bundler-audit 0.6.1 → 0.7.0.1

data/data/ruby-advisory-db/gems/chartkick/CVE-2019-18841.yml

@@ -0,0 +1,13 @@
+---
+gem: chartkick
+cve: 2019-18841
+url: https://github.com/ankane/chartkick.js/issues/117
+title: Prototype Pollution in Chartkick.js 3.1.x
+date: 2019-11-09
+description: |
+  A specially crafted response in data loaded via URL
+  can cause prototype pollution in JavaScript.
+unaffected_versions:
+  - "< 3.1.0"
+patched_versions:
+  - ">= 3.3.0"

data/data/ruby-advisory-db/gems/chloride/CVE-2018-6517.yml

@@ -0,0 +1,17 @@
+---
+gem: chloride
+cve: 2018-6517
+url: https://puppet.com/security/cve/CVE-2018-6517
+date: 2019-03-08
+title: Improper handling of ssh known_hosts file with Chloride
+
+description: |
+  Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints
+  for previously unknown hosts getting added to the user's known_hosts file without
+  confirmation. In version 0.3.0 this is updated so that the user's known_hosts file
+  is not updated by chloride.
+
+cvss_v3: 5.0
+
+patched_versions:
+  - ">= 0.3.0"

data/data/ruby-advisory-db/gems/ciborg/{OSVDB-108586.yml → CVE-2014-5003.yml}

@@ -2,7 +2,7 @@
 gem: ciborg
 cve: 2014-5003
 osvdb: 108586
-url: http://osvdb.org/show/osvdb/108586
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-5003
 title: ciborg Gem for Ruby default.rb /tmp/perlbrew-installer Local Symlink File Overwrite
 date: 2014-06-30
 description: ciborg Gem for Ruby contains a flaw as default.rb creates temporary files insecurely. It is possible for a local attacker to use a symlink attack against the /tmp/perlbrew-installer file to cause the program to unexpectedly overwrite an arbitrary file.

data/data/ruby-advisory-db/gems/cocaine/{OSVDB-98835.yml → CVE-2013-4457.yml}

@@ -2,7 +2,7 @@
 gem: cocaine
 cve: 2013-4457
 osvdb: 98835
-url: http://www.osvdb.org/show/osvdb/98835
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-4457
 title: Cocaine Gem for Ruby contains a flaw
 date: 2013-10-22
 description: Cocaine Gem for Ruby contains a flaw that is due to the method

data/data/ruby-advisory-db/gems/codders-dataset/CVE-2014-4991.yml

@@ -0,0 +1,8 @@
+---
+gem: codders-dataset
+cve: 2014-4991
+osvdb: 108582
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-4991
+title: codders-dataset Gem for Ruby lib/dataset/database/mysql.rb and lib/dataset/database/postgresql.rb Process Table Local Plaintext Credential Disclosure
+date: 2014-06-30
+description: (1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.

data/data/ruby-advisory-db/gems/coin_base/CVE-2019-15224.yml

@@ -0,0 +1,18 @@
+---
+gem: coin_base
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in coin_base
+description: |
+  The coin_base gem 4.2.1 through 4.2.2 for Ruby, as distributed on RubyGems.org, included a
+  code-execution backdoor inserted by a third party.
+
+  No unaffected version is known to exist, as the gem appears to have been entirely removed.
+unaffected_versions:
+  - "< 4.2.1"
+  - "> 4.2.2"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/coming-soon/CVE-2019-15224.yml

@@ -0,0 +1,18 @@
+---
+gem: coming-soon
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in coming-soon
+description: |
+  The coming-soon gem 0.2.8 for Ruby, as distributed on RubyGems.org, included a code-execution
+  backdoor inserted by a third party.
+
+  No unaffected version is known to exist, as the gem appears to have been entirely removed.
+unaffected_versions:
+  - "< 0.2.8"
+  - "> 0.2.8"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/command_wrap/{OSVDB-91450.yml → CVE-2013-1875.yml}

@@ -2,7 +2,7 @@
 gem: command_wrap
 cve: 2013-1875
 osvdb: 91450
-url: http://osvdb.org/show/osvdb/91450
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1875
 title: command_wrap Gem for Ruby URI Handling Arbitrary Command Injection
 date: 2013-03-18
 description: command_wrap Gem for Ruby contains a flaw that is triggered during the handling of input passed via the URL that contains a semicolon character (;). This will allow a remote attacker to inject arbitrary commands and have them executed in the context of the user clicking it.

data/data/ruby-advisory-db/gems/consul/CVE-2019-16377.yml

@@ -0,0 +1,15 @@
+---
+gem: consul
+cve: 2019-16377
+url: https://github.com/makandra/consul/issues/49
+title: |
+  Consul gem insufficient authentication check: Multiple powers in one controller are not always checked correctly
+date: 2019-09-23
+description: |
+  With the consul ruby gem before 1.0.3, if a controller checks multiple powers
+  using `:if` or `:except` conditions, these conditions are erroneously applied
+  to all power checks in that controller. This can lead to skipped power checks
+  and hence unauthenticated access to certain controller actions.
+
+patched_versions:
+  - ">= 1.0.3"

data/data/ruby-advisory-db/gems/crack/{OSVDB-90742.yml → CVE-2013-1800.yml}

@@ -2,7 +2,7 @@
 gem: crack
 cve: 2013-1800
 osvdb: 90742
-url: http://osvdb.org/show/osvdb/90742
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1800
 title: crack Gem for Ruby Type Casting Parameter Parsing Remote Code Execution 
 description: |
   crack Gem for Ruby contains a flaw that is triggered when a type casting

data/data/ruby-advisory-db/gems/cremefraiche/{OSVDB-93395.yml → CVE-2013-2090.yml}

@@ -2,7 +2,7 @@
 gem: cremefraiche
 cve: 2013-2090
 osvdb: 93395
-url: http://osvdb.org/show/osvdb/93395
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-2090
 title: Creme Fraiche Gem for Ruby File Name Shell Metacharacter Injection Arbitrary Command Execution
 date: 2013-05-14
 description: Creme Fraiche Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input in file names. With a specially crafted file name that contains shell metacharacters, a context-dependent attacker can execute arbitrary commands

data/data/ruby-advisory-db/gems/cron_parser/CVE-2019-15224.yml

@@ -0,0 +1,20 @@
+---
+gem: cron_parser
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in cron_parser
+description: |
+  The cron_parser gem 0.1.4, 1.0.12, and 1.0.13 as distributed on RubyGems.org, included a
+  code-execution backdoor inserted by a third party.
+
+  No unaffected version is known to exist, as the gem appears to have been entirely removed.
+unaffected_versions:
+  - "< 1.0.12"
+  - "> 1.0.13"
+  - "< 0.1.4"
+  - "> 0.1.4"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/curl/{OSVDB-91230.yml → CVE-2013-2617.yml}

@@ -2,7 +2,7 @@
 gem: curl
 cve: 2013-2617
 osvdb: 91230
-url: http://osvdb.org/show/osvdb/91230
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-2617
 title: Curl Gem for Ruby URI Handling Arbitrary Command Injection
 date: 2013-03-12
 description: Curl Gem for Ruby contains a flaw that is triggered during the

data/data/ruby-advisory-db/gems/datagrid/CVE-2019-14281.yml

@@ -0,0 +1,14 @@
+---
+gem: datagrid
+cve: 2019-14281
+ghsa: rqp5-pg7w-832p
+url: https://github.com/rubygems/rubygems.org/issues/2072
+date: 2019-07-31
+title: Code execution backdoor in datagrid
+description: |
+  The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included
+  a code-execution backdoor inserted by a third party.
+unaffected_versions:
+  - "< 1.0.6"
+  - "> 1.0.6"
+cvss_v3: 9.8

data/data/ruby-advisory-db/gems/delayed_job_web/CVE-2017-12097.yml

@@ -0,0 +1,17 @@
+---
+gem: delayed_job_web
+cve: 2017-12097
+url: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0449
+date: 2018-01-10
+title: delayed_job_web ruby gem XSS vulnerability via `queues` parameter
+description: |
+  An exploitable cross site scripting (XSS) vulnerability exists in the
+  filter functionality of the delayed_job_web ruby gem. A specially crafted
+  URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary
+  javascript on the victim's browser. An attacker can phish an authenticated user
+  to trigger this vulnerability.
+
+cvss_v3: 6.1
+
+patched_versions:
+  - ">= 1.4.2"

data/data/ruby-advisory-db/gems/devise/{OSVDB-89642.yml → CVE-2013-0233.yml}

@@ -2,7 +2,7 @@
 gem: devise
 cve: 2013-0233
 osvdb: 89642
-url: http://osvdb.org/show/osvdb/89642
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0233
 title: Devise Database Type Conversion Crafted Request Parsing Security Bypass
 date: 2013-01-28
 

data/data/ruby-advisory-db/gems/devise/CVE-2019-16109.yml

@@ -0,0 +1,13 @@
+---
+gem: devise
+cve: 2019-16109
+url: https://github.com/plataformatec/devise/issues/5071
+title: Devise Gem for Ruby confirmation token validation with a blank string
+date: 2019-09-08
+description: |
+  Devise before 4.7.1 confirms accounts upon receiving a request with a blank
+  confirmation_token, if a database record has a blank value in the confirmation_token column.
+  However, there is no scenario within Devise itself in which such database records would exist.
+
+patched_versions:
+  - ">= 4.7.1"

data/data/ruby-advisory-db/gems/devise/CVE-2019-5421.yml

@@ -0,0 +1,16 @@
+---
+gem: devise
+cve: 2019-5421
+url: https://github.com/plataformatec/devise/issues/4981
+title: Devise Gem for Ruby Time-of-check Time-of-use race condition with lockable module
+date: 2019-02-07
+description: |
+  Devise ruby gem before 4.6.0 when the `lockable` module is used is vulnerable to a
+  time-of-check time-of-use (TOCTOU) race condition due to `increment_failed_attempts`
+  within the `Devise::Models::Lockable` class not being concurrency safe.
+
+patched_versions:
+  - ">= 4.6.0"
+
+cvss_v2: 7.5
+cvss_v3: 9.8

data/data/ruby-advisory-db/gems/doge-coin/CVE-2019-15224.yml

@@ -0,0 +1,19 @@
+---
+gem: doge-coin
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in doge-coin
+description: |
+  The doge-coin gem 1.0.2 for Ruby, as distributed on RubyGems.org, included a code-execution
+  backdoor inserted by a third party.
+
+  Users of an affected version should consider downgrading to the last non-affected version of
+  1.0.1.
+unaffected_versions:
+  - "< 1.0.2"
+  - "> 1.0.2"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/doorkeeper-openid_connect/CVE-2019-9837.yml

@@ -0,0 +1,16 @@
+---
+gem: doorkeeper-openid_connect
+cve: 2019-9837
+date: 2019-03-25
+url: https://github.com/doorkeeper-gem/doorkeeper-openid_connect/blob/master/CHANGELOG.md#v154-2019-02-15
+title: Doorkeeper::OpenidConnect Open Redirect
+description: Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper)
+  1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in
+  an OAuth authorization request (that results in an error response) with the 'openid'
+  scope and a prompt=none value. This allows phishing attacks against the authorization
+  flow.
+cvss_v3: 6.1
+patched_versions:
+  - ">= 1.5.4"
+unaffected_versions:
+  - "< 1.4.0"

data/data/ruby-advisory-db/gems/doorkeeper/CVE-2018-1000088.yml

@@ -0,0 +1,39 @@
+---
+gem: doorkeeper
+cve: 2018-1000088
+date: 2018-02-21
+url: "https://blog.justinbull.ca/cve-2018-1000088-stored-xss-in-doorkeeper/"
+
+title: Doorkeeper gem has stored XSS on authorization consent view
+
+description: |
+  Stored XSS on the OAuth Client's name will cause users being prompted for
+  consent via the "implicit" grant type to execute the XSS payload.
+
+  The XSS attack could gain access to the user's active session, resulting in
+  account compromise.
+
+  Any user is susceptible if they click the authorization link for the
+  malicious OAuth client. Because of how the links work, a user cannot tell if
+  a link is malicious or not without first visiting the page with the XSS
+  payload.
+
+  If 3rd parties are allowed to create OAuth clients in the app using
+  Doorkeeper, upgrade to the patched versions immediately.
+
+  Additionally there is stored XSS in the native_redirect_uri form element.
+
+  DWF has assigned CVE-2018-1000088.
+
+cvss_v3: 7.6
+
+unaffected_versions:
+  - "< 2.1.0"
+
+patched_versions:
+  - ">= 4.2.6"
+
+related:
+  url:
+    - https://github.com/doorkeeper-gem/doorkeeper/issues/969
+    - https://github.com/doorkeeper-gem/doorkeeper/issues/970

data/data/ruby-advisory-db/gems/doorkeeper/CVE-2018-1000211.yml

@@ -0,0 +1,39 @@
+---
+gem: doorkeeper
+cve: 2018-1000211
+date: 2018-07-11
+url: "https://blog.justinbull.ca/cve-2018-1000211-public-apps-cant-revoke-tokens-in-doorkeeper/"
+
+title: Doorkeeper gem does not revoke token for public clients
+
+description: |
+  Any OAuth application that uses public/non-confidential authentication when
+  interacting with Doorkeeper is unable to revoke its tokens when calling the
+  revocation endpoint.
+
+  A bug in the token revocation API would cause it to attempt to authenticate
+  the public OAuth client as if it was a confidential app. Because of this, the
+  token is never revoked.
+
+  The impact of this is the access or refresh token is not revoked, leaking
+  access to protected resources for the remainder of that token's lifetime.
+
+  If Doorkeeper is used to facilitate public OAuth apps and leverage token
+  revocation functionality, upgrade to the patched versions immediately.
+
+  Credit to Roberto Ostinelli for discovery, Justin Bull for the fixes.
+
+  DWF has assigned CVE-2018-1000211.
+
+unaffected_versions:
+  - "< 4.2.0"
+
+patched_versions:
+  - ">= 4.4.0"
+  - ">= 5.0.0.rc2"
+
+related:
+  url:
+    - https://github.com/doorkeeper-gem/doorkeeper/issues/891
+    - https://github.com/doorkeeper-gem/doorkeeper/pull/1119
+    - https://github.com/doorkeeper-gem/doorkeeper/pull/1120

data/data/ruby-advisory-db/gems/doorkeeper/CVE-2020-10187.yml

@@ -0,0 +1,34 @@
+---
+gem: doorkeeper
+ghsa: j7vx-8mqj-cqp9
+cve: 2020-10187
+date: 2020-05-02
+url: https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-j7vx-8mqj-cqp9
+title: Doorkeeper application secret information disclosure vulnerability
+
+description: |
+  Information disclosure vulnerability. Allows an attacker to see all
+  Doorkeeper::Application model attribute values (including secrets) after
+  authorizing an application to their user.
+
+  An application is vulnerable if the authorized applications controller is
+  enabled (GET /oauth/authorized_applications.json).
+
+  Recommended additional hardening for >= 5.1 is to enable application secrets
+  hashing. This would render the exposed secret useless.
+
+unaffected_versions:
+  - "< 5.0.0"
+
+patched_versions:
+  - "~> 5.0.3"
+  - "~> 5.1.1"
+  - "~> 5.2.5"
+  - ">= 5.3.2"
+
+cvss_v2: 5.5
+cvss_v3: 5.4
+
+related:
+  url:
+    - https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6

data/data/ruby-advisory-db/gems/dragonfly/{OSVDB-90647.yml → CVE-2013-1756.yml}

@@ -2,7 +2,7 @@
 gem: dragonfly
 cve: 2013-1756
 osvdb: 90647
-url: http://www.osvdb.org/show/osvdb/90647
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1756
 title: Dragonfly Gem for Ruby Crafted Request Parsing Remote Code Execution
 date: 2013-02-19
 description: |

data/data/ruby-advisory-db/gems/dragonfly/{OSVDB-96798.yml → CVE-2013-5671.yml}

@@ -2,7 +2,7 @@
 gem: dragonfly
 cve: 2013-5671
 osvdb: 96798
-url: http://osvdb.org/show/osvdb/96798
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-5671
 title: fog-dragonfly Gem for Ruby imagemagickutils.rb Remote Command Execution
 date: 2013-09-03
 description: |

data/data/ruby-advisory-db/gems/easymon/CVE-2018-1000855.yml

@@ -0,0 +1,16 @@
+---
+gem: easymon
+date: 2018-11-09
+url: https://github.com/basecamp/easymon/issues/26
+cve: 2018-1000855
+title: Reflected XSS in Firefox in check endpoint
+description: |
+  When passing an invalid check name as parameter to the endpoint where
+  the easymon routes are mounted, a 406 response with a body that contains the invalid
+  check name unescaped is returned. Malicious JavaScript can be injected into that
+  invalid name and have it executed in Firefox
+patched_versions:
+  - ">= 1.4.1"
+related:
+  url:
+    - https://github.com/basecamp/easymon/pull/25