bundler-audit 0.6.1 → 0.9.0.1

data/data/ruby-advisory-db/Gemfile

@@ -1,9 +0,0 @@
-source 'https://rubygems.org'
-
-gem 'rspec'
-gem 'rake'
-
-group :development do
-  gem 'pry'
-  gem 'nokogiri'
-end

data/data/ruby-advisory-db/Gemfile.lock

@@ -1,40 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    coderay (1.1.1)
-    diff-lcs (1.2.5)
-    method_source (0.8.2)
-    mini_portile2 (2.0.0)
-    nokogiri (1.6.7.2)
-      mini_portile2 (~> 2.0.0.rc2)
-    pry (0.10.3)
-      coderay (~> 1.1.0)
-      method_source (~> 0.8.1)
-      slop (~> 3.4)
-    rake (11.0.1)
-    rspec (3.4.0)
-      rspec-core (~> 3.4.0)
-      rspec-expectations (~> 3.4.0)
-      rspec-mocks (~> 3.4.0)
-    rspec-core (3.4.4)
-      rspec-support (~> 3.4.0)
-    rspec-expectations (3.4.0)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.4.0)
-    rspec-mocks (3.4.1)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.4.0)
-    rspec-support (3.4.1)
-    slop (3.6.0)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  nokogiri
-  pry
-  rake
-  rspec
-
-BUNDLED WITH
-   1.11.2

data/data/ruby-advisory-db/LICENSE.txt

@@ -1,5 +0,0 @@
-If you submit code or data to the ruby-advisory-db that is copyrighted by yourself, upon submission you hereby agree to release it into the public domain.
-
-However, not all of the ruby-advisory-db can be considered public domain. The ruby-advisory-db may contain some information copyrighted by the Open Source Vulnerability Database (http://osvdb.org). If you use ruby-advisory-db data to build a product or a service, it is your responsibility to familiarize yourself with the terms of their license: http://www.osvdb.org/osvdb_license
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/data/ruby-advisory-db/README.md

@@ -1,99 +0,0 @@
-# Ruby Advisory Database
-
-The Ruby Advisory Database is a community effort to compile all security advisories that are relevant to Ruby libraries.
-
-You can check your own Gemfile.locks against this database by using [bundler-audit](https://github.com/rubysec/bundler-audit).
-
-## Support Ruby security!
-
-Do you know about a vulnerability that isn't listed in this database? Open an issue, submit a PR, or [use this form](https://rubysec.com/advisories/new) which will email the maintainers.
-
-## Directory Structure
-
-The database is a list of directories that match the names of Ruby libraries on
-[rubygems.org]. Within each directory are one or more advisory files
-for the Ruby library. These advisory files are named using
-the advisories' [CVE] identifier number.
-
-    gems/:
-      actionpack/:
-        CVE-2014-0130.yml  CVE-2014-7818.yml  CVE-2014-7829.yml  CVE-2015-7576.yml
-        CVE-2015-7581.yml  CVE-2016-0751.yml  CVE-2016-0752.yml
-
-## Format
-
-Each advisory file contains the advisory information in [YAML] format:
-
-    ---
-    gem: examplegem
-    cve: 2013-0156
-    url: https://github.com/rubysec/ruby-advisory-db/issues/123456
-    title: |
-      Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing
-      Remote Code Execution
-
-    description: |
-      Ruby on Rails contains a flaw in params_parser.rb of the Action Pack.
-      The issue is triggered when a type casting error occurs during the parsing
-      of parameters. This may allow a remote attacker to potentially execute
-      arbitrary code.
-
-    cvss_v2: 10.0
-
-    patched_versions:
-      - ~> 2.3.15
-      - ~> 3.0.19
-      - ~> 3.1.10
-      - ">= 3.2.11"
-    unaffected_versions:
-      - ~> 2.4.3
-
-    related:
-      cve:
-        - 2013-1234567
-        - 2013-1234568
-      url:
-        - https://github.com/rubysec/ruby-advisory-db/issues/123457
-
-
-### Schema
-
-* `gem` \[String\]: Name of the affected gem.
-* `framework` \[String\] (optional): Name of framework gem belongs to.
-* `platform` \[String\] (optional): If this vulnerability is platform-specific, name of platform this vulnerability affects (e.g. JRuby)
-* `cve` \[String\]: CVE id.
-* `osvdb` \[Integer\]: OSVDB id.
-* `url` \[String\]: The URL to the full advisory.
-* `title` \[String\]: The title of the advisory.
-* `date` \[Date\]: Disclosure date of the advisory.
-* `description` \[String\]: Multi-paragraph description of the vulnerability.
-* `cvss_v2` \[Float\]: The [CVSSv2] score for the vulnerability.
-* `cvss_v3` \[Float\]: The [CVSSv3] score for the vulnerability.
-* `unaffected_versions` \[Array\<String\>\] (optional): The version requirements for the
-  unaffected versions of the Ruby library.
-* `patched_versions` \[Array\<String\>\]: The version requirements for the
-  patched versions of the Ruby library.
-* `related` \[Hash\<Array\<String\>\>\]: Sometimes an advisory references many urls and cves. Supported keys: `cve` and `url`
-
-### Tests
-Prior to submitting a pull request, run the tests:
-
-```
-bundle install
-bundle exec rspec
-```
-
-## Credits
-
-Please see [CONTRIBUTORS.md].
-
-This database also includes data from the [Open Source Vulnerability Database][OSVDB]
-developed by the Open Security Foundation (OSF) and its contributors.
-
-[rubygems.org]: https://rubygems.org/
-[CVE]: http://cve.mitre.org/
-[OSVDB]: http://www.osvdb.org/
-[CVSSv2]: https://www.first.org/cvss/v2/guide
-[CVSSv3]: https://www.first.org/cvss/user-guide
-[YAML]: http://www.yaml.org/
-[CONTRIBUTORS.md]: https://github.com/rubysec/ruby-advisory-db/blob/master/CONTRIBUTORS.md

data/data/ruby-advisory-db/Rakefile

@@ -1,26 +0,0 @@
-require 'yaml'
-
-namespace :lint do
-  begin
-    require 'rspec/core/rake_task'
-
-    RSpec::Core::RakeTask.new(:yaml)
-  rescue LoadError => e
-    task :spec do
-      abort "Please run `gem install rspec` to install RSpec."
-    end
-  end
-
-  task :cve do
-    Dir.glob('{gems,libraries,rubies}/*/*.yml') do |path|
-      advisory = YAML.load_file(path)
-
-      unless advisory['cve']
-        puts "Missing CVE: #{path}"
-      end
-    end
-  end
-end
-
-task :lint    => ['lint:yaml', 'lint:cve']
-task :default => :lint

data/data/ruby-advisory-db/gems/Arabic-Prawn/OSVDB-104365.yml

@@ -1,12 +0,0 @@
----
-gem: Arabic-Prawn
-cve: 2014-2322
-osvdb: 104365
-url: http://osvdb.org/show/osvdb/104365
-title: Arabic Prawn Gem for Ruby lib/string_utf_support.rb User Input Handling Remote Command Injection
-date: 2014-03-10
-description: |
-  Arabic Prawn Gem for Ruby contains a flaw in the lib/string_utf_support.rb
-  file. The issue is due to the program failing to sanitize user input. This may
-  allow a remote attacker to inject arbitrary commands.
-cvss_v2: 7.5

data/data/ruby-advisory-db/gems/RedCloth/CVE-2012-6684.yml

@@ -1,21 +0,0 @@
----
-gem: RedCloth
-cve: 2012-6684
-osvdb: 115941
-url: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6684
-title: RedCloth Gem for Ruby Textile Link Parsing XSS
-date: 2012-02-29
-description: |
-  RedCloth Gem for Ruby contains a flaw that allows a cross-site scripting (XSS)
-  attack. This flaw exists because the program does not validate input when
-  parsing textile links before returning it to users. This may allow a remote
-  attacker to create a specially crafted request that would execute arbitrary
-  script code in a user's browser session within the trust relationship between
-  their browser and the server.
-cvss_v2: 4.3
-patched_versions:
-  - ">= 4.3.0"
-related:
-  url:
-    - https://github.com/jgarber/redcloth/commit/2f6dab4d6aea5cee778d2f37a135637fe3f1573c
-    - http://co3k.org/blog/redcloth-unfixed-xss-en

data/data/ruby-advisory-db/gems/VladTheEnterprising/CVE-2014-4995.yml

@@ -1,13 +0,0 @@
----
-gem: VladTheEnterprising
-cve: 2014-4995
-osvdb: 108728
-url: http://www.osvdb.org/show/osvdb/108728
-title: VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} Symlink Multiple Impact
-date: 2014-06-30
-description: |
-  VladTheEnterprising Gem for Ruby contains a flaw as the program creates
-  temporary files insecurely. It is possible for a local attacker to use
-  a symlink attack against the /tmp/my.cnf.#{target_host} file they can
-  overwrite arbitrary files, gain access to the MySQL root password,
-  or inject arbitrary commands.

data/data/ruby-advisory-db/gems/VladTheEnterprising/CVE-2014-4996.yml

@@ -1,13 +0,0 @@
----
-gem: VladTheEnterprising
-cve: 2014-4996
-osvdb: 108728
-url: http://www.osvdb.org/show/osvdb/108728
-title: VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} Symlink Multiple Impact 
-date: 2014-06-30
-description: |
-  VladTheEnterprising Gem for Ruby contains a flaw as the program creates
-  temporary files insecurely. It is possible for a local attacker to use
-  a symlink attack against the /tmp/my.cnf.#{target_host} file they can
-  overwrite arbitrary files, gain access to the MySQL root password,
-  or inject arbitrary commands.

data/data/ruby-advisory-db/gems/actionmailer/OSVDB-98629.yml

@@ -1,17 +0,0 @@
----
-gem: actionmailer
-cve: 2013-4389
-osvdb: 98629
-url: http://www.osvdb.org/show/osvdb/98629
-title: Action Mailer Gem for Ruby contains a possible DoS Vulnerability
-date: 2013-10-16
-description: Action Mailer Gem for Ruby contains a format string flaw in
-  the Log Subscriber component. The issue is triggered as format string
-  specifiers (e.g. %s and %x) are not properly sanitized in user-supplied
-  input when handling email addresses. This may allow a remote attacker
-  to cause a denial of service
-cvss_v2: 4.3
-unaffected_versions:
-  - ~> 2.3.2
-patched_versions: 
-  - '>= 3.2.15'

data/data/ruby-advisory-db/gems/actionpack/CVE-2014-0130.yml

@@ -1,23 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2014-0130
-url: https://groups.google.com/forum/#!topic/rubyonrails-security/NkKc7vTW70o
-title: Directory Traversal Vulnerability With Certain Route Configurations
-date: 2014-05-06
-
-description: |
-  There is a vulnerability in the 'implicit render'
-  functionality in Ruby on Rails.The implicit render functionality
-  allows controllers to render a template, even if there is no
-  explicit action with the corresponding name.  This module does not
-  perform adequate input sanitization which could allow an attacker to
-  use a specially crafted request to retrieve arbitrary files from the
-  rails application server.
-
-cvss_v2: 4.3
-
-patched_versions:
-  - ~> 3.2.18
-  - ~> 4.0.5
-  - ">= 4.1.1"

data/data/ruby-advisory-db/gems/actionpack/CVE-2014-7818.yml

@@ -1,24 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2014-7818
-url: https://groups.google.com/forum/#!topic/rubyonrails-security/dCp7duBiQgo
-title: Arbitrary file existence disclosure in Action Pack
-date: 2014-10-30
-
-description: |
-  Specially crafted requests can be used to determine whether a file exists on
-  the filesystem that is outside the Rails application's root directory.  The
-  files will not be served, but attackers can determine whether or not the file
-  exists.
-
-cvss_v2: 4.3
-
-unaffected_versions:
-  - "< 3.0.0"
-
-patched_versions:
-  - ~> 3.2.20
-  - ~> 4.0.11
-  - ~> 4.1.7
-  - ">= 4.2.0.beta3"

data/data/ruby-advisory-db/gems/actionpack/CVE-2014-7829.yml

@@ -1,26 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2014-7829
-url: https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRCGk
-title: Arbitrary file existence disclosure in Action Pack
-date: 2014-11-17
-
-description: |
-  Specially crafted requests can be used to determine whether a file exists on
-  the filesystem that is outside the Rails application's root directory.  The
-  files will not be served, but attackers can determine whether or not the file
-  exists.  This vulnerability is very similar to CVE-2014-7818, but the
-  specially crafted string is slightly different.
-
-cvss_v2: 5.0
-
-unaffected_versions:
-  - "< 3.0.0"
-
-patched_versions:
-  - ~> 3.2.21
-  - ~> 4.0.11.1
-  - ~> 4.0.12
-  - ~> 4.1.7.1
-  - ">= 4.1.8"

data/data/ruby-advisory-db/gems/actionpack/CVE-2015-7576.yml

@@ -1,116 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2015-7576
-date: 2016-01-25
-url: "https://groups.google.com/forum/#!topic/rubyonrails-security/ANv0HDHEC3k"
-
-title: Timing attack vulnerability in basic authentication in Action Controller.
-
-description: |
-    There is a timing attack vulnerability in the basic authentication support
-    in Action Controller. This vulnerability has been assigned the CVE
-    identifier CVE-2015-7576.
-
-    Versions Affected:  All.
-    Not affected:       None.
-    Fixed Versions:     5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1
-
-    Impact
-    ------
-    Due to the way that Action Controller compares user names and passwords in
-    basic authentication authorization code, it is possible for an attacker to
-    analyze the time taken by a response and intuit the password.
-
-    For example, this string comparison:
-
-      "foo" == "bar"
-
-    is possibly faster than this comparison:
-
-      "foo" == "fo1"
-
-    Attackers can use this information to attempt to guess the username and
-    password used in the basic authentication system.
-
-    You can tell you application is vulnerable to this attack by looking for
-    `http_basic_authenticate_with` method calls in your application.
-
-    All users running an affected release should either upgrade or use one of
-    the workarounds immediately.
-
-    Releases
-    --------
-    The FIXED releases are available at the normal locations.
-
-    Workarounds
-    -----------
-    If you can't upgrade, please use the following monkey patch in an initializer
-    that is loaded before your application:
-
-    ```
-    $ cat config/initializers/basic_auth_fix.rb
-    module ActiveSupport
-      module SecurityUtils
-        def secure_compare(a, b)
-          return false unless a.bytesize == b.bytesize
-
-          l = a.unpack "C#{a.bytesize}"
-
-          res = 0
-          b.each_byte { |byte| res |= byte ^ l.shift }
-          res == 0
-        end
-        module_function :secure_compare
-
-        def variable_size_secure_compare(a, b)
-          secure_compare(::Digest::SHA256.hexdigest(a), ::Digest::SHA256.hexdigest(b))
-        end
-        module_function :variable_size_secure_compare
-      end
-    end
-
-    module ActionController
-      class Base
-        def self.http_basic_authenticate_with(options = {})
-          before_action(options.except(:name, :password, :realm)) do
-            authenticate_or_request_with_http_basic(options[:realm] || "Application") do |name, password|
-              # This comparison uses & so that it doesn't short circuit and
-              # uses `variable_size_secure_compare` so that length information
-              # isn't leaked.
-              ActiveSupport::SecurityUtils.variable_size_secure_compare(name, options[:name]) &
-                ActiveSupport::SecurityUtils.variable_size_secure_compare(password, options[:password])
-            end
-          end
-        end
-      end
-    end
-    ```
-
-
-    Patches
-    -------
-    To aid users who aren't able to upgrade immediately we have provided patches for
-    the two supported release series. They are in git-am format and consist of a
-    single changeset.
-
-    * 4-1-basic_auth.patch - Patch for 4.1 series
-    * 4-2-basic_auth.patch - Patch for 4.2 series
-    * 5-0-basic_auth.patch - Patch for 5.0 series
-
-    Please note that only the 4.1.x and 4.2.x series are supported at present. Users
-    of earlier unsupported releases are advised to upgrade as soon as possible as we
-    cannot guarantee the continued availability of security fixes for unsupported
-    releases.
-
-    Credits
-    -------
-
-    Thank you to Daniel Waterworth for reporting the problem and working with us to
-    fix it.
-
-patched_versions:
-  - ">= 5.0.0.beta1.1"
-  - "~> 4.2.5, >= 4.2.5.1"
-  - "~> 4.1.14, >= 4.1.14.1"
-  - "~> 3.2.22.1"

data/data/ruby-advisory-db/gems/actionpack/CVE-2015-7581.yml

@@ -1,55 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2015-7581
-date: 2016-01-25
-url: "https://groups.google.com/forum/#!topic/rubyonrails-security/dthJ5wL69JE"
-
-title: Object leak vulnerability for wildcard controller routes in Action Pack
-
-description: |
-  There is an object leak vulnerability for wildcard controllers in Action Pack. 
-  This vulnerability has been assigned the CVE identifier CVE-2015-7581. 
-
-  Versions Affected:  >= 4.0.0 and < 5.0.0.beta1 
-  Not affected:       < 4.0.0, 5.0.0.beta1 and newer 
-  Fixed Versions:     4.2.5.1, 4.1.14.1 
-
-  Impact 
-  ------ 
-  Users that have a route that contains the string ":controller" are susceptible 
-  to objects being leaked globally which can lead to unbounded memory growth. 
-  To identify if your application is vulnerable, look for routes that contain 
-  ":controller". 
-
-  Internally, Action Pack keeps a map of "url controller name" to "controller 
-  class name".  This map is cached globally, and is populated even if the 
-  controller class doesn't actually exist. 
-
-  All users running an affected release should either upgrade or use one of the 
-  workarounds immediately. 
-
-  Releases 
-  -------- 
-  The FIXED releases are available at the normal locations. 
-
-  Workarounds 
-  ----------- 
-  There are no feasible workarounds for this issue. 
-
-  Patches 
-  ------- 
-  To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series.  They are in git-am format and consist of a single changeset. 
-
-  * 4-1-wildcard_route.patch - Patch for 4.1 series 
-  * 4-2-wildcard_route.patch - Patch for 4.2 series 
-
-  Please note that only the 4.1.x and 4.2.x series are supported at present.  Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
-
-unaffected_versions:
-  - "< 4.0.0"
-  - ">= 5.0.0.beta1"
-
-patched_versions:
-  - "~> 4.2.5, >= 4.2.5.1"
-  - "~> 4.1.14, >= 4.1.14.1"

data/data/ruby-advisory-db/gems/actionpack/CVE-2016-0751.yml

@@ -1,71 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2016-0751
-date: 2016-01-25
-url: "https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc"
-
-title: Possible Object Leak and Denial of Service attack in Action Pack
-
-description: |
-  There is a possible object leak which can lead to a denial of service
-  vulnerability in Action Pack. This vulnerability has been
-  assigned the CVE identifier CVE-2016-0751.
-
-  Versions Affected:  All.
-  Not affected:       None.
-  Fixed Versions:     5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1
-
-  Impact
-  ------
-  A carefully crafted accept header can cause a global cache of mime types to
-  grow indefinitely which can lead to a possible denial of service attack in
-  Action Pack.
-
-  All users running an affected release should either upgrade or use one of the
-  workarounds immediately.
-
-  Releases
-  --------
-  The FIXED releases are available at the normal locations.
-
-  Workarounds
-  -----------
-  This attack can be mitigated by a proxy that only allows known mime types in
-  the Accept header.
-
-  Placing the following code in an initializer will also mitigate the issue:
-
-  ```ruby
-  require 'action_dispatch/http/mime_type'
-
-  Mime.const_set :LOOKUP, Hash.new { |h,k|
-    Mime::Type.new(k) unless k.blank?
-  }
-  ```
-
-  Patches
-  -------
-  To aid users who aren't able to upgrade immediately we have provided patches for
-  the two supported release series. They are in git-am format and consist of a
-  single changeset.
-
-  * 5-0-mime_types_leak.patch - Patch for 5.0 series
-  * 4-2-mime_types_leak.patch - Patch for 4.2 series
-  * 4-1-mime_types_leak.patch - Patch for 4.1 series
-  * 3-2-mime_types_leak.patch - Patch for 3.2 series
-
-  Please note that only the 4.1.x and 4.2.x series are supported at present. Users
-  of earlier unsupported releases are advised to upgrade as soon as possible as we
-  cannot guarantee the continued availability of security fixes for unsupported
-  releases.
-
-  Credits
-  -------
-  Aaron Patterson <3<3
-
-patched_versions:
-  - ">= 5.0.0.beta1.1"
-  - "~> 4.2.5, >= 4.2.5.1"
-  - "~> 4.1.14, >= 4.1.14.1"
-  - "~> 3.2.22.1"

data/data/ruby-advisory-db/gems/actionpack/CVE-2016-0752.yml

@@ -1,96 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2016-0752
-date: 2016-01-25
-url: "https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00"
-
-title: Possible Information Leak Vulnerability in Action View
-description: |
-  There is a possible directory traversal and information leak vulnerability in
-  Action View. This vulnerability has been assigned the CVE identifier
-  CVE-2016-0752.
-
-  Versions Affected:  All.
-  Not affected:       None.
-  Fixed Versions:     5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1
-
-  Impact
-  ------
-  Applications that pass unverified user input to the `render` method in a
-  controller may be vulnerable to an information leak vulnerability.
-
-  Impacted code will look something like this:
-
-  ```ruby
-  def index
-    render params[:id]
-  end
-  ```
-
-  Carefully crafted requests can cause the above code to render files from
-  unexpected places like outside the application's view directory, and can
-  possibly escalate this to a remote code execution attack.
-
-  All users running an affected release should either upgrade or use one of the
-  workarounds immediately.
-
-  Releases
-  --------
-  The FIXED releases are available at the normal locations.
-
-  Workarounds
-  -----------
-  A workaround to this issue is to not pass arbitrary user input to the `render`
-  method.  Instead, verify that data before passing it to the `render` method.
-
-  For example, change this:
-
-  ```ruby
-  def index
-    render params[:id]
-  end
-  ```
-
-  To this:
-
-  ```ruby
-  def index
-    render verify_template(params[:id])
-  end
-
-  private
-  def verify_template(name)
-    # add verification logic particular to your application here
-  end
-  ```
-
-  Patches
-  -------
-  To aid users who aren't able to upgrade immediately we have provided patches for
-  the two supported release series. They are in git-am format and consist of a
-  single changeset.
-
-  * 3-2-render_data_leak.patch - Patch for 3.2 series
-  * 4-1-render_data_leak.patch - Patch for 4.1 series
-  * 4-2-render_data_leak.patch - Patch for 4.2 series
-  * 5-0-render_data_leak.patch - Patch for 5.0 series
-
-  Please note that only the 4.1.x and 4.2.x series are supported at present. Users
-  of earlier unsupported releases are advised to upgrade as soon as possible as we
-  cannot guarantee the continued availability of security fixes for unsupported
-  releases.
-
-  Credits
-  -------
-  Thanks John Poulin for reporting this!
-
-unaffected_versions:
-  # Newer versions are affected, but tracked in the actionview gem.
-  - ">= 4.1.0"
-
-patched_versions:
-  - ">= 5.0.0.beta1.1"
-  - "~> 4.2.5, >= 4.2.5.1"
-  - "~> 4.1.14, >= 4.1.14.1"
-  - "~> 3.2.22.1"