bundler-audit 0.7.0.1 → 0.8.0.rc1

data/data/ruby-advisory-db/gems/nokogiri/CVE-2016-4658.yml

@@ -1,33 +0,0 @@
----
-gem: nokogiri
-cve: 2016-4658
-url: https://github.com/sparklemotion/nokogiri/issues/1615
-title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt
-date: 2017-03-11
-description: |
-  Nokogiri version 1.7.1 has been released, pulling in several upstream
-  patches to the vendored libxml2 to address the following CVEs:
-
-  CVE-2016-4658
-  CVSS v3 Base Score: 9.8 (Critical)
-  libxml2 in Apple iOS before 10, OS X before 10.12, tvOS before 10, and
-  watchOS before 3 allows remote attackers to execute arbitrary code or cause
-  a denial of service (memory corruption) via a crafted XML document.
-
-  CVE-2016-5131
-  CVSS v3 Base Score: 8.8 (HIGH)
-  Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google
-  Chrome before 52.0.2743.82, allows remote attackers to cause a denial of
-  service or possibly have unspecified other impact via vectors related to
-  the XPointer range-to function.
-
-cvss_v2: 10.0
-cvss_v3: 9.8
-
-patched_versions:
-  - ">= 1.7.1"
-related:
-  cve:
-    - 2016-5131
-  url:
-    - https://github.com/sparklemotion/nokogiri/issues/1615

data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-15412.yml

@@ -1,23 +0,0 @@
----
-gem: nokogiri
-cve: 2017-15412
-url: https://github.com/sparklemotion/nokogiri/issues/1714
-title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities
-date: 2018-01-29
-description: |
-  The version of libxml2 packaged with Nokogiri contains a
-  vulnerability. Nokogiri has mitigated these issue by upgrading to
-  libxml 2.9.6.
-
-  It was discovered that libxml2 incorrecty handled certain files. An attacker
-  could use this issue with specially constructed XML data to cause libxml2 to
-  consume resources, leading to a denial of service.
-
-patched_versions:
-  - ">= 1.8.2"
-related:
-  cve:
-    - 2017-18258
-  url:
-    - https://usn.ubuntu.com/usn/usn-3513-1/
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15412.html

data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-16932.yml

@@ -1,21 +0,0 @@
----
-gem: nokogiri
-cve: 2017-16932
-url: https://github.com/sparklemotion/nokogiri/issues/1714
-title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities
-date: 2018-01-29
-description: |
-  The version of libxml2 packaged with Nokogiri contains a
-  vulnerability. Nokogiri has mitigated these issue by upgrading to
-  libxml 2.9.5.
-
-  Wei Lei discovered that libxml2 incorrecty handled certain parameter
-  entities. An attacker could use this issue with specially constructed XML
-  data to cause libxml2 to consume resources, leading to a denial of service.
-
-patched_versions:
-  - ">= 1.8.1"
-related:
-  url:
-    - https://usn.ubuntu.com/usn/usn-3504-1/
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16932.html

data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-5029.yml

@@ -1,44 +0,0 @@
----
-gem: nokogiri
-cve: 2017-5029
-url: https://github.com/sparklemotion/nokogiri/issues/1634
-title: Nokogiri gem contains two upstream vulnerabilities in libxslt 1.1.29
-date: 2017-05-09
-description: |
-    nokogiri version 1.7.2 has been released.
-
-    This is a security update based on 1.7.1, addressing two upstream
-    libxslt 1.1.29 vulnerabilities classified as "Medium" by Canonical 
-    and given a CVSS3 score of "6.5 Medium" and "8.8 High" by RedHat.
-
-    These patches only apply when using Nokogiri's vendored libxslt
-    package. If you're using your distro's system libraries, there's no
-    need to upgrade from 1.7.0.1 or 1.7.1 at this time.
-
-    Full details are available at the github issue linked to in the
-    changelog below.
-
-    -----
-
-    # 1.7.2 / 2017-05-09
-
-    ## Security Notes
-
-    [MRI] Upstream libxslt patches are applied to the vendored libxslt
-    1.1.29 which address CVE-2017-5029 and CVE-2016-4738.
-
-    For more information:
-
-    * https://github.com/sparklemotion/nokogiri/issues/1634
-    * http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5029.html
-    * http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4738.html
-
-patched_versions:
-  - ">= 1.7.2"
-related:
-  cve:
-    - 2016-4738
-    - 2017-5029
-  url:
-    - http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5029.html
-    - http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4738.html

data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-9050.yml

@@ -1,60 +0,0 @@
----
-gem: nokogiri
-cve: 2017-9050
-url: https://github.com/sparklemotion/nokogiri/issues/1673
-title: Nokogiri gem, via libxml, is affected by DoS and RCE vulnerabilities 
-date: 2017-09-19
-description: |
-  The version of libxml2 packaged with Nokogiri contains several
-  vulnerabilities. Nokogiri has mitigated these issues by upgrading to
-  libxml 2.9.5.
-
-  It was discovered that a type confusion error existed in libxml2. An
-  attacker could use this to specially construct XML data that
-  could cause a denial of service or possibly execute arbitrary
-  code. (CVE-2017-0663)
-
-  It was discovered that libxml2 did not properly validate parsed entity
-  references. An attacker could use this to specially construct XML
-  data that could expose sensitive information. (CVE-2017-7375)
-
-  It was discovered that a buffer overflow existed in libxml2 when
-  handling HTTP redirects. An attacker could use this to specially
-  construct XML data that could cause a denial of service or possibly
-  execute arbitrary code. (CVE-2017-7376)
-
-  Marcel Böhme and Van-Thuan Pham discovered a buffer overflow in
-  libxml2 when handling elements. An attacker could use this to specially
-  construct XML data that could cause a denial of service or possibly
-  execute arbitrary code. (CVE-2017-9047)
-
-  Marcel Böhme and Van-Thuan Pham discovered a buffer overread
-  in libxml2 when handling elements. An attacker could use this
-  to specially construct XML data that could cause a denial of
-  service. (CVE-2017-9048)
-
-  Marcel Böhme and Van-Thuan Pham discovered multiple buffer overreads
-  in libxml2 when handling parameter-entity references. An attacker
-  could use these to specially construct XML data that could cause a
-  denial of service. (CVE-2017-9049, CVE-2017-9050)
-
-patched_versions:
-  - ">= 1.8.1"
-related:
-  cve:
-    - 2017-0663
-    - 2017-7375
-    - 2017-7376
-    - 2017-9047
-    - 2017-9048
-    - 2017-9049
-    - 2017-9050
-  url:
-    - https://usn.ubuntu.com/usn/usn-3424-1/
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-0663.html
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7375.html
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7376.html
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9047.html
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9048.html
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9049.html
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9050.html

data/data/ruby-advisory-db/gems/nokogiri/CVE-2018-14404.yml

@@ -1,69 +0,0 @@
----
-gem: nokogiri
-cve: 2018-14404
-date: 2018-10-04
-url: https://github.com/sparklemotion/nokogiri/issues/1785
-title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities
-description: |
-  Nokogiri 1.8.5 has been released.
-
-  This is a security and bugfix release. It addresses two CVEs in upstream
-  libxml2 rated as "medium" by Red Hat, for which details are below.
-
-  If you're using your distro's system libraries, rather than Nokogiri's
-  vendored libraries, there's no security need to upgrade at this time,
-  though you may want to check with your distro whether they've patched this
-  (Canonical has patched Ubuntu packages). Note that these patches are not
-  yet (as of 2018-10-04) in an upstream release of libxml2.
-
-  Full details about the security update are available in Github Issue #1785.
-  [#1785]: https://github.com/sparklemotion/nokogiri/issues/1785
-
-  -----
-
-  [MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404
-  and CVE-2018-14567. Full details are available in #1785. Note that these
-  patches are not yet (as of 2018-10-04) in an upstream release of libxml2.
-
-  -----
-
-  CVE-2018-14404
-
-  Permalink:
-
-  https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14404.html
-
-  Description:
-
-  A NULL pointer dereference vulnerability exists in the
-  xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when
-  parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR
-  case. Applications processing untrusted XSL format inputs with the use of
-  the libxml2 library may be vulnerable to a denial of service attack due
-  to a crash of the application
-
-  Canonical rates this vulnerability as "Priority: Medium"
-
-  -----
-
-  CVE-2018-14567
-
-  Permalink:
-
-  https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14567.html
-
-  Description:
-
-  infinite loop in LZMA decompression
-
-  Canonical rates this vulnerability as "Priority: Medium"
-
-patched_versions:
-  - ">= 1.8.5"
-related:
-  cve:
-    - 2018-14567
-  url:
-    - https://groups.google.com/forum/#!msg/ruby-security-ann/uVrmO2HjqQw/Fw3ocLI0BQAJ
-    - https://gitlab.gnome.org/GNOME/libxml2/commit/a436374994c47b12d5de1b8b1d191a098fa23594
-    - https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74

data/data/ruby-advisory-db/gems/nokogiri/CVE-2018-8048.yml

@@ -1,36 +0,0 @@
----
-gem: nokogiri
-cve: 2018-8048
-date: 2018-03-29
-url: https://github.com/sparklemotion/nokogiri/pull/1746
-title: Revert libxml2 behavior in Nokogiri gem that could cause XSS
-description: |
-  [MRI] Behavior in libxml2 has been reverted which caused
-  CVE-2018-8048 (loofah gem), CVE-2018-3740 (sanitize gem), and
-  CVE-2018-3741 (rails-html-sanitizer gem). The commit in question is
-  here:
-
-  https://github.com/GNOME/libxml2/commit/960f0e2
-
-  and more information is available about this commit and its impact
-  here:
-
-  https://github.com/flavorjones/loofah/issues/144
-
-  This release simply reverts the libxml2 commit in question to protect
-  users of Nokogiri's vendored libraries from similar vulnerabilities.
-
-  If you're offended by what happened here, I'd kindly ask that you
-  comment on the upstream bug report here:
-
-  https://bugzilla.gnome.org/show_bug.cgi?id=769760
-
-patched_versions:
-  - ">= 1.8.3"
-related:
-  cve:
-    - 2018-3740
-    - 2018-3741
-  url:
-    - https://github.com/GNOME/libxml2/commit/960f0e2
-    - https://bugzilla.gnome.org/show_bug.cgi?id=769760

data/data/ruby-advisory-db/gems/nokogiri/CVE-2019-11068.yml

@@ -1,49 +0,0 @@
----
-gem: nokogiri
-cve: 2019-11068
-date: 2019-04-22
-url: https://github.com/sparklemotion/nokogiri/issues/1892
-title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
-description: |
-  Nokogiri v1.10.3 has been released.
-
-  This is a security release. It addresses a CVE in upstream libxslt rated as
-  "Priority: medium" by Canonical, and "NVD Severity: high" by Debian. More
-  details are available below.
-
-  If you're using your distro's system libraries, rather than Nokogiri's
-  vendored libraries, there's no security need to upgrade at this time, though
-  you may want to check with your distro whether they've patched this
-  (Canonical has patched Ubuntu packages). Note that this patch is not yet (as
-  of 2019-04-22) in an upstream release of libxslt.
-
-  Full details about the security update are available in Github Issue
-  [#1892] https://github.com/sparklemotion/nokogiri/issues/1892.
-
-  ---
-
-  CVE-2019-11068
-
-  Permalinks are:
-  - Canonical: https://people.canonical.com/~ubuntu-security/cve/CVE-2019-11068
-  - Debian: https://security-tracker.debian.org/tracker/CVE-2019-11068
-
-  Description:
-
-  > libxslt through 1.1.33 allows bypass of a protection mechanism
-  > because callers of xsltCheckRead and xsltCheckWrite permit access
-  > even upon receiving a -1 error code. xsltCheckRead can return -1 for
-  > a crafted URL that is not actually invalid and is subsequently
-  > loaded.
-
-  Canonical rates this as "Priority: Medium".
-
-  Debian rates this as "NVD Severity: High (attack range: remote)".
-
-patched_versions:
-  - ">= 1.10.3"
-
-related:
-  url:
-    - https://groups.google.com/forum/#!msg/ruby-security-ann/_y80o1zZlOs/k4SDX6hoAAAJ
-    - https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6

data/data/ruby-advisory-db/gems/nokogiri/CVE-2019-13117.yml

@@ -1,80 +0,0 @@
----
-gem: nokogiri
-cve: 2019-13117
-date: 2019-10-31
-url: https://github.com/sparklemotion/nokogiri/issues/1943
-title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities
-description: |
-  Nokogiri v1.10.5 has been released.
-
-  This is a security release. It addresses three CVEs in upstream libxml2,
-  for which details are below.
-
-  If you're using your distro's system libraries, rather than Nokogiri's
-  vendored libraries, there's no security need to upgrade at this time,
-  though you may want to check with your distro whether they've patched this
-  (Canonical has patched Ubuntu packages). Note that libxslt 1.1.34 addresses
-  these vulnerabilities.
-
-  Full details about the security update are available in Github Issue
-  [#1943] https://github.com/sparklemotion/nokogiri/issues/1943.
-
-  ---
-
-  CVE-2019-13117
-
-  https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13117.html
-
-  Priority: Low
-
-  Description: In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings
-  could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This
-  could allow an attacker to discern whether a byte on the stack contains the
-  characters A, a, I, i, or 0, or any other character.
-
-  Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1
-
-  ---
-
-  CVE-2019-13118
-
-  https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13118.html
-
-  Priority: Low
-
-  Description: In numbers.c in libxslt 1.1.33, a type holding grouping characters of an
-  xsl:number instruction was too narrow and an invalid character/length
-  combination could be passed to xsltNumberFormatDecimal, leading to a read
-  of uninitialized stack data
-
-  Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b
-
-  ---
-
-  CVE-2019-18197
-
-  https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-18197.html
-
-  Priority: Medium
-
-  Description: In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't
-  reset under certain circumstances. If the relevant memory area happened to
-  be freed and reused in a certain way, a bounds check could fail and memory
-  outside a buffer could be written to, or uninitialized data could be
-  disclosed.
-
-  Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285
-
-patched_versions:
-  - ">= 1.10.5"
-
-related:
-  url:
-    - https://groups.google.com/d/msg/ruby-security-ann/-Wq4aouIA3Q/yc76ZHemBgAJ
-    - https://usn.ubuntu.com/4164-1/
-    - https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1
-    - https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b
-    - https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285
-  cve:
-    - 2019-13118
-    - 2019-18197

data/data/ruby-advisory-db/gems/nokogiri/CVE-2019-5477.yml

@@ -1,31 +0,0 @@
----
-gem: nokogiri
-cve: 2019-5477
-date: 2019-08-11
-url: https://github.com/sparklemotion/nokogiri/issues/1915
-title: Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file
-description: |
-  A command injection vulnerability in Nokogiri v1.10.3 and earlier allows
-  commands to be executed in a subprocess by Ruby's `Kernel.open` method.
-  Processes are vulnerable only if the undocumented method
-  `Nokogiri::CSS::Tokenizer#load_file` is being passed untrusted user input.
-
-  This vulnerability appears in code generated by the Rexical gem versions
-  v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner
-  code for parsing CSS queries. The underlying vulnerability was addressed in
-  Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in
-  Nokogiri v1.10.4.
-
-  Upgrade to Nokogiri v1.10.4, or avoid calling the undocumented method
-  `Nokogiri::CSS::Tokenizer#load_file` with untrusted user input.
-
-patched_versions:
-  - ">= 1.10.4"
-
-cvss_v2: 7.5
-cvss_v3: 9.8
-
-related:
-  url:
-    - https://github.com/tenderlove/rexical/commit/a652474dbc66be350055db3e8f9b3a7b3fd75926
-    - https://groups.google.com/forum/#!msg/ruby-security-ann/YMnKFsASOAE/Fw3ocLI0BQAJ