bundler-audit 0.7.0.1 → 0.8.0.rc1

data/data/ruby-advisory-db/gems/actionpack/CVE-2016-0751.yml

@@ -1,74 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2016-0751
-date: 2016-01-25
-url: "https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc"
-
-title: Possible Object Leak and Denial of Service attack in Action Pack
-
-description: |
-  There is a possible object leak which can lead to a denial of service
-  vulnerability in Action Pack. This vulnerability has been
-  assigned the CVE identifier CVE-2016-0751.
-
-  Versions Affected:  All.
-  Not affected:       None.
-  Fixed Versions:     5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1
-
-  Impact
-  ------
-  A carefully crafted accept header can cause a global cache of mime types to
-  grow indefinitely which can lead to a possible denial of service attack in
-  Action Pack.
-
-  All users running an affected release should either upgrade or use one of the
-  workarounds immediately.
-
-  Releases
-  --------
-  The FIXED releases are available at the normal locations.
-
-  Workarounds
-  -----------
-  This attack can be mitigated by a proxy that only allows known mime types in
-  the Accept header.
-
-  Placing the following code in an initializer will also mitigate the issue:
-
-  ```ruby
-  require 'action_dispatch/http/mime_type'
-
-  Mime.const_set :LOOKUP, Hash.new { |h,k|
-    Mime::Type.new(k) unless k.blank?
-  }
-  ```
-
-  Patches
-  -------
-  To aid users who aren't able to upgrade immediately we have provided patches for
-  the two supported release series. They are in git-am format and consist of a
-  single changeset.
-
-  * 5-0-mime_types_leak.patch - Patch for 5.0 series
-  * 4-2-mime_types_leak.patch - Patch for 4.2 series
-  * 4-1-mime_types_leak.patch - Patch for 4.1 series
-  * 3-2-mime_types_leak.patch - Patch for 3.2 series
-
-  Please note that only the 4.1.x and 4.2.x series are supported at present. Users
-  of earlier unsupported releases are advised to upgrade as soon as possible as we
-  cannot guarantee the continued availability of security fixes for unsupported
-  releases.
-
-  Credits
-  -------
-  Aaron Patterson <3<3
-
-cvss_v2: 5.0
-cvss_v3: 7.5
-
-patched_versions:
-  - ">= 5.0.0.beta1.1"
-  - "~> 4.2.5, >= 4.2.5.1"
-  - "~> 4.1.14, >= 4.1.14.1"
-  - "~> 3.2.22.1"

data/data/ruby-advisory-db/gems/actionpack/CVE-2016-0752.yml

@@ -1,96 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2016-0752
-date: 2016-01-25
-url: "https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00"
-
-title: Possible Information Leak Vulnerability in Action View
-description: |
-  There is a possible directory traversal and information leak vulnerability in
-  Action View. This vulnerability has been assigned the CVE identifier
-  CVE-2016-0752.
-
-  Versions Affected:  All.
-  Not affected:       None.
-  Fixed Versions:     5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1
-
-  Impact
-  ------
-  Applications that pass unverified user input to the `render` method in a
-  controller may be vulnerable to an information leak vulnerability.
-
-  Impacted code will look something like this:
-
-  ```ruby
-  def index
-    render params[:id]
-  end
-  ```
-
-  Carefully crafted requests can cause the above code to render files from
-  unexpected places like outside the application's view directory, and can
-  possibly escalate this to a remote code execution attack.
-
-  All users running an affected release should either upgrade or use one of the
-  workarounds immediately.
-
-  Releases
-  --------
-  The FIXED releases are available at the normal locations.
-
-  Workarounds
-  -----------
-  A workaround to this issue is to not pass arbitrary user input to the `render`
-  method.  Instead, verify that data before passing it to the `render` method.
-
-  For example, change this:
-
-  ```ruby
-  def index
-    render params[:id]
-  end
-  ```
-
-  To this:
-
-  ```ruby
-  def index
-    render verify_template(params[:id])
-  end
-
-  private
-  def verify_template(name)
-    # add verification logic particular to your application here
-  end
-  ```
-
-  Patches
-  -------
-  To aid users who aren't able to upgrade immediately we have provided patches for
-  the two supported release series. They are in git-am format and consist of a
-  single changeset.
-
-  * 3-2-render_data_leak.patch - Patch for 3.2 series
-  * 4-1-render_data_leak.patch - Patch for 4.1 series
-  * 4-2-render_data_leak.patch - Patch for 4.2 series
-  * 5-0-render_data_leak.patch - Patch for 5.0 series
-
-  Please note that only the 4.1.x and 4.2.x series are supported at present. Users
-  of earlier unsupported releases are advised to upgrade as soon as possible as we
-  cannot guarantee the continued availability of security fixes for unsupported
-  releases.
-
-  Credits
-  -------
-  Thanks John Poulin for reporting this!
-
-unaffected_versions:
-  # Newer versions are affected, but tracked in the actionview gem.
-  - ">= 4.1.0"
-
-patched_versions:
-  - ">= 5.0.0.beta1.1"
-  - "~> 4.2.5, >= 4.2.5.1"
-  - "~> 4.1.14, >= 4.1.14.1"
-  - "~> 3.2.22.1"

data/data/ruby-advisory-db/gems/actionpack/CVE-2016-2097.yml

@@ -1,91 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2016-2097
-date: 2016-02-29
-url: "https://groups.google.com/forum/#!topic/rubyonrails-security/ddY6HgqB2z4"
-
-title: Possible Information Leak Vulnerability in Action View
-
-description: |
-
-  There is a possible directory traversal and information leak vulnerability 
-  in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 
-  patch was not covering all the scenarios. This vulnerability has been 
-  assigned the CVE identifier CVE-2016-2097.
-
-  Versions Affected:  3.2.x, 4.0.x, 4.1.x
-  Not affected:       4.2+
-  Fixed Versions:     3.2.22.2, 4.1.14.2
-
-  Impact 
-  ------ 
-  Applications that pass unverified user input to the `render` method in a
-  controller may be vulnerable to an information leak vulnerability.
-
-  Impacted code will look something like this:
-
-  ```ruby
-  def index
-    render params[:id]
-  end
-  ```
-
-  Carefully crafted requests can cause the above code to render files from
-  unexpected places like outside the application's view directory, and can
-  possibly escalate this to a remote code execution attack.
-
-  All users running an affected release should either upgrade or use one of the
-  workarounds immediately.
-
-  Releases 
-  -------- 
-  The FIXED releases are available at the normal locations. 
-
-  Workarounds 
-  ----------- 
-  A workaround to this issue is to not pass arbitrary user input to the `render`
-  method. Instead, verify that data before passing it to the `render` method.
-
-  For example, change this:
-
-  ```ruby
-  def index
-    render params[:id]
-  end
-  ```
-
-  To this:
-
-  ```ruby
-  def index
-    render verify_template(params[:id])
-  end
-
-  private
-  def verify_template(name)
-    # add verification logic particular to your application here
-  end
-  ```
-
-  Patches 
-  ------- 
-  To aid users who aren't able to upgrade immediately we have provided patches 
-  for it. It is in git-am format and consist of a single changeset.
-
-  * 3-2-render_data_leak_2.patch - Patch for 3.2 series
-  * 4-1-render_data_leak_2.patch - Patch for 4.1 series
-
-  Credits 
-  ------- 
-  Thanks to both Jyoti Singh and Tobias Kraze from makandra for reporting this 
-  and working with us in the patch!
-
-unaffected_versions:
-  # Newer versions are affected, but tracked in the actionview gem.
-  - ">= 4.1.0"
-
-patched_versions:
-  - "~> 3.2.22.2"
-  - "~> 4.1.14"
-  - ">= 4.1.14.2"

data/data/ruby-advisory-db/gems/actionpack/CVE-2016-2098.yml

@@ -1,89 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2016-2098
-date: 2016-02-29
-url: "https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q"
-
-title: Possible remote code execution vulnerability in Action Pack
-
-description: |
-  There is a possible remote code execution vulnerability in Action Pack.
-  This vulnerability has been assigned the CVE identifier CVE-2016-2098.
-
-  Versions Affected:  3.2.x, 4.0.x, 4.1.x, 4.2.x
-  Not affected:       5.0+
-  Fixed Versions:     3.2.22.2, 4.1.14.2, 4.2.5.2
-
-  Impact 
-  ------ 
-  Applications that pass unverified user input to the `render` method in a
-  controller or a view may be vulnerable to a code injection.
-
-  Impacted code will look like this:
-
-  ```ruby
-  class TestController < ApplicationController
-    def show
-      render params[:id]
-    end
-  end
-  ```
-
-  An attacker could use the request parameters to coerce the above example
-  to execute arbitrary ruby code.
-
-  All users running an affected release should either upgrade or use one of 
-  the workarounds immediately.
-
-  Releases 
-  -------- 
-  The FIXED releases are available at the normal locations.
-
-  Workarounds 
-  ----------- 
-  A workaround to this issue is to not pass arbitrary user input to the `render`
-  method. Instead, verify that data before passing it to the `render` method.
-
-  For example, change this:
-
-  ```ruby
-  def index
-    render params[:id]
-  end
-  ```
-
-  To this:
-
-  ```ruby
-  def index
-    render verify_template(params[:id])
-  end
-
-  private
-  def verify_template(name)
-    # add verification logic particular to your application here
-  end
-  ```
-
-  Patches 
-  ------- 
-  To aid users who aren't able to upgrade immediately we have provided a 
-  patch for it. It is in git-am format and consist of a single changeset.
-
-  * 3-2-secure_inline_with_params.patch - Patch for 3.2 series
-  * 4-1-secure_inline_with_params.patch - Patch for 4.1 series
-  * 4-2-secure_inline_with_params.patch - Patch for 4.2 series
-
-  Credits 
-  ------- 
-  Thanks to both Tobias Kraze from makandra and joernchen of Phenoelit for 
-  reporting this!
-
-unaffected_versions:
-  - ">= 5.0.0.beta1"
-
-patched_versions:
-  - "~> 3.2.22.2"
-  - "~> 4.2.5, >= 4.2.5.2"
-  - "~> 4.1.14, >= 4.1.14.2"

data/data/ruby-advisory-db/gems/actionpack/CVE-2016-6316.yml

@@ -1,57 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2016-6316
-date: 2016-08-11
-url: https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk
-
-title: Possible XSS Vulnerability in Action View
-
-description: |
-  There is a possible XSS vulnerability in Action View.  Text declared as "HTML
-  safe" will not have quotes escaped when used as attribute values in tag
-  helpers.
-
-  Impact
-  ------
-
-  Text declared as "HTML safe" when passed as an attribute value to a tag helper
-  will not have quotes escaped which can lead to an XSS attack.  Impacted code
-  looks something like this:
-
-  ```ruby
-  content_tag(:div, "hi", title: user_input.html_safe)
-  ```
-
-  Some helpers like the `sanitize` helper will automatically mark strings as
-  "HTML safe", so impacted code could also look something like this:
-
-  ```ruby
-  content_tag(:div, "hi", title: sanitize(user_input))
-  ```
-
-  All users running an affected release should either upgrade or use one of the
-  workarounds immediately.
-
-  Workarounds
-  -----------
-  You can work around this issue by either *not* marking arbitrary user input as
-  safe, or by manually escaping quotes like this:
-
-  ```ruby
-  def escape_quotes(value)
-    value.gsub(/"/, '"'.freeze)
-  end
-
-  content_tag(:div, "hi", title: escape_quotes(sanitize(user_input)))
-  ```
-
-unaffected_versions:
-  - "< 3.0.0"
-  # Newer versions are affected, but tracked in the actionview gem.
-  - ">= 4.1.0"
-
-patched_versions:
-  - ~> 3.2.22.3
-  - ~> 4.2.7.1
-  - ">= 5.0.0.1"

data/data/ruby-advisory-db/gems/actionpack/CVE-2020-8164.yml

@@ -1,49 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2020-8164
-date: 2020-05-18
-url: https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY
-title: Possible Strong Parameters Bypass in ActionPack
-description: |
-  There is a strong parameters bypass vector in ActionPack.
-
-  Versions Affected:  rails <= 6.0.3
-  Not affected:       rails < 4.0.0
-  Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1
-
-  Impact
-  ------
-  In some cases user supplied information can be inadvertently leaked from
-  Strong Parameters.  Specifically the return value of `each`, or `each_value`,
-  or `each_pair` will return the underlying "untrusted" hash of data that was
-  read from the parameters.  Applications that use this return value may be
-  inadvertently use untrusted user input.
-
-  Impacted code will look something like this:
-
-  ```
-  def update
-    # Attacker has included the parameter: `{ is_admin: true }`
-    User.update(clean_up_params)
-  end
-
-  def clean_up_params
-     params.each { |k, v|  SomeModel.check(v) if k == :name }
-  end
-  ```
-
-  Note the mistaken use of `each` in the `clean_up_params` method in the above
-  example.
-
-  Workarounds
-  -----------
-  Do not use the return values of `each`, `each_value`, or `each_pair` in your
-  application.
-
-unaffected_versions:
-  - "< 4.0.0"
-
-patched_versions:
-  - "~> 5.2.4.3"
-  - ">= 6.0.3.1"