bundler-audit 0.7.0.1 → 0.8.0.rc1

data/data/ruby-advisory-db/gems/rexical/CVE-2019-5477.yml

@@ -1,21 +0,0 @@
----
-gem: rexical
-cve: 2019-5477
-date: 2019-08-11
-url: https://github.com/tenderlove/rexical/commit/a652474dbc66be350055db3e8f9b3a7b3fd75926
-title: Rexical Command Injection Vulnerability
-description: |
-  A command injection vulnerability appears in code generated by the Rexical
-  gem versions v1.0.6 and earlier. It allows commands to be executed in a
-  subprocess by Ruby's `Kernel.open` method.
-
-patched_versions:
-  - ">= 1.0.7"
-
-cvss_v2: 7.5
-cvss_v3: 9.8
-
-related:
-  url:
-    - https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc#107--2019-08-06
-    - https://groups.google.com/forum/#!msg/ruby-security-ann/YMnKFsASOAE/Fw3ocLI0BQAJ

data/data/ruby-advisory-db/gems/rgpg/CVE-2013-4203.yml

@@ -1,15 +0,0 @@
----
-gem: rgpg
-cve: 2013-4203
-osvdb: 95948
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-4203
-title: rgpg Gem for Ruby lib/rgpg/gpg_helper.rb Remote Command Execution
-date: 2013-08-02
-description: |
-  rgpg Gem for Ruby contains a flaw in the GpgHelper module
-  (lib/rgpg/gpg_helper.rb). The issue is due to the program failing to properly
-  sanitize user-supplied input before being used in the system() function for
-  execution. This may allow a remote attacker to execute arbitrary commands.
-cvss_v2: 7.5
-patched_versions:
-  - ">= 0.2.3"

data/data/ruby-advisory-db/gems/rubocop/CVE-2017-8418.yml

@@ -1,20 +0,0 @@
----
-gem: rubocop
-cve: 2017-8418
-url: https://github.com/bbatsov/rubocop/issues/4336
-date: 2017-05-01
-title: |
-  RuboCop: insecure use of /tmp
-
-description: |
-  RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local
-  users to exploit this to tamper with cache files belonging to other users.
-
-cvss_v2: 2.1
-
-patched_versions:
-  - ">= 0.49.0"
-
-related:
-  url:
-    - http://www.openwall.com/lists/oss-security/2017/05/01/14

data/data/ruby-advisory-db/gems/ruby-openid/CVE-2019-11027.yml

@@ -1,16 +0,0 @@
----
-gem: ruby-openid
-cve: 2019-11027
-ghsa: fqfj-cmh6-hj49
-url: https://github.com/openid/ruby-openid/issues/122
-date: 2019-06-13
-title: ruby-openid SSRF via claimed_id request
-description: |
-  Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable
-  flaw. This library is used by Rails web applications to integrate with OpenID Providers.
-  Severity can range from medium to critical, depending on how a web application developer
-  chose to employ the ruby-openid library. Developers who based their OpenID integration
-  heavily on the "example app" provided by the project are at highest risk.
-cvss_v3: 9.8
-patched_versions:
-- ">= 2.9.0"

data/data/ruby-advisory-db/gems/ruby-saml/CVE-2016-5697.yml

@@ -1,20 +0,0 @@
----
-gem: ruby-saml
-cve: 2016-5697
-url: https://github.com/onelogin/ruby-saml/commit/a571f52171e6bfd87db59822d1d9e8c38fb3b995
-title: XML signature wrapping attack
-date: 2016-06-24
-description: |
-  ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack
-  in the specific scenario where there was a signature that referenced at the same time
-  2 elements (but past the scheme validator process since 1 of the element was inside
-  the encrypted assertion).
-
-  ruby-saml users must update to 1.3.0, which implements 3 extra validations to
-  mitigate this kind of attack.
-
-cvss_v2: 5.0
-cvss_v3: 7.5
-
-patched_versions:
-  - ">= 1.3.0"

data/data/ruby-advisory-db/gems/ruby-saml/CVE-2017-11428.yml

@@ -1,27 +0,0 @@
----
-gem: ruby-saml
-cve: 2017-11428
-url: https://github.com/onelogin/ruby-saml/commit/048a544730930f86e46804387a6b6fad50d8176f
-title: Authentication bypass via incorrect XML canonicalization and DOM traversal
-date: 2018-02-27
-description: |
-  ruby-saml prior to version 1.7.0 is vulnerable to an authentication bypass via incorrect
-  XML canonicalization and DOM traversal. Specifically, there are inconsistencies in
-  handling of comments within XML nodes, resulting in incorrect parsing of the inner text
-  of XML nodes such that any inner text after the comment is lost prior to
-  cryptographically signing the SAML message. Text after the comment therefore has no
-  impact on the signature on the SAML message.
-
-  A remote attacker can modify SAML content for a SAML service provider without
-  invalidating the cryptographic signature, which may allow attackers to bypass
-  primary authentication for the affected SAML service provider.
-
-cvss_v2: 6.3
-
-patched_versions:
-  - ">= 1.7.0"
-
-related:
-  url:
-    - https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
-    - https://www.kb.cert.org/vuls/id/475445

data/data/ruby-advisory-db/gems/ruby-saml/OSVDB-117903.yml

@@ -1,13 +0,0 @@
----
-gem: ruby-saml
-osvdb: 117903
-url: http://www.osvdb.org/show/osvdb/117903
-title: Ruby-Saml Gem is vulnerable to arbitrary code execution
-date: 2015-02-03
-description: |
-  ruby-saml contains a flaw that is triggered as the URI value of a SAML response is
-  not properly sanitized through a prepared statement. This may allow a remote
-  attacker to execute arbitrary shell commands on the host machine.
-cvss_v2:
-patched_versions:
-  - ">= 0.8.2"

data/data/ruby-advisory-db/gems/ruby-saml/OSVDB-124383.yml

@@ -1,11 +0,0 @@
----
-gem: ruby-saml
-osvdb: 124383
-url: https://github.com/onelogin/ruby-saml/pull/247
-title: Ruby-Saml Gem is vulnerable to entity expansion attacks
-date: 2015-06-30
-description: |
-  ruby-saml before 1.0.0 is vulnerable to entity expansion attacks.
-cvss_v2: 3.9
-patched_versions:
-  - ">= 1.0.0"

data/data/ruby-advisory-db/gems/ruby-saml/OSVDB-124991.yml

@@ -1,13 +0,0 @@
----
-gem: ruby-saml
-osvdb: 124991
-url: https://github.com/onelogin/ruby-saml/pull/225
-title: Ruby-Saml Gem is vulnerable to XPath Injection
-date: 2015-04-29
-description: |
-  ruby-saml before 1.0.0 is vulnerable to XPath injection on xml_security.rb. The 
-  lack of prepared statements allows for possibly command injection, leading to 
-  arbitrary code execution
-cvss_v2: 6.7
-patched_versions:
-  - ">= 1.0.0"

data/data/ruby-advisory-db/gems/ruby_parser-legacy/CVE-2019-18409.yml

@@ -1,16 +0,0 @@
----
-gem: ruby_parser-legacy
-cve: 2019-18409
-date: 2019-10-24
-url: https://github.com/zenspider/ruby_parser-legacy/issues/1
-title: ruby_parser-legacy world writable files allow local privilege escalation
-
-description: |
-  The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local
-  privilege escalation because of world-writable files. For example,
-  if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used,
-  a local user can insert malicious code into the
-  ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.
-
-cvss_v2: 4.6
-cvss_v3: 7.8

data/data/ruby-advisory-db/gems/ruby_parser/CVE-2013-0162.yml

@@ -1,11 +0,0 @@
---- 
-gem: ruby_parser
-cve: 2013-0162
-osvdb: 90561
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-0162
-title: RubyGems ruby_parser (RP) Temporary File Symlink Arbitrary File Overwrite
-date: 2013-02-21
-description: RubyGems ruby_parser (RP) contains a flaw as rubygem-ruby_parser creates temporary files insecurely. It is possible for a local attacker to use a symlink attack to cause the program to unexpectedly overwrite an arbitrary file.
-cvss_v2: 2.1
-patched_versions: 
-  - ">= 3.1.2"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2007-0469.yml

@@ -1,18 +0,0 @@
----
-gem: rubygems-update
-library: rubygems
-cve: 2007-0469
-osvdb: 33561
-url: https://nvd.nist.gov/vuln/detail/CVE-2007-0469
-title: |
-  RubyGems installer.rb extract_files Function Crafted GEM Package Arbitrary
-  File Overwrite
-date: 2007-01-22
-description: |
-  The extract_files function in installer.rb in RubyGems before 0.9.1 does not
-  check whether files exist before overwriting them, which allows user-assisted
-  remote attackers to overwrite arbitrary files, cause a denial of service, or
-  execute arbitrary code via crafted GEM packages.
-cvss_v2: 9.3
-patched_versions:
-  - ">= 0.9.1"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2012-2125.yml

@@ -1,17 +0,0 @@
----
-gem: rubygems-update
-library: rubygems
-cve: 2012-2125
-osvdb: 85809
-url: https://nvd.nist.gov/vuln/detail/CVE-2012-2125
-title: |
-  RubyGems HTTPS to HTTP Redirection MitM Downloaded Installation File
-  Manipulation
-date: 2012-09-25
-description: |
-  RubyGems contains a flaw that is triggered by the gem fetcher allowing for
-  redirection of HTTPS to HTTP. This may allow a remote attacker to conduct a
-  man-in-the-middle attack to alter downloaded gem installation files.
-cvss_v2: 5.8
-patched_versions:
-  - ">= 1.8.23"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2012-2126.yml

@@ -1,15 +0,0 @@
----
-gem: rubygems-update
-library: rubygems
-cve: 2012-2126
-osvdb: 81444
-url: https://nvd.nist.gov/vuln/detail/CVE-2012-2126
-title: RubyGems SSL Certificate Validation MitM Spoofing Weakness
-date: 2012-04-20
-description: |
-  RubyGems contains a flaw related to the validation of SSL certificates when
-  accessing certain services and APIs. This may allow a man-in-the-middle
-  attacker to spoof a valid server.
-cvss_v2: 4.3
-patched_versions:
-  - ">= 1.8.23"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2013-4287.yml

@@ -1,20 +0,0 @@
----
-gem: rubygems-update
-library: rubygems
-cve: 2013-4287
-osvdb: 97163
-url: http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html
-title: RubyGems Multiple API Call Version Validation CPU Consumption DoS
-date: 2013-09-09
-description: |
-  RubyGems contains a flaw that may allow a denial of service. The issue is
-  triggered when handling the gem build, Gem::Package, or Gem::PackageTask API
-  calls, which attempt to validate the version of the program. This may allow a
-  context-dependent attacker to cause a consumption of CPU resources and crash
-  the program.
-cvss_v2: 4.3
-patched_versions:
-  - ~> 1.8.23.1
-  - ~> 1.8.26
-  - ~> 2.0.8
-  - ">= 2.1.0"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2013-4363.yml

@@ -1,21 +0,0 @@
----
-gem: rubygems-update
-library: rubygems
-cve: 2013-4363
-osvdb: 97163
-url: http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html
-title: RubyGems Multiple API Call Version Validation CPU Consumption DoS
-date: 2013-09-24
-description: |
-  RubyGems contains a flaw that may allow a denial of service. The issue is
-  triggered when handling the gem build, Gem::Package, or Gem::PackageTask API
-  calls, which attempt to validate the version of the program. This may allow a
-  context-dependent attacker to cause a consumption of CPU resources and crash
-  the program. This vulnerability is due to an incomplete fix for
-  CVE-2013-4287, which allowed a denial of service via improper validation.
-cvss_v2: 4.3
-patched_versions:
-  - ~> 1.8.23.2
-  - ~> 1.8.27
-  - ~> 2.0.10
-  - ">= 2.1.5"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2015-3900.yml

@@ -1,20 +0,0 @@
----
-gem: rubygems-update
-library: rubygems
-cve: 2015-3900
-osvdb: 122162
-url: https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007/?fid=6356
-title: |
-  RubyGems remote_fetcher.rb api_endpoint() Function Missing SRV Record
-  Hostname Validation Request Hijacking
-date: 2015-05-14
-description: |
-  RubyGems contains a flaw in the api_endpoint() function in remote_fetcher.rb
-  that is triggered when handling hostnames in SRV records. With a specially
-  crafted response, a context-dependent attacker may conduct DNS hijacking
-  attacks.
-cvss_v2: 5.0
-patched_versions:
-  - ~> 2.0.16
-  - ~> 2.2.4
-  - ">= 2.4.7"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2015-4020.yml

@@ -1,20 +0,0 @@
----
-gem: rubygems-update
-library: rubygems
-cve: 2015-4020
-url: https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478
-title: |
-  RubyGems remote_fetcher.rb api_endpoint() Function Missing SRV Record
-  Hostname Validation Request Hijacking
-date: 2015-06-08
-description: |
-  RubyGems contains a flaw in the api_endpoint() function in remote_fetcher.rb
-  that is triggered when handling hostnames in SRV records. With a specially
-  crafted response, a context-dependent attacker may conduct DNS hijacking
-  attacks. This vulnerability is due to an incomplete fix for CVE-2015-3900,
-  which allowed redirection to an arbitrary gem server in any security domain. 
-cvss_v2: 5.0
-patched_versions:
-  - ~> 2.0.17
-  - ~> 2.2.5
-  - ">= 2.4.8"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0899.yml

@@ -1,16 +0,0 @@
----
-gem: rubygems-update
-library: rubygems
-cve: 2017-0899
-url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
-title: RubyGems ANSI escape sequence vulnerability
-date: 2017-08-29
-description: |
-  RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem
-  specifications that include terminal escape characters. Printing the gem
-  specification would execute terminal escape sequences.
-cvss_v2: 7.5
-patched_versions:
-  - ">= 2.4.5.3"
-  - ">= 2.5.2.1"
-  - ">= 2.6.13"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0900.yml

@@ -1,16 +0,0 @@
----
-gem: rubygems-update
-library: rubygems
-cve: 2017-0900
-url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
-title: RubyGems DoS vulnerability in the query command
-date: 2017-08-29
-description: |
-  RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem
-  specifications to cause a denial of service attack against RubyGems clients
-  who have issued a `query` command.
-cvss_v2: 5.0
-patched_versions:
-  - ">= 2.4.5.3"
-  - ">= 2.5.2.1"
-  - ">= 2.6.13"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0901.yml

@@ -1,16 +0,0 @@
----
-gem: rubygems-update
-library: rubygems
-cve: 2017-0901
-url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
-title: RubyGems vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files
-date: 2017-08-29
-description: |
-  RubyGems version 2.6.12 and earlier fails to validate specification names,
-  allowing a maliciously crafted gem to potentially overwrite any file on the
-  filesystem.
-cvss_v2: 6.4
-patched_versions:
-  - ">= 2.4.5.3"
-  - ">= 2.5.2.1"
-  - ">= 2.6.13"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0902.yml

@@ -1,16 +0,0 @@
----
-gem: rubygems-update
-library: rubygems
-cve: 2017-0902
-url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
-title: RubyGems DNS request hijacking vulnerability
-date: 2017-08-29
-description: |
-  RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking
-  vulnerability that allows a MITM attacker to force the RubyGems client to
-  down load and install gems from a server that the attacker controls.
-cvss_v2: 6.8
-patched_versions:
-  - ">= 2.4.5.3"
-  - ">= 2.5.2.1"
-  - ">= 2.6.13"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0903.yml

@@ -1,17 +0,0 @@
----
-gem: rubygems-update
-library: rubygems
-cve: 2017-0903
-url: https://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
-title: Unsafe Object Deserialization Vulnerability in RubyGems
-date: 2017-10-09
-description: |
-  There is a possible unsafe object deserialization vulnerability in RubyGems.
-  It is possible for YAML deserialization of gem specifications to bypass class
-  white lists. Specially crafted serialized objects can possibly be used to
-  escalate to remote code execution.
-cvss_v2: 7.5
-unaffected_versions:
-  - "< 2.0.0"
-patched_versions:
-  - ">= 2.6.14"

data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8320.yml

@@ -1,21 +0,0 @@
----
-gem: rubygems-update
-library: rubygems
-cve: 2019-8320
-url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
-title: Delete directory using symlink when decompressing tar
-date: 2019-03-05
-description: |
-  A Directory Traversal issue was discovered in RubyGems 2.7.6 and later
-  through 3.0.2. Before making new directories or touching files (which now
-  include path-checking code for symlinks), it would delete the target
-  destination. If that destination was hidden behind a symlink, a malicious gem
-  could delete arbitrary files on the user’s machine, presuming the attacker
-  could guess at paths. Given how frequently gem is run as sudo, and how
-  predictable paths are on modern systems (/tmp, /usr, etc.), this could
-  likely lead to data loss or an unusable system.
-unaffected_versions:
-  - "< 2.7.6"
-patched_versions:
-  - ">= 3.0.3"
-  - "~> 2.7.9"