bundler-audit 0.6.1 → 0.7.0.1

data/data/ruby-advisory-db/gems/echor/{OSVDB-102129.yml → CVE-2014-1834.yml}

@@ -2,7 +2,7 @@
 gem: echor
 cve: 2014-1834
 osvdb: 102129
-url: http://osvdb.org/show/osvdb/102129
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-1834
 title: echor Gem for Ruby backplane.rb perform_request Function Arbitrary Command Execution
 date: 2014-01-14
 description: |

data/data/ruby-advisory-db/gems/echor/{OSVDB-102130.yml → CVE-2014-1835.yml}

@@ -2,7 +2,7 @@
 gem: echor
 cve: 2014-1835
 osvdb: 102130
-url: http://osvdb.org/show/osvdb/102130
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-1835
 title: echor Gem for Ruby Process Listing Local Plaintext Credential Disclosure
 date: 2014-01-14
 description: |

data/data/ruby-advisory-db/gems/excon/CVE-2019-16779.yml

@@ -0,0 +1,23 @@
+---
+gem: excon
+cve: 2019-16779
+ghsa: q58g-455p-8vw9
+url: https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9
+date: 2019-12-16
+title: Race condition when using persistent connections
+description: |-
+  There was a race condition around persistent connections, where a connection
+  which is interrupted (such as by a timeout) would leave data on the socket.
+  Subsequent requests would then read this data, returning content from the
+  previous response. The race condition window appears to be short, and it
+  would be difficult to purposefully exploit this.
+
+  Users can workaround the problem by disabling persistent connections, though
+  this may cause performance implications.
+
+patched_versions:
+  - ">= 0.71.0"
+
+related:
+  url:
+   - https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29

data/data/ruby-advisory-db/gems/extlib/{OSVDB-90740.yml → CVE-2013-1802.yml}

@@ -2,7 +2,7 @@
 gem: extlib
 cve: 2013-1802
 osvdb: 90740
-url: http://osvdb.org/show/osvdb/90740
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1802
 title: extlib Gem for Ruby Type Casting Parameter Parsing Remote Code Execution 
 date: 2013-01-08
 

data/data/ruby-advisory-db/gems/fastreader/{OSVDB-91232.yml → CVE-2013-2615.yml}

@@ -2,7 +2,7 @@
 gem: fastreader
 cve: 2013-2615
 osvdb: 91232
-url: http://osvdb.org/show/osvdb/91232
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-2615
 title: fastreader Gem for Ruby URI Handling Arbitrary Command Injection 
 date: 2013-03-13
 description: |

data/data/ruby-advisory-db/gems/fat_free_crm/{OSVDB-101445.yml → CVE-2013-7222.yml}

@@ -2,7 +2,7 @@
 gem: fat_free_crm
 osvdb: 101445
 cve: 2013-7222
-url: http://osvdb.org/show/osvdb/101445
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-7222
 title: Fat Free CRM Gem for Ruby lack of support for cycling the Rails
   session secret
 date: 2013-12-24

data/data/ruby-advisory-db/gems/fat_free_crm/{OSVDB-101446.yml → CVE-2013-7223.yml}

@@ -2,7 +2,7 @@
 gem: fat_free_crm
 osvdb: 101446
 cve: 2013-7223
-url: http://osvdb.org/show/osvdb/101446
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-7223
 title: Fat Free CRM Gem for Ruby contains multiple cross-site request forgery
   (CSRF) vulnerabilities
 date: 2013-12-24

data/data/ruby-advisory-db/gems/fat_free_crm/{OSVDB-101447.yml → CVE-2013-7224.yml}

@@ -2,7 +2,7 @@
 gem: fat_free_crm
 osvdb: 101447
 cve: 2013-7224
-url: http://osvdb.org/show/osvdb/101447
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-7224
 title: Fat Free CRM Gem for Ruby allows remote attackers to obtain
   sensitive informations
 date: 2013-12-24

data/data/ruby-advisory-db/gems/fat_free_crm/{OSVDB-101448.yml → CVE-2013-7225.yml}

@@ -2,7 +2,7 @@
 gem: fat_free_crm
 osvdb: 101448
 cve: 2013-7225
-url: http://osvdb.org/show/osvdb/101448
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-7225
 title: Fat Free CRM Gem for Ruby allows remote attackers to inject or
   manipulate SQL queries
 date: 2013-12-24

data/data/ruby-advisory-db/gems/fat_free_crm/{OSVDB-101700.yml → CVE-2013-7249.yml}

@@ -2,7 +2,7 @@
 gem: fat_free_crm
 osvdb: 101700
 cve: 2013-7249
-url: http://osvdb.org/show/osvdb/101700
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-7249
 title: Fat Free CRM Gem for Ruby allows remote attackers to obtain
   sensitive informations
 date: 2013-12-24

data/data/ruby-advisory-db/gems/fat_free_crm/{OSVDB-110420.yml → CVE-2014-5441.yml}

@@ -2,7 +2,7 @@
 gem: fat_free_crm
 osvdb: 110420
 cve: 2014-5441
-url: http://osvdb.org/show/osvdb/110420
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-5441
 title: Fat Free CRM Gem contains a javascript cross-site scripting (XSS)
   vulnerability
 date: 2014-08-22

data/data/ruby-advisory-db/gems/fat_free_crm/{OSVDB-118465.yml → CVE-2015-1585.yml}

@@ -2,7 +2,7 @@
 gem: fat_free_crm
 osvdb: 118465
 cve: 2015-1585
-url: http://osvdb.org/show/osvdb/118465
+url: https://nvd.nist.gov/vuln/detail/CVE-2015-1585
 title: Fat Free CRM Gem being vulnerable to CSRF-type attacks
 date: 2015-02-16
 description: |

data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2018-1000842.yml

@@ -0,0 +1,23 @@
+---
+gem: fat_free_crm
+cve: 2018-1000842
+url: https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29
+date: 2018-10-27
+title: fat_free_crm gem XSS vulnerability via query parameter
+description: |
+  FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0
+  <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit
+  6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution.
+  This attack appear to be exploitable via Content with Javascript payload will be
+  executed on end user browsers when they visit the page. This vulnerability appears
+  to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2.
+
+cvss_v3: 6.1
+cvss_v2: 4.3
+
+patched_versions:
+  - ">= 0.18.1"
+  - ~> 0.17.3
+  - ~> 0.16.4
+  - ~> 0.15.2
+  - ~> 0.14.2

data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2018-20975.yml

@@ -0,0 +1,12 @@
+---
+gem: fat_free_crm
+cve: 2018-20975
+ghsa: 4p8f-mmfj-r45g
+url: https://github.com/fatfreecrm/fat_free_crm/commit/6d60bc8ed010c4eda05d6645c64849f415f68d65
+date: 2019-08-21
+title: fat_free_crm XSS via query parameter of tags_helper method
+description: |
+  Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.
+cvss_v3: 6.1
+patched_versions:
+- ">= 0.18.1"

data/data/ruby-advisory-db/gems/faye/CVE-2020-11020.yml

@@ -0,0 +1,91 @@
+---
+gem: faye
+cve: 2020-11020
+ghsa: qpg4-4w7w-2mq5
+url: https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5
+date: 2020-04-29
+title: Authentication and extension bypass in Faye
+description: |-
+  On 20 April 2020 it was reported to me that the potential for authentication
+  bypass exists in [Faye][1]'s extension system. This vulnerability has existed in
+  the Node.js and Ruby versions of the server since version 0.5.0, when extensions
+  were first introduced, in July 2010. It is patched in versions 1.0.4, 1.1.3 and
+  1.2.5, which we are releasing today.
+
+  The vulnerability allows any client to bypass checks put in place by server-side
+  extensions, by appending extra segments to the message channel. For example, the
+  Faye [extension docs][2] suggest that users implement access control for
+  subscriptions by checking incoming messages for the `/meta/subscribe` channel,
+  for example:
+
+  ```js
+  server.addExtension({
+    incoming: function(message, callback) {
+      if (message.channel === '/meta/subscribe') {
+        if (message.ext.authToken !== 'my super secret password') {
+          message.error = 'Invalid auth token';
+        }
+      }
+      callback(message);
+    }
+  });
+  ```
+
+  A bug in the server's code for recognising the special `/meta/*` channels, which
+  trigger connection and subscription events, means that a client can bypass this
+  check by sending a message to `/meta/subscribe/x` rather than `/meta/subscribe`:
+
+  ```json
+  {
+    "channel": "/meta/subscribe/x",
+    "clientId": "3jrc6602npj4gyp6bn5ap2wqzjtb2q3",
+    "subscription": "/foo"
+  }
+  ```
+
+  This message will not be checked by the above extension, as it checks the
+  message's channel is exactly equal to `/meta/subscribe`. But it will still be
+  processed as a subscription request by the server, so the client becomes
+  subscribed to the channel `/foo` without supplying the necessary credentials.
+
+  The vulnerability is caused by the way the Faye server recognises meta channels.
+  It will treat a message to any channel that's a prefix-match for one of the
+  special channels `/meta/handshake`, `/meta/connect`, `/meta/subscribe`,
+  `/meta/unsubscribe` or `/meta/disconnect`, as though it were an exact match for
+  that channel. So, a message to `/meta/subscribe/x` is still processed as a
+  subscription request, for example.
+
+  An authentication bypass for subscription requests is the most serious effect of
+  this but all other meta channels are susceptible to similar manipulation.
+
+  This parsing bug in the server is fixed in versions 1.0.4, 1.1.3 and 1.2.5.
+  These should be drop-in replacements for prior versions and you should upgrade
+  immediately if you are running any prior version.
+
+  If you are unable to install one of these versions, you can make your extensions
+  catch all messages the server would process by checking the channel _begins_
+  with the expected channel name, for example:
+
+  ```js
+  server.addExtension({
+    incoming: function(message, callback) {
+      if (message.channel.startsWith('/meta/subscribe')) {
+        // authentication logic
+      }
+      callback(message);
+    }
+  });
+  ```
+
+  [1]: https://faye.jcoglan.com/
+  [2]: https://faye.jcoglan.com/node/extensions.html
+
+cvss_v3: 8.5
+
+patched_versions:
+  - "~> 1.0.4"
+  - "~> 1.1.3"
+  - ">= 1.2.5"
+
+unaffected_versions:
+  - "< 0.5.0"

data/data/ruby-advisory-db/gems/features/{OSVDB-96975.yml → CVE-2013-4318.yml}

@@ -2,7 +2,7 @@
 gem: features
 cve: 2013-4318
 osvdb: 96975
-url: http://osvdb.org/show/osvdb/96975
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-4318
 title: Features Gem for Ruby /tmp/out.html Local XSS
 date: 2013-09-01
 description: Features Gem for Ruby contains a flaw that allows a local cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain input upon submission to /tmp/out.html. This may allow an attacker to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

data/data/ruby-advisory-db/gems/ffi/CVE-2018-1000201.yml

@@ -0,0 +1,22 @@
+---
+gem: ffi
+cve: 2018-1000201
+url: https://github.com/ffi/ffi/releases/tag/1.9.24
+title: ruby-ffi DDL loading issue on Windows OS
+date: 2018-06-22
+
+description: |
+  ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be
+  hijacked on Windows OS, when a Symbol is used as DLL name instead of a String
+  This vulnerability appears to have been fixed in v1.9.24 and later.
+
+cvss_v2: 6.8
+cvss_v3: 7.8
+
+patched_versions:
+  - ">= 1.9.24"
+
+related:
+  url:
+    - https://github.com/ffi/ffi/commit/09e0c6076466b4383da7fa4e13f714311109945a
+    - https://github.com/ffi/ffi/commit/e0fe486df0e117ed67b0282b6ada04b7214ca05c

data/data/ruby-advisory-db/gems/field_test/CVE-2019-13146.yml

@@ -0,0 +1,20 @@
+---
+gem: field_test
+cve: 2019-13146
+url: https://github.com/ankane/field_test/issues/17
+title: Arbitrary Variants Via Query Parameters
+date: 2019-07-01
+description: |
+  Due to unvalidated input, an attacker can pass in
+  arbitrary variants via query parameters.
+
+  If an application treats variants as trusted, this can
+  lead to potential vulnerabilities like SQL injection
+  or cross-site scripting (XSS). For instance:
+
+  landing_page = field_test(:landing_page)
+  Page.where("key = '#{landing_page}'")
+patched_versions:
+  - ">= 0.3.1"
+unaffected_versions:
+  - "< 0.3.0"

data/data/ruby-advisory-db/gems/fileutils/{OSVDB-90717.yml → CVE-2013-2516.yml}

@@ -1,8 +1,11 @@
---- 
+---
 gem: fileutils
 cve: 2013-2516
 osvdb: 90717
-url: http://osvdb.org/show/osvdb/90717
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-2516
 title: fileutils Gem for Ruby file_utils.rb Crafted URL Handling Remote Command Execution
 date: 2013-02-28
 description: fileutils Gem for Ruby contains a flaw in file_utils.rb. The issue is triggered when handling a specially crafted URL containing a command after a delimiter (;). This may allow a remote attacker to potentially execute arbitrary commands.
+
+patched_versions:
+  - '>= 0.7.1'

data/data/ruby-advisory-db/gems/flash_tool/{OSVDB-90829.yml → CVE-2013-2513.yml}

@@ -2,7 +2,7 @@
 gem: flash_tool
 cve: 2013-2513
 osvdb: 90829
-url: http://osvdb.org/show/osvdb/90829
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-2513
 title: flash_tool Gem for Ruby File Download Handling Arbitrary Command Execution
 date: 2013-03-04
 description: flash_tool Gem for Ruby contains a flaw that is triggered during the handling of downloaded files that contain shell characters. With a specially crafted file, a context-dependent attacker can execute arbitrary commands.

data/data/ruby-advisory-db/gems/fog-dragonfly/{OSVDB-90647.yml → CVE-2013-1756.yml}

@@ -2,7 +2,7 @@
 gem: fog-dragonfly
 cve: 2013-1756
 osvdb: 90647
-url: http://www.osvdb.org/show/osvdb/90647
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1756
 title: Dragonfly Gem for Ruby Crafted Request Parsing Remote Code Execution
 date: 2013-02-19
 description: |
@@ -14,3 +14,5 @@ description: |
 cvss_v2: 7.5
 unaffected_versions:
   - "< 0.7.0"
+patched_versions:
+  - ">= 0.9.14"

data/data/ruby-advisory-db/gems/fog-dragonfly/{OSVDB-96798.yml → CVE-2013-5671.yml}

@@ -2,7 +2,7 @@
 gem: fog-dragonfly
 cve: 2013-5671
 osvdb: 96798
-url: http://osvdb.org/show/osvdb/96798
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-5671
 title: fog-dragonfly Gem for Ruby imagemagickutils.rb Remote Command Execution
 date: 2013-09-03
 description: |

data/data/ruby-advisory-db/gems/ftpd/{OSVDB-90784.yml → CVE-2013-2512.yml}

@@ -2,7 +2,7 @@
 gem: ftpd
 cve: 2013-2512
 osvdb: 90784
-url: http://osvdb.org/show/osvdb/90784
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-2512
 title: ftpd Gem for Ruby Shell Character Handling Remote Command Injection
 date: 2013-02-28
 

data/data/ruby-advisory-db/gems/geminabox/CVE-2017-16792.yml

@@ -0,0 +1,21 @@
+---
+gem: geminabox
+cve: 2017-16792
+date: 2017-11-10
+url: https://github.com/geminabox/geminabox/blob/master/CHANGELOG.md#01310-2017-11-13
+title: Stored XSS in "geminabox" via injection in Gemspec "homepage" value
+description: |
+  Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem
+  in a Box) allows attackers to inject arbitrary web script via a crafted
+  JavaScript URL in the "homepage" value of a ".gemspec" file.
+
+  A ".gemspec" file must be created with a JavaScript URL in the homepage
+  value. This can be used to build a gem for upload to the Geminabox server,
+  in order to achieve stored XSS via the gem hyperlink.
+
+patched_versions:
+  - ">= 0.13.10"
+related:
+  url:
+    - https://github.com/geminabox/geminabox/commit/f8429a9e364658459add170e4ebc7a5d3b4759e7
+    - https://github.com/geminabox/geminabox/commit/e7e0b16147677e9029f0b55eff6bc6dda52398d4

data/data/ruby-advisory-db/gems/gemirro/CVE-2017-16833.yml

@@ -0,0 +1,22 @@
+---
+gem: gemirro
+cve: 2017-16833
+date: 2017-07-11
+url: https://github.com/PierreRambaud/gemirro/commit/9659f9b7ce15a723da8e361bd41b9203b19c97de
+title: Stored XSS in "gemirro" via injection in Gemspec "homepage" value
+description: |
+  Stored cross-site scripting (XSS) vulnerability in Gemirro allows
+  attackers to inject arbitrary web script via a crafted JavaScript URL
+  in the "homepage" value of a ".gemspec" file.
+
+  A ".gemspec" file must be created with a JavaScript URL in the homepage
+  value. This can be used to build a gem for upload to the Gemirro server,
+  in order to achieve stored XSS via the author name hyperlink.
+
+patched_versions:
+- ">= 0.15.0"
+related:
+  url:
+    - https://github.com/PierreRambaud/gemirro/commit/8acfb9ce9774128d535e2795d583242bb86d6ea8
+    - https://github.com/PierreRambaud/gemirro/commit/8fa709b121b7e18fceda308917d0fb68dc1479c3
+    - https://rubygems.org/gems/gemirro/versions/0.15.0

data/data/ruby-advisory-db/gems/gitlab-grit/{OSVDB-99370.yml → CVE-2013-4489.yml}

@@ -2,7 +2,7 @@
 gem: gitlab-grit
 cve: 2013-4489
 osvdb: 99370
-url: http://www.osvdb.org/show/osvdb/99370
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-4489
 title: GitLab Grit Gem for Ruby contains a flaw
 date: 2013-11-04
 description: GitLab Grit Gem for Ruby contains a flaw in the app/contexts/search_context.rb script.

data/data/ruby-advisory-db/gems/grape/CVE-2018-3769.yml

@@ -0,0 +1,20 @@
+---
+gem: grape
+cve: 2018-3769
+date: 2018-05-23
+url: https://github.com/ruby-grape/grape/issues/1762
+title: ruby-grape Gem has XSS via "format" parameter
+description: |
+  When request on API contains the "format" parameter in GET, the input
+  value of this parameter is rendered as the web-server responds with
+  text/html header.
+
+  Example:
+  http://example.com/api/endpoint?format=%3Cscript%3Ealert(document.cookie)%3C/script%3E
+
+patched_versions:
+  - ">= 1.1.0"
+related:
+  url:
+    - https://github.com/ruby-grape/grape/pull/1763
+    - https://github.com/ruby-grape/grape/commit/6876b71efc7b03f7ce1be3f075eaa4e7e6de19af