bundler-audit 0.7.0.1 → 0.8.0.rc1

data/data/ruby-advisory-db/gems/handlebars-source/OSVDB-131671.yml

@@ -1,17 +0,0 @@
----
-gem: handlebars-source
-osvdb: 131671
-url: https://blog.srcclr.com/handlebars_vulnerability_research_findings/
-title: handlebars.js - quoteless attributes in templates can lead to XSS
-date: 2015-08-24
-description: |
-  The upstream 'handlebars' node.js module was found to not properly escape
-  equals (=) signs, leading to possible content injection via attributes
-  in templates.
-
-  Example:
-  * Template: <a href={{foo}}/>
-  * Input: { 'foo' : 'test.com onload=alert(1)'}
-  * Rendered result: <a href=test.com onload=alert(1)/>
-patched_versions:
-  - ">= 4.0.0"

data/data/ruby-advisory-db/gems/http/CVE-2015-1828.yml

@@ -1,14 +0,0 @@
----
-gem: http
-cve: 2015-1828
-osvdb: 119927
-url: https://groups.google.com/forum/#!topic/httprb/jkb4oxwZjkU
-title: HTTPS MitM vulnerability in http.rb
-date: 2015-03-24
-description: |
-  http.rb failed to call the OpenSSL::SSL::SSLSocket#post_connection_check method to perform hostname verification.
-  Because of this, an attacker with a valid certificate but with a mismatched subject can perform a MitM attack.
-cvss_v2: 5.0
-patched_versions:
-  - ">= 0.7.3"
-  - "~> 0.6.4"

data/data/ruby-advisory-db/gems/httparty/CVE-2013-1801.yml

@@ -1,14 +0,0 @@
----
-gem: httparty
-cve: 2013-1801
-osvdb: 90741
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-1801
-title: httparty Gem for Ruby Type Casting Parameter Parsing Remote Code Execution
-date: 2013-01-14
-description: |
-  httparty Gem for Ruby contains a flaw that is triggered when a type casting
-  error occurs during the parsing of parameters. This may allow a
-  context-dependent attacker to potentially execute arbitrary code.
-cvss_v2: 7.5
-patched_versions:
-  - ">= 0.10.0"

data/data/ruby-advisory-db/gems/i18n/CVE-2014-10077.yml

@@ -1,18 +0,0 @@
----
-gem: i18n
-cve: 2014-10077
-url: https://github.com/svenfuchs/i18n/pull/289
-title: i18n Gem for Ruby lib/i18n/core_ext/hash.rb Hash#slice() Function Hash Handling DoS
-date: 2014-09-27
-description: |
-  i18n Gem for Ruby contains a flaw in the Hash#slice() function in
-  lib/i18n/core_ext/hash.rb that is triggered when calling a hash when
-  :some_key is in keep_keys but not in the hash. This may allow an attacker
-  to cause the program to crash.
-
-patched_versions:
-  - ">= 0.8.0"
-
-related:
-  osvdb:
-    - 121500

data/data/ruby-advisory-db/gems/i18n/OSVDB-100528.yml

@@ -1,17 +0,0 @@
----
-gem: i18n
-cve: 2013-4492
-osvdb: 100528
-url: https://groups.google.com/forum/#!topic/ruby-security-ann/pLrh6DUw998
-title: i18n missing translation error message XSS
-date: 2013-12-03
-
-description: |
-  The HTML exception message raised by I18n::MissingTranslation fails
-  to escape the keys.
-
-cvss_v2: 4.3
-
-patched_versions:
-  - ~> 0.5.1
-  - '>= 0.6.6'

data/data/ruby-advisory-db/gems/iodine/GHSA-85rf-xh54-whp3.yml

@@ -1,21 +0,0 @@
----
-gem: iodine
-ghsa: 85rf-xh54-whp3
-url: https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3
-date: 2019-10-07
-title: iodine path traversal via malicious URL drafting attack
-description: |
-  Malicious URL drafting attack against iodines static file server
-  may allow path traversal
-
-  Impact:
-  A path traversal vulnerability was detected in iodine's static file service.
-
-  This vulnerability effects any application running iodine's static file server
-  on an effected iodine version.
-
-  Malicious URL drafting may cause the static file server to attempt a response
-  containing data from files that shouldn't be normally accessible from the
-  public folder.
-patched_versions:
-- ">= 0.7.34"

data/data/ruby-advisory-db/gems/jekyll/CVE-2018-17567.yml

@@ -1,14 +0,0 @@
----
-gem: jekyll
-cve: 2018-17567
-date: 2018-09-28
-url: https://jekyllrb.com/news/2018/09/19/security-fixes-for-3-6-3-7-3-8/
-title: Jekyll _config.yml privilege escalation
-description: Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows
-  attackers to access arbitrary files by specifying a symlink in the "include" key
-  in the "_config.yml" file.
-cvss_v3: 7.5
-patched_versions:
-- "~> 3.6.3"
-- "~> 3.7.4"
-- ">= 3.8.4"

data/data/ruby-advisory-db/gems/jquery-rails/CVE-2015-1840.yml

@@ -1,36 +0,0 @@
----
-gem: jquery-rails
-cve: 2015-1840
-url: https://groups.google.com/forum/#!topic/ruby-security-ann/XIZPbobuwaY
-title: CSRF Vulnerability in jquery-rails
-date: 2015-06-16
-description: |
-  In the scenario where an attacker might be able to control the href attribute
-  of an anchor tag or the action attribute of a form tag that will trigger a
-  POST action, the attacker can set the href or action to
-  " https://attacker.com" (note the leading space) that will be passed to
-  JQuery, who will see this as a same origin request, and send the user's CSRF
-  token to the attacker domain.
-
-  To work around this problem, change code that allows users to control the
-  href attribute of an anchor tag or the action attribute of a form tag to
-  filter the user parameters.
-
-  For example, code like this:
-
-    link_to params
-
-  to code like this:
-
-    link_to filtered_params
-
-    def filtered_params
-      \# Filter just the parameters that you trust
-    end
-
-  See also:
-  - http://blog.honeybadger.io/understanding-the-rails-jquery-csrf-vulnerability-cve-2015-1840/
-cvss_v2: 5.0
-patched_versions:
-  - ">= 4.0.4"
-  - "~> 3.1.3"

data/data/ruby-advisory-db/gems/jquery-rails/CVE-2019-11358.yml

@@ -1,24 +0,0 @@
----
-gem: jquery-rails
-framework: rails
-cve: 2019-11358
-date: 2019-04-19
-url: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
-title: Prototype pollution attack through jQuery $.extend
-description: |
-  jQuery before 3.4.0 mishandles jQuery.extend(true, {}, ...) because of
-  bject.prototype pollution. If an unsanitized source object contained an
-  enumerable __proto__ property, it could extend the native Object.prototype.
-
-cvss_v2: 4.3
-cvss_v3: 6.1
-
-patched_versions:
-  - ">= 4.3.4"
-
-related:
-  url:
-    - https://hackerone.com/reports/454365
-    - https://github.com/jquery/jquery/pull/4333
-    - https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b
-    - https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#434

data/data/ruby-advisory-db/gems/jquery-ui-rails/CVE-2016-7103.yml

@@ -1,23 +0,0 @@
----
-gem: jquery-ui-rails
-framework: rails
-cve: 2016-7103
-date: 2016-08-27
-url: https://github.com/jquery/api.jqueryui.com/issues/281
-title: XSS Vulnerability on closeText option of Dialog jQuery UI
-
-description: |
-  Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might
-  allow remote attackers to inject arbitrary web script or HTML via the
-  closeText parameter of the dialog function.
-
-cvss_v2: 4.3
-cvss_v3: 6.1
-
-patched_versions:
-  - ">= 6.0.0"
-
-related:
-  url:
-    - https://github.com/jquery/jquery-ui/pull/1635
-    - https://github.com/jquery-ui-rails/jquery-ui-rails/blob/master/History.md#600

data/data/ruby-advisory-db/gems/jquery-ujs/CVE-2015-1840.yml

@@ -1,35 +0,0 @@
----
-gem: jquery-ujs
-cve: 2015-1840
-url: https://groups.google.com/forum/#!topic/ruby-security-ann/XIZPbobuwaY
-title: CSRF Vulnerability in jquery-ujs
-date: 2015-06-16
-description: |
-  In the scenario where an attacker might be able to control the href attribute
-  of an anchor tag or the action attribute of a form tag that will trigger a
-  POST action, the attacker can set the href or action to
-  " https://attacker.com" (note the leading space) that will be passed to
-  JQuery, who will see this as a same origin request, and send the user's CSRF
-  token to the attacker domain.
-
-  To work around this problem, change code that allows users to control the
-  href attribute of an anchor tag or the action attribute of a form tag to
-  filter the user parameters.
-
-  For example, code like this:
-
-    link_to params
-
-  to code like this:
-
-    link_to filtered_params
-
-    def filtered_params
-      \# Filter just the parameters that you trust
-    end
-
-  See also:
-  - http://blog.honeybadger.io/understanding-the-rails-jquery-csrf-vulnerability-cve-2015-1840/
-cvss_v2: 5.0
-patched_versions:
-  - ">= 1.0.4"

data/data/ruby-advisory-db/gems/jruby-openssl/CVE-2009-4123.yml

@@ -1,16 +0,0 @@
----
-gem: jruby-openssl
-platform: jruby
-cve: 2009-4123
-url: http://jruby.org/2009/12/07/vulnerability-in-jruby-openssl
-title: jruby-openssl Gem for JRuby fails to do proper certificate validation
-date: 2009-12-07
-description: |
-  A security problem involving peer certificate verification was found where
-  failed verification silently did nothing, making affected applications
-  vulnerable to attackers. Attackers could lead a client application to believe
-  that a secure connection to a rogue SSL server is legitimate. Attackers could
-  also penetrate client-validated SSL server applications with a dummy
-  certificate.
-patched_versions:
-  - ">= 0.6"

data/data/ruby-advisory-db/gems/jruby-sandbox/OSVDB-106279.yml

@@ -1,12 +0,0 @@
----
-gem: jruby-sandbox
-platform: jruby
-osvdb: 106279
-url: http://www.phenoelit.org/stuff/jruby-sandbox.txt
-title: jruby-sandbox Java Class Importation Sandbox Bypass
-date: 2014-04-24
-description: |
-  jruby-sandbox contains a flaw that is triggered when importing Java Classes.
-  This may allow a remote attacker to bypass the sandbox for code execution.
-patched_versions:
-  - ">= 0.2.3"

data/data/ruby-advisory-db/gems/json-jwt/CVE-2018-1000539.yml

@@ -1,21 +0,0 @@
----
-gem: json-jwt
-cve: 2018-1000539
-date: 2018-04-30
-url: https://github.com/nov/json-jwt/pull/62
-title: Auth tag forgery vulnerability with AES-GCM encrypted JWT
-description: |
-  Ruby's OpenSSL bindings do not check the length of the supplied
-  authentication tag when decrypting an authenticated encryption mode
-  such as AES-GCM, leaving this up to the authors of a gem/app to
-  implement for properly validating the message.
-
-  json-jwt was not checking for the authentication tag length, meaning
-  that with a one byte tag the JWT would be considered not tampered
-  with. This means that with an average of 128 (max 256) attempts an
-  attacker can forge a valid signature.
-
-unaffected_versions:
-  - "< 0.5.1"
-patched_versions:
-  - ">= 1.9.4"

data/data/ruby-advisory-db/gems/json-jwt/CVE-2019-18848.yml

@@ -1,15 +0,0 @@
----
-gem: json-jwt
-cve: 2019-18848
-ghsa: cff7-6h4q-q5pj
-url: https://github.com/nov/json-jwt/commit/ada16e772906efdd035e3df49cb2ae372f0f948a
-date: 2019-11-14
-title: |
-  json-jwt improper input validation due to lack of element count when
-  splitting string
-description: |
-  The json-jwt gem before 1.11.0 for Ruby lacks an element count during
-  the splitting of a JWE string.
-cvss_v3: 7.5
-patched_versions:
-- ">= 1.11.0"

data/data/ruby-advisory-db/gems/json/CVE-2013-0269.yml

@@ -1,20 +0,0 @@
---- 
-gem: json
-cve: 2013-0269
-osvdb: 101137
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-0269
-title: json Gem for Ruby multiple Remote DoS vulnerabilities
-date: 2013-02-12
-description: |
-  The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby
-  allows remote attackers to cause a denial of service (resource consumption) or
-  bypass the mass assignment protection mechanism via a crafted JSON document
-  that triggers the creation of arbitrary Ruby symbols or certain internal
-  objects, as demonstrated by conducting a SQL injection attack against
-  Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
-
-cvss_v2: 9.0
-patched_versions: 
-  - ~> 1.5.5
-  - ~> 1.6.8
-  - ">= 1.7.7"

data/data/ruby-advisory-db/gems/json/CVE-2020-10663.yml

@@ -1,35 +0,0 @@
----
-gem: json
-cve: 2020-10663
-url: https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
-title: json Gem for Ruby Unsafe Object Creation Vulnerability (additional fix)
-date: 2020-03-19
-description: |
-  There is an unsafe object creation vulnerability in the json gem bundled with
-  Ruby. This vulnerability has been assigned the CVE identifier CVE-2020-10663.
-  We strongly recommend upgrading the json gem.
-
-  Details
-  -------
-
-  When parsing certain JSON documents, the json gem (including the one bundled
-  with Ruby) can be coerced into creating arbitrary objects in the target system.
-
-  This is the same issue as CVE-2013-0269. The previous fix was incomplete, which
-  addressed JSON.parse(user_input), but didn’t address some other styles of JSON
-  parsing including JSON(user_input) and JSON.parse(user_input, nil).
-
-  See CVE-2013-0269 in detail. Note that the issue was exploitable to cause a
-  Denial of Service by creating many garbage-uncollectable Symbol objects, but
-  this kind of attack is no longer valid because Symbol objects are now
-  garbage-collectable. However, creating arbitrary objects may cause severe
-  security consequences depending upon the application code.
-
-patched_versions:
-  - ">= 2.3.0"
-
-related:
-  cve:
-    - 2013-0269
-  url:
-    - https://groups.google.com/forum/#!topic/ruby-security-ann/ermX1eQqqKA

data/data/ruby-advisory-db/gems/json/OSVDB-101157.yml

@@ -1,14 +0,0 @@
---- 
-gem: json
-osvdb: 101157
-url: http://osvdb.org/show/osvdb/101157
-title: json Gem for Ruby Data Handling Stack Buffer Overflow
-date: 2007-05-21
-description: |
-  json Gem for Ruby contains an overflow condition that is triggered as
-  user-supplied input is not properly validated when handling specially crafted
-  data. This may allow a remote attacker to cause a stack-based buffer
-  overflow, resulting in a denial of service or potentially allowing the
-  execution of arbitrary code.
-patched_versions: 
-  - ">= 1.1.0"

data/data/ruby-advisory-db/gems/kafo/CVE-2014-0135.yml

@@ -1,15 +0,0 @@
----
-gem: kafo
-cve: 2014-0135
-osvdb: 106826
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-0135
-title: Kafo default_values.yaml Insecure Permissions Local Information Disclosure
-date: 2014-03-13
-description: Kafo contains a flaw that is due to the program using insecure
-  world-readable permissions for the default_values.yaml file. This may allow a
-  local attacker to gain access to password and other unspecified sensitive
-  information located within the file.
-cvss_v2: 1.9
-patched_versions:
-  - "~> 0.3.17"
-  - ">= 0.5.2"

data/data/ruby-advisory-db/gems/kajam/CVE-2014-4999.yml

@@ -1,12 +0,0 @@
----
-gem: kajam
-cve: 2014-4999
-osvdb: 108529
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-4999
-title: kajam Gem for Ruby /dataset/lib/dataset/database/postgresql.rb Process List Local Plaintext Password Disclosure
-date: 2014-06-30
-description: |
-  kajam Gem for Ruby contains a flaw in
-  /dataset/lib/dataset/database/postgresql.rb that is triggered as the program
-  exposes the MySQL or PostgreSQL password in the process list. This may allow
-  a local attacker to gain access to password information.

data/data/ruby-advisory-db/gems/kajam/OSVDB-108530.yml

@@ -1,11 +0,0 @@
----
-gem: kajam
-osvdb: 108530
-url: http://osvdb.org/show/osvdb/108530
-title: kajam Gem for Ruby /dataset/lib/dataset/database/postgresql.rb Metacharacter Handling Remote Command Execution
-date: 2014-06-30
-description: |
-  kajam Gem for Ruby contains a flaw in
-  /dataset/lib/dataset/database/postgresql.rb that is triggered when handling
-  metacharacters. This may allow a remote attacker to execute arbitrary
-  commands.

data/data/ruby-advisory-db/gems/kaminari/CVE-2020-11082.yml

@@ -1,34 +0,0 @@
----
-gem: kaminari
-cve: 2020-11082
-ghsa: r5jw-62xg-j433
-url: https://github.com/kaminari/kaminari/security/advisories/GHSA-r5jw-62xg-j433
-date: 2020-05-28
-title: Cross-Site Scripting in Kaminari via `original_script_name` parameter
-description: |-
-  ### Impact
-  There was a vulnerability in versions of Kaminari that would allow an attacker to inject arbitrary code into pages with pagination links.
-
-  For example, an attacker could craft pagination links that link to other domain or host:
-  https://example.com/posts?page=4&original_script_name=https://another-host.example.com
-
-  In addition, an attacker could also craft pagination links that include JavaScript code that runs when a user clicks the link:
-  https://example.com/posts?page=4&original_script_name=javascript:alert(42)%3b//
-
-  ### Releases
-  The 1.2.1 gem including the patch has already been released.
-  All past released versions are affected by this vulnerability.
-
-  ### Workarounds
-  Application developers who can't update the gem can workaround by overriding the `PARAM_KEY_EXCEPT_LIST` constant.
-
-  ```ruby
-  module Kaminari::Helpers
-    PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
-  end
-  ```
-
-cvss_v3: 6.4
-
-patched_versions:
-  - ">= 1.2.1"