+  - "> 4.2.3"
+patched_versions:
+  - ">= 4.2.4"
+related:
+  url:
+    - https://github.com/airbrake/airbrake-ruby/pull/469

data/data/ruby-advisory-db/gems/archive-tar-minitar/CVE-2016-10173.yml

@@ -13,4 +13,4 @@ description: |
 
   Credit: ecneladis
 patched_versions:
-  - ">= 0.6.1"
+  - ">= 0.6.0"

data/data/ruby-advisory-db/gems/authlogic/{OSVDB-89064.yml → CVE-2012-6497.yml}

@@ -2,7 +2,7 @@
 gem: authlogic
 cve: 2012-6497
 osvdb: 89064
-url: http://osvdb.org/show/osvdb/89064
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-6497
 title: Ruby on Rails Authlogic Gem secret_token.rb Known secret_token Value Weakness
 date: 2012-12-21
 description: |

data/data/ruby-advisory-db/gems/awesome-bot/CVE-2019-15224.yml

@@ -0,0 +1,19 @@
+---
+gem: awesome-bot
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in awesome-bot
+description: |
+  The awesome-bot gem 1.18.0 for Ruby, as distributed on RubyGems.org, included a code-execution
+  backdoor inserted by a third party.
+
+  Users of an affected version should consider downgrading to the last non-affected version of
+  1.17.2 or upgrading to 1.19.x.
+unaffected_versions:
+  - "< 1.18.0"
+  - "> 1.18.0"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/backup-agoddard/{OSVDB-108578.yml → CVE-2014-4993.yml}

@@ -2,7 +2,7 @@
 gem: backup-agoddard
 cve: 2014-4993
 osvdb: 108578
-url: http://osvdb.org/show/osvdb/108578
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-4993
 title: backup-agoddard Gem for Ruby /lib/backup/cli/utility.rb Process Table Local Plaintext Password Disclosure
 date: 2014-06-30
 description: backup-agoddard Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb that is due to the application exposing password information in plaintext in the process table. This may allow a local attacker to gain access to password information.

data/data/ruby-advisory-db/gems/backup_checksum/{OSVDB-108569.yml → CVE-2014-4993.yml}

@@ -2,7 +2,7 @@
 gem: backup_checksum
 cve: 2014-4993
 osvdb: 108569
-url: http://osvdb.org/show/osvdb/108569
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-4993
 title: backup_checksum Gem for Ruby /lib/backup/cli/utility.rb Process List Local Plaintext Password Disclosure
 date: 2014-06-30
 description: |

data/data/ruby-advisory-db/gems/bibtex-ruby/CVE-2019-10780.yml

@@ -0,0 +1,16 @@
+---
+gem: bibtex-ruby
+cve: 2019-10780
+ghsa: c5r5-7pfh-6qg6
+url: https://github.com/advisories/GHSA-c5r5-7pfh-6qg6
+date: 2020-02-14
+title: OS command injection in BibTeX-Ruby
+description: |
+  BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized
+  user input being passed directly to the built-in Ruby Kernel.open method through
+  BibTeX.open.
+
+cvss_v3: 9.8
+
+patched_versions:
+  - ">= 5.1.0"

data/data/ruby-advisory-db/gems/bio-basespace-sdk/{OSVDB-101031.yml → CVE-2013-7111.yml}

@@ -2,7 +2,7 @@
 gem: bio-basespace-sdk
 cve: 2013-7111
 osvdb: 101031
-url: http://osvdb.org/show/osvdb/101031
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-7111
 title: Bio Basespace SDK Gem for Ruby Command Line API Key Disclosure
 date: 2013-12-14
 description: Bio Basespace SDK Gem for Ruby contains a flaw that is due to the API client code passing the API_KEY to a curl command. This may allow a local attacker to gain access to API key information by monitoring the process table.

data/data/ruby-advisory-db/gems/bitcoin_vanity/CVE-2019-15224.yml

@@ -0,0 +1,18 @@
+---
+gem: bitcoin_vanity
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in bitcoin_vanity
+description: |
+  The bitcoin_vanity gem 4.3.3 for Ruby, as distributed on RubyGems.org, included a code-execution
+  backdoor inserted by a third party.
+
+  No unaffected version is known to exist, as the gem appears to have been entirely removed.
+unaffected_versions:
+  - "< 4.3.3"
+  - "> 4.3.3"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/blockchain_wallet/CVE-2019-15224.yml

@@ -0,0 +1,19 @@
+---
+gem: blockchain_wallet
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in blockchain_wallet
+description: |
+  The blockchain_wallet gem 0.0.6 through 0.0.7 for Ruby, as distributed on RubyGems.org, included
+  a code-execution backdoor inserted by a third party.
+
+  Users of an affected version should consider downgrading to the last non-affected version of
+  0.0.5.
+unaffected_versions:
+  - "< 0.0.6"
+  - "> 0.0.7"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2016-10735.yml

@@ -0,0 +1,20 @@
+---
+gem: bootstrap-sass
+cve: 2016-10735
+url: https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/
+title: XSS vulnerability via data-target in bootstrap-sass
+date: 2016-07-27
+
+description: |
+  In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2,
+  XSS is possible in the data-target attribute.
+
+cvss_v2: 4.3
+cvss_v3: 6.1
+
+patched_versions:
+  - '>= 3.4.0'
+
+related:
+  url:
+    - https://github.com/twbs/bootstrap/issues/20184

data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2019-10842.yml

@@ -0,0 +1,25 @@
+---
+gem: bootstrap-sass
+cve: 2019-10842
+url: https://github.com/twbs/bootstrap-sass/issues/1195
+title: Remote code execution in bootstrap-sass
+date: 2019-04-04
+
+description: |
+  Arbitrary code execution (via backdoor code, when 
+  downloaded from rubygems.org) was discovered in 
+  bootstrap-sass 3.2.0.3.
+  
+  Users are advised to upgrade immediately to 3.2.0.4
+  
+  An unauthenticated attacker can craft the ___cfduid cookie value
+  with base64 arbitrary code to be executed via eval(), which can
+  be leveraged to execute arbitrary code on the target system. 
+  (Note that there are three underscore characters in the cookie name. 
+  This is unrelated to the __cfduid cookie that is legitimately used by 
+  Cloudflare.)
+
+unaffected_versions:
+  - "<= 3.2.0.2"
+patched_versions:
+  - ">= 3.2.0.4"

data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2019-8331.yml

@@ -0,0 +1,20 @@
+---
+gem: bootstrap-sass
+cve: 2019-8331
+url: https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/
+title: XSS vulnerability in bootstrap-sass
+date: 2019-02-15
+
+description: |
+  In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible
+  in the tooltip or popover data-template attribute.
+
+cvss_v2: 4.3
+cvss_v3: 6.1
+
+patched_versions:
+  - '>= 3.4.1'
+
+related:
+  url:
+    - https://github.com/twbs/bootstrap-sass/releases/tag/v3.4.1

data/data/ruby-advisory-db/gems/bootstrap/CVE-2016-10735.yml

@@ -0,0 +1,20 @@
+---
+gem: bootstrap
+cve: 2016-10735
+url: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/
+title: XSS vulnerability via data-target in bootstrap
+date: 2016-07-27
+
+description: |
+  In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2,
+  XSS is possible in the data-target attribute.
+
+cvss_v2: 4.3
+cvss_v3: 6.1
+
+patched_versions:
+  - '>= 4.0.0-beta.2'
+
+related:
+  url:
+    - https://github.com/twbs/bootstrap/issues/20184

data/data/ruby-advisory-db/gems/bootstrap/CVE-2018-14040.yml

@@ -0,0 +1,24 @@
+---
+gem: bootstrap
+cve: 2018-14040
+url: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/
+title: XSS vulnerabilities via data-parent, data-target, data-container in bootstrap
+date: 2018-07-03
+
+description: |
+  In Bootstrap before 4.1.2, XSS is possible in collapse data-parent
+  attribute (CVE-2018-14040), data-target property of scrollspy
+  (CVE-2018-14041), data-container property of tooltip (CVE-2018-14042)
+
+cvss_v2: 4.3
+cvss_v3: 6.1
+
+patched_versions:
+  - '>= 4.1.2'
+
+related:
+  cve:
+    - 2018-14041
+    - 2018-14042
+  url:
+    - https://github.com/twbs/bootstrap/issues/26423

data/data/ruby-advisory-db/gems/bootstrap/CVE-2019-8331.yml

@@ -0,0 +1,20 @@
+---
+gem: bootstrap
+cve: 2019-8331
+url: https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/
+title: XSS vulnerability in bootstrap
+date: 2019-02-15
+
+description: |
+  In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible
+  in the tooltip or popover data-template attribute.
+
+cvss_v2: 4.3
+cvss_v3: 6.1
+
+patched_versions:
+  - '>= 4.3.1'
+
+related:
+  url:
+    - https://github.com/twbs/bootstrap-rubygem/releases/tag/v4.3.1

data/data/ruby-advisory-db/gems/brakeman/CVE-2019-18409.yml

@@ -0,0 +1,26 @@
+---
+gem: brakeman
+cve: 2019-18409
+date: 2019-10-24
+url: https://brakemanscanner.org/blog/2019/10/14/brakeman-4-dot-7-dot-1-released
+title: brakeman world writable files allow local privilege escalation
+
+description: |
+  The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local
+  privilege escalation because of world-writable files. For example,
+  if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used,
+  a local user can insert malicious code into the
+  ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.
+
+cvss_v2: 4.6
+cvss_v3: 7.8
+
+patched_versions:
+  - ">= 4.7.1"
+
+unaffected_versions:
+  - "<= 4.4.0"
+
+related:
+  url:
+    - https://github.com/zenspider/ruby_parser-legacy/issues/1

data/data/ruby-advisory-db/gems/brbackup/{OSVDB-108901.yml → CVE-2014-5004.yml}

@@ -2,7 +2,7 @@
 gem: brbackup
 cve: 2014-5004
 osvdb: 108901
-url: http://osvdb.org/show/osvdb/108901
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-5004
 title: brbackup Gem for Ruby Process List Local Plaintext Password Disclosure
 date: 2014-07-09
 description: |

data/data/ruby-advisory-db/gems/bson/CVE-2015-4411.yml

@@ -0,0 +1,21 @@
+---
+gem: bson
+cve: 2015-4411
+ghsa: qh4w-7pw3-p4rp
+url: https://github.com/advisories/GHSA-qh4w-7pw3-p4rp
+date: 2020-04-29
+title: Potential denial of service in bson rubygem
+description: |
+  The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4
+  as used in rubygem-moped allows remote attackers to cause a denial of service (worker
+  resource consumption) via a crafted string. NOTE: This issue is due to an incomplete
+  fix to CVE-2015-4410.
+
+cvss_v3: 7.5
+
+patched_versions:
+  - ">= 3.0.4"
+
+related:
+  cve:
+  - 2015-4410

data/data/ruby-advisory-db/gems/bson/CVE-2015-4412.yml

@@ -8,9 +8,11 @@ date: 2015-06-04
 description: >-
   A flaw in the ObjectId validation regular expression can enable attackers to inject arbitrary information into a given BSON object.
 
-vendor_patch: 
-  - https://github.com/mongodb/mongo-ruby-driver/compare/6ae981167759d5819ba3d41e374e5b2af5b79077~1...9859a3ab9773a8a883eb8438b665a921cc991c71
-  - https://github.com/mongodb/bson-ruby/compare/7446d7c6764dfda8dc4480ce16d5c023e74be5ca...28f34978a85b689a4480b4d343389bf4886522e7
 patched_versions:
   - "~> 1.12.3"
   - ">= 3.0.4"
+
+related:
+  url:
+    - https://github.com/mongodb/mongo-ruby-driver/compare/6ae981167759d5819ba3d41e374e5b2af5b79077~1...9859a3ab9773a8a883eb8438b665a921cc991c71
+    - https://github.com/mongodb/bson-ruby/compare/7446d7c6764dfda8dc4480ce16d5c023e74be5ca...28f34978a85b689a4480b4d343389bf4886522e7

data/data/ruby-advisory-db/gems/bundler/{OSVDB-110004.yml → CVE-2013-0334.yml}

@@ -2,7 +2,7 @@
 gem: bundler
 cve: 2013-0334
 osvdb: 110004
-url: http://www.osvdb.org/show/osvdb/110004
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0334
 title: Bundler Gem for Ruby Multiple Top-level Source Lines Gemfile Handling Gem Installation Spoofing
 date: 2014-08-13
 description: |

data/data/ruby-advisory-db/gems/cairo/CVE-2017-7475.yml

@@ -0,0 +1,15 @@
+---
+gem: cairo
+cve: 2017-7475
+ghsa: 5v3f-73gv-x7x5
+url: https://bugs.freedesktop.org/show_bug.cgi?id=100763
+date: 2017-11-15
+title: cairo NULL pointer dereference
+description: |
+  Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related
+  to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.
+
+cvss_v3: 5.5
+
+patched_versions:
+- ">= 1.15.5"

data/data/ruby-advisory-db/gems/cap-strap/{OSVDB-108574.yml → CVE-2014-4992.yml}

@@ -2,7 +2,7 @@
 gem: cap-strap
 cve: 2014-4992
 osvdb: 108574
-url: http://osvdb.org/show/osvdb/108574
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-4992
 title: cap-strap Gem for Ruby Process Table Local Plaintext Credential Disclosure
 date: 2014-06-30
 description: cap-strap Gem for Ruby contains a flaw that is due to the application exposing credential information in plaintext in the process table listing. This may allow a local attacker to gain access to credential information.

data/data/ruby-advisory-db/gems/capistrano-colors/CVE-2019-15224.yml

@@ -0,0 +1,19 @@
+---
+gem: capistrano-colors
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in capistrano-colors
+description: |
+  The capistrano-colors 0.5.5 gem for Ruby, as distributed on RubyGems.org, included a
+  code-execution backdoor inserted by a third party.
+
+  Users of an affected version should consider downgrading to the last non-affected version of
+  0.5.4.
+unaffected_versions:
+  - "< 0.5.5"
+  - "> 0.5.5"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/chartkick/CVE-2019-12732.yml

@@ -0,0 +1,21 @@
+---
+gem: chartkick
+cve: 2019-12732
+url: https://github.com/ankane/chartkick/issues/488
+title: XSS Vulnerability in Chartkick Ruby Gem
+date: 2019-06-04
+description: |
+  Chartkick is vulnerable to a cross-site scripting (XSS) attack if
+  both the following conditions are met:
+
+  Condition 1:
+    It's used with `ActiveSupport.escape_html_entities_in_json = false`
+    (this is not the default for Rails)
+    OR used with a non-Rails framework like Sinatra.
+
+  Condition 2:
+    Untrusted data or options are passed to a chart.
+
+    <%= line_chart params[:data], min: params[:min] %>
+patched_versions:
+  - ">= 3.2.0"