bundler-audit 0.7.0.1 → 0.8.0.rc1

data/data/ruby-advisory-db/gems/passenger/CVE-2015-7519.yml

@@ -1,17 +0,0 @@
----
-gem: passenger
-cve: 2015-7519
-url: https://blog.phusion.nl/2015/12/07/cve-2015-7519/
-title: Phusion Passenger Server allows to overwrite headers in some cases
-date: 2015-11-23
-description: It is possible in some cases, for clients to overwrite headers
-  set by the server, resulting in a medium level security issue.
-  Passenger 5 uses an SCGI-inspired format to pass headers to Ruby/Python
-  applications, while Passenger 4 uses an SCGI-inspired format to pass
-  headers to all applications. This implies a conversion to
-  UPPER_CASE_WITH_UNDERSCORES whereby the difference between characters
-  like '-' and '_' is lost.
-
-patched_versions:
-  - "~> 4.0.60"
-  - ">= 5.0.22"

data/data/ruby-advisory-db/gems/passenger/CVE-2016-10345.yml

@@ -1,17 +0,0 @@
----
-gem: passenger
-cve: 2016-10345
-url: https://blog.phusion.nl/2017/01/10/passenger-5-1-1/
-title:  Predictable tmp File Path Vulnerability in Phusion Passenger
-date: 2016-11-09
-
-description: >-
-  In Phusion Passenger before 5.1.0, a known /tmp filename was used during
-  passenger-install-nginx-module execution, which could allow local attackers
-  to gain the privileges of the passenger user.
-
-cvss_v2: 4.6
-cvss_v3: 7.8
-
-patched_versions:
-  - ">= 5.1.0"

data/data/ruby-advisory-db/gems/passenger/OSVDB-90738.yml

@@ -1,16 +0,0 @@
----
-gem: passenger
-cve: 2012-6135
-osvdb: 90738
-url: http://old.blog.phusion.nl/2013/03/05/phusion-passenger-4-0-beta-1-and-2-arbitrary-file-deletion-vulnerability/
-title: Phusion Passenger Gem for Ruby Arbitrary File Deletion
-date: 2012-02-01
-description: Phusion Passenger Gem for Ruby contains a flaw that is triggered
-  during application startup. This issue may allow a local attacker to delete
-  arbitrary files via an application process. If the program has completed the
-  start up process this vulnerability is no longer exploitable.
-cvss_v2: 2.1
-patched_versions:
-  - ">= 4.0.0"
-unaffected_versions:
-  - "< 4.0.0"

data/data/ruby-advisory-db/gems/pdfkit/CVE-2013-1607.yml

@@ -1,11 +0,0 @@
---- 
-gem: pdfkit
-cve: 2013-1607
-osvdb: 90867
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-1607
-title: PDFKit Gem for Ruby PDF File Generation Parameter Handling Remote Code Execution
-date: 2013-02-21
-description: PDFKit Gem for Ruby contains a flaw that is due to the program failing to properly validate input during the handling of parameters when generating PDF files. This may allow a remote attacker to potentially execute arbitrary code via the pdfkit generation options.
-cvss_v2: 
-patched_versions: 
-  - ">= 0.5.3"

data/data/ruby-advisory-db/gems/point-cli/CVE-2014-4997.yml

@@ -1,8 +0,0 @@
----
-gem: point-cli
-cve: 2014-4997
-osvdb: 108577
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-4997
-title: point-cli Gem for Ruby /lib/commands/setup.rb Process Table Local Plaintext Credential Disclosure
-date: 2014-06-30
-description: point-cli Gem for Ruby contains a flaw in /lib/commands/setup.rb that is due to the application exposing credential information in plaintext in the process table. This may allow a local attacker to gain access to credential information.

data/data/ruby-advisory-db/gems/private_address_check/CVE-2017-0904.yml

@@ -1,17 +0,0 @@
----
-gem: private_address_check
-cve: 2017-0904
-url: https://github.com/jtdowney/private_address_check/issues/1
-title: private_address_check Ruby Gem Resolv.getaddresses Server-Side Request Forgery
-date: 2017-11-07
-description: |
-  The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's
-  Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security
-  measures, such as when used to blacklist private network addresses to prevent server-side
-  request forgery.
-
-cvss_v2: 6.8
-cvss_v3: 8.1
-
-patched_versions:
-  - ">= 0.4.0"

data/data/ruby-advisory-db/gems/private_address_check/CVE-2017-0909.yml

@@ -1,15 +0,0 @@
----
-gem: private_address_check
-cve: 2017-0909
-url: https://github.com/jtdowney/private_address_check/pull/3
-title: private_address_check Ruby Gem Blacklist Bypass privilege escalation
-date: 2017-11-09
-description: |
-  The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete
-  blacklist of common private/local network addresses used to prevent server-side request forgery.
-
-cvss_v2: 7.5
-cvss_v3: 9.8
-
-patched_versions:
-  - ">= 0.4.1"

data/data/ruby-advisory-db/gems/private_address_check/CVE-2018-3759.yml

@@ -1,14 +0,0 @@
----
-gem: private_address_check
-cve: 2018-3759
-url: https://github.com/jtdowney/private_address_check/commit/4068228187db87fea7577f7020099399772bb147
-title: private_address_check Ruby Gem Time-of-check Time-of-use race condition
-date: 2018-05-03
-description: |
-  private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU)
-  race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0
-  can trigger this case where the initial resolution is a public address by the subsequent
-  resolution is a private address.
-
-patched_versions:
-  - ">= 0.5.0"

data/data/ruby-advisory-db/gems/puma/CVE-2019-16770.yml

@@ -1,21 +0,0 @@
----
-gem: puma
-cve: 2019-16770
-ghsa: 7xx3-m584-x994
-url: https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994
-date: 2019-12-05
-title: Keepalive thread overload/DoS in puma
-description: |
-  A poorly-behaved client could use keepalive requests to monopolize
-  Puma's reactor and create a denial of service attack.
-
-  If more keepalive connections to Puma are opened than there are
-  threads available, additional connections will wait permanently if
-  the attacker sends requests frequently enough.
-
-cvss_v3: 8.8
-cvss_v2: 6.8
-
-patched_versions:
-  - "~> 3.12.2"
-  - ">= 4.3.1"

data/data/ruby-advisory-db/gems/puma/CVE-2020-11076.yml

@@ -1,22 +0,0 @@
----
-gem: puma
-cve: 2020-11076
-ghsa: x7jg-6pwg-fx5h
-url: https://github.com/puma/puma/security/advisories/GHSA-x7jg-6pwg-fx5h
-date: 2020-05-22
-title: HTTP Smuggling via Transfer-Encoding Header in Puma
-description: |-
-  ### Impact
-
-  By using an invalid transfer-encoding header, an attacker could
-  [smuggle an HTTP response.](https://portswigger.net/web-security/request-smuggling)
-
-  ### Patches
-
-  The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.
-
-cvss_v3: 7.5
-
-patched_versions:
-  - "~> 3.12.5"
-  - ">= 4.3.4"

data/data/ruby-advisory-db/gems/puma/CVE-2020-11077.yml

@@ -1,31 +0,0 @@
----
-gem: puma
-cve: 2020-11077
-ghsa: w64w-qqph-5gxm
-url: https://github.com/puma/puma/security/advisories/GHSA-w64w-qqph-5gxm
-date: 2020-05-22
-title: HTTP Smuggling via Transfer-Encoding Header in Puma
-description: |-
-  ### Impact
-
-  This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4.
-
-  A client could smuggle a request through a proxy, causing the proxy to send a response
-  back to another unknown client.
-
-  If the proxy uses persistent connections and the client adds another request in via HTTP
-  pipelining, the proxy may mistake it as the first request's body. Puma, however,
-  would see it as two requests, and when processing the second request, send back
-  a response that the proxy does not expect. If the proxy has reused the persistent
-  connection to Puma to send another request for a different client, the second response
-  from the first client will be sent to the second client.
-
-  ### Patches
-
-  The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.
-
-cvss_v3: 6.8
-
-patched_versions:
-- "~> 3.12.6"
-- ">= 4.3.5"

data/data/ruby-advisory-db/gems/puma/CVE-2020-5247.yml

@@ -1,25 +0,0 @@
----
-gem: puma
-cve: 2020-5247
-ghsa: 84j7-475p-hp8v
-url: https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v
-date: 2020-02-27
-title: HTTP Response Splitting vulnerability in puma
-description: |-
-  If an application using Puma allows untrusted input in a response header,
-  an attacker can use newline characters (i.e. CR, LF) to end the header and
-  inject malicious content, such as additional headers or an entirely new
-  response body. This vulnerability is known as HTTP Response Splitting.
-
-  While not an attack in itself, response splitting is a vector for several
-  other attacks, such as cross-site scripting (XSS).
-
-cvss_v3: 6.5
-
-patched_versions:
-  - "~> 3.12.4"
-  - ">= 4.3.3"
-
-related:
-  cve:
-    - 2019-16254

data/data/ruby-advisory-db/gems/puma/CVE-2020-5249.yml

@@ -1,36 +0,0 @@
----
-gem: puma
-cve: 2020-5249
-ghsa: 33vf-4xgg-9r58
-url: https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58
-date: 2020-03-03
-title: HTTP Response Splitting (Early Hints) in Puma
-description: |-
-  ### Impact
-  If an application using Puma allows untrusted input in an early-hints header,
-  an attacker can use a carriage return character to end the header and inject
-  malicious content, such as additional headers or an entirely new response body.
-  This vulnerability is known as [HTTP Response
-  Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)
-
-  While not an attack in itself, response splitting is a vector for several other
-  attacks, such as cross-site scripting (XSS).
-
-  This is related to [CVE-2020-5247](https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v),
-  which fixed this vulnerability but only for regular responses.
-
-  ### Patches
-  This has been fixed in 4.3.3 and 3.12.4.
-
-  ### Workarounds
-  Users can not allow untrusted/user input in the Early Hints response header.
-
-cvss_v3: 6.5
-
-patched_versions:
-  - "~> 3.12.4"
-  - ">= 4.3.3"
-
-related:
-  cve:
-    - 2020-5247

data/data/ruby-advisory-db/gems/quick_magick/OSVDB-106954.yml

@@ -1,7 +0,0 @@
----
-gem: quick_magick
-osvdb: 106954
-url: http://osvdb.org/show/osvdb/106954
-title: quick_magick Gem for Ruby QuickMagick::Image.read Function Crafted String Handling Remote Command Injection 
-date: 2011-01-12
-description: quick_magick Gem for Ruby contains a flaw in the QuickMagick::Image.read function. The issue is triggered when handling a specially crafted string. This may allow a remote attacker to inject arbitrary commands.

data/data/ruby-advisory-db/gems/rack-attack/OSVDB-132234.yml

@@ -1,26 +0,0 @@
----
-gem: rack-attack
-osvdb: 132234
-url: https://github.com/kickstarter/rack-attack/releases/tag/v4.3.1
-title: |
-  rack-attack Gem for Ruby missing normalization before request path
-  processing
-date: 2015-12-18
-description: |
-  When using rack-attack with a rails app, developers expect the request
-  path to be normalized. In particular, trailing slashes are stripped so
-  a request path "/login/" becomes "/login" by the time you're in
-  ActionController.
-
-  Since Rack::Attack runs before ActionDispatch, the request path is not
-  yet normalized. This can cause throttles and blacklists to not work as
-  expected.
-
-  E.g., a throttle:
-
-  `throttle('logins', ...) {|req| req.path == "/login" }`
-
-  would not match a request to '/login/', though Rails would route
-  '/login/' to the same '/login' action. 
-patched_versions:
-  - ">= 4.3.1"

data/data/ruby-advisory-db/gems/rack-cache/CVE-2012-2671.yml

@@ -1,18 +0,0 @@
---- 
-gem: rack-cache
-cve: 2012-2671
-osvdb: 83077
-url: https://nvd.nist.gov/vuln/detail/CVE-2012-2671
-title: rack-cache Rubygem Sensitive HTTP Header Caching Weakness
-date: 2012-06-06
-
-description: |
-  Rack::Cache (rack-cache) contains a flaw related to the rubygem caching
-  sensitive HTTP headers. This will result in a weakness that may make it
-  easier for an attacker to gain access to a user's session via a specially
-  crafted header.
-
-cvss_v2: 7.5
-
-patched_versions: 
-  - ">= 1.2"

data/data/ruby-advisory-db/gems/rack-cors/CVE-2017-11173.yml

@@ -1,21 +0,0 @@
----
-gem: rack-cors
-cve: 2017-11173
-date: 2015-07-13
-url: https://github.com/cyu/rack-cors/issues/86
-title: rack-cors Gem Missing Anchor permits unauthorized CORS requests
-description: |
-  Missing anchor in generated regex for rack-cors before 0.4.1
-  allows a malicious third-party site to perform CORS requests.
-  If the configuration were intended to allow only the trusted
-  example.com domain name and not the malicious example.net domain name,
-  then example.com.example.net (as well as example.com-example.net) would
-  be inadvertently allowed.
-
-cvss_v2: 6.8
-patched_versions:
-  - ">= 0.4.1"
-related:
-  url:
-    - https://github.com/cyu/rack-cors/issues/86
-    - http://seclists.org/fulldisclosure/2017/Jul/22

data/data/ruby-advisory-db/gems/rack-cors/CVE-2019-18978.yml

@@ -1,13 +0,0 @@
----
-gem: rack-cors
-cve: 2019-18978
-ghsa: pf8f-w267-mq2h
-url: https://github.com/cyu/rack-cors/commit/e4d4fc362a4315808927011cbe5afcfe5486f17d
-date: 2019-11-15
-title: rack-cors directory traversal via path
-description: |
-  An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem
-  before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources
-  because resource matching does not ensure that pathnames are in a canonical format.
-patched_versions:
-- ">= 1.0.4"

data/data/ruby-advisory-db/gems/rack-mini-profiler/CVE-2016-4442.yml

@@ -1,17 +0,0 @@
----
-gem: rack-mini-profiler
-cve: 2016-4442
-url: https://github.com/MiniProfiler/rack-mini-profiler/commit/4273771d65f1a7411e3ef5843329308d0e2d257c
-title: rack-mini-profiler may disclose information to unauthorized users
-date: 2016-05-18
-description: >-
-  Carefully crafted requests can expose information about
-  strings and objects allocated during the request for unauthorised
-  users.
-
-patched_versions:
-  - ">= 0.10.1"
-
-related:
-  url:
-    - http://seclists.org/oss-sec/2016/q2/516

data/data/ruby-advisory-db/gems/rack-protection/CVE-2018-1000119.yml

@@ -1,18 +0,0 @@
----
-gem: rack-protection
-cve: 2018-1000119
-url: https://github.com/sinatra/rack-protection/pull/98
-date: 2018-03-07
-title: rack-protection gem timing attack vulnerability when validating CSRF token
-description: |
-  Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains
-  a timing attack vulnerability in the CSRF token checking that can result in signatures
-  can be exposed. This attack appear to be exploitable via network connectivity to
-  the ruby application.
-
-cvss_v3: 5.9
-cvss_v2: 4.3
-
-patched_versions:
-  - ~> 1.5.5
-  - ">= 2.0.0"

data/data/ruby-advisory-db/gems/rack-protection/CVE-2018-7212.yml

@@ -1,12 +0,0 @@
----
-gem: rack-protection
-cve: 2018-7212
-url: https://github.com/sinatra/sinatra/pull/1379
-title: Path traversal is possible via backslash characters on Windows.
-date: 2018-02-18
-description: |
-  An issue was discovered in rack-protection 2.x before 2.0.1 on Windows. Path traversal
-  is possible via backslash characters.
-patched_versions:
-  - ">= 2.0.1"
-  - "~> 1.5.4"

data/data/ruby-advisory-db/gems/rack-ssl/CVE-2014-2538.yml

@@ -1,11 +0,0 @@
----
-gem: rack-ssl
-cve: 2014-2538
-osvdb: 104734
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-2538
-title: rack-ssl Gem for Ruby Error Message Reflected XSS 
-date: 2013-07-09
-description: rack-ssl Gem for Ruby contains a flaw that allows a reflected cross-site scripting (XSS) attack. This flaw exists because the program does not validate input passed via error messages before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
-cvss_v2: 4.3
-patched_versions:
-  - ">= 1.3.4"

data/data/ruby-advisory-db/gems/rack/CVE-2011-5036.yml

@@ -1,21 +0,0 @@
----
-gem: rack
-cve: 2011-5036
-osvdb: 78121
-url: https://nvd.nist.gov/vuln/detail/CVE-2011-5036
-title: |
-  Rack Hash Collision Form Parameter Parsing Remote DoS
-date: 2011-12-28
-
-description: |
-  Rack contains a flaw that may allow a remote denial of service. The issue is
-  triggered when an attacker sends multiple crafted parameters which trigger
-  hash collisions, and will result in loss of availability for the program via
-  CPU consumption.
-
-cvss_v2: 5.0
-patched_versions:
-  - "~> 1.1.3"
-  - "~> 1.2.5"
-  - "~> 1.3.6"
-  - ">= 1.4.0"