bundler-audit 0.7.0.1 → 0.8.0.rc1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (597) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ruby.yml +28 -0
  3. data/.gitignore +1 -0
  4. data/.rspec +1 -1
  5. data/ChangeLog.md +57 -0
  6. data/Gemfile +1 -1
  7. data/README.md +61 -4
  8. data/Rakefile +0 -23
  9. data/bundler-audit.gemspec +0 -7
  10. data/lib/bundler/audit/advisory.rb +12 -1
  11. data/lib/bundler/audit/cli.rb +86 -80
  12. data/lib/bundler/audit/cli/formats.rb +144 -0
  13. data/lib/bundler/audit/cli/formats/json.rb +51 -0
  14. data/lib/bundler/audit/cli/formats/text.rb +116 -0
  15. data/lib/bundler/audit/configuration.rb +101 -0
  16. data/lib/bundler/audit/database.rb +135 -28
  17. data/lib/bundler/audit/report.rb +149 -0
  18. data/lib/bundler/audit/results.rb +19 -0
  19. data/lib/bundler/audit/results/insecure_source.rb +75 -0
  20. data/lib/bundler/audit/results/result.rb +21 -0
  21. data/lib/bundler/audit/results/unpatched_gem.rb +94 -0
  22. data/lib/bundler/audit/scanner.rb +95 -22
  23. data/lib/bundler/audit/task.rb +2 -4
  24. data/lib/bundler/audit/version.rb +1 -1
  25. data/spec/advisory_spec.rb +34 -15
  26. data/spec/bundle/unpatched_gems_with_dot_configuration/.bundler-audit.yml +3 -0
  27. data/spec/bundle/unpatched_gems_with_dot_configuration/Gemfile +3 -0
  28. data/spec/cli/formats/json_spec.rb +113 -0
  29. data/spec/cli/formats/text_spec.rb +179 -0
  30. data/spec/cli/formats_spec.rb +86 -0
  31. data/spec/cli_spec.rb +29 -17
  32. data/spec/configuration_spec.rb +70 -0
  33. data/spec/database_spec.rb +248 -51
  34. data/spec/fixtures/advisory/CVE-2020-1234.yml +19 -0
  35. data/spec/fixtures/{not_a_hash.yml → advisory/not_a_hash.yml} +0 -0
  36. data/spec/fixtures/config/bad/ignore_contains_a_non_string.yml +4 -0
  37. data/spec/fixtures/config/bad/ignore_is_not_an_array.yml +3 -0
  38. data/spec/fixtures/config/valid.yml +4 -0
  39. data/spec/fixtures/lib/bundler/audit/cli/formats/bad.rb +19 -0
  40. data/spec/fixtures/lib/bundler/audit/cli/formats/good.rb +19 -0
  41. data/spec/integration_spec.rb +18 -4
  42. data/spec/report_spec.rb +98 -0
  43. data/spec/results/insecure_source_spec.rb +47 -0
  44. data/spec/results/result_spec.rb +10 -0
  45. data/spec/results/unpatched_gem_spec.rb +123 -0
  46. data/spec/scanner_spec.rb +66 -35
  47. data/spec/spec_helper.rb +38 -25
  48. metadata +31 -554
  49. data/.gitmodules +0 -3
  50. data/.travis.yml +0 -14
  51. data/data/ruby-advisory-db.ts +0 -1
  52. data/data/ruby-advisory-db/.gitignore +0 -1
  53. data/data/ruby-advisory-db/.rspec +0 -1
  54. data/data/ruby-advisory-db/.travis.yml +0 -12
  55. data/data/ruby-advisory-db/CONTRIBUTING.md +0 -71
  56. data/data/ruby-advisory-db/CONTRIBUTORS.md +0 -41
  57. data/data/ruby-advisory-db/Gemfile +0 -11
  58. data/data/ruby-advisory-db/LICENSE.txt +0 -5
  59. data/data/ruby-advisory-db/README.md +0 -133
  60. data/data/ruby-advisory-db/Rakefile +0 -22
  61. data/data/ruby-advisory-db/gems/Arabic-Prawn/CVE-2014-2322.yml +0 -12
  62. data/data/ruby-advisory-db/gems/RedCloth/CVE-2012-6684.yml +0 -21
  63. data/data/ruby-advisory-db/gems/VladTheEnterprising/CVE-2014-4995.yml +0 -13
  64. data/data/ruby-advisory-db/gems/VladTheEnterprising/CVE-2014-4996.yml +0 -13
  65. data/data/ruby-advisory-db/gems/actionmailer/CVE-2013-4389.yml +0 -17
  66. data/data/ruby-advisory-db/gems/actionpack-page_caching/CVE-2020-8159.yml +0 -40
  67. data/data/ruby-advisory-db/gems/actionpack/CVE-2012-1099.yml +0 -26
  68. data/data/ruby-advisory-db/gems/actionpack/CVE-2012-3424.yml +0 -28
  69. data/data/ruby-advisory-db/gems/actionpack/CVE-2012-3463.yml +0 -26
  70. data/data/ruby-advisory-db/gems/actionpack/CVE-2012-3465.yml +0 -23
  71. data/data/ruby-advisory-db/gems/actionpack/CVE-2013-0156.yml +0 -24
  72. data/data/ruby-advisory-db/gems/actionpack/CVE-2013-1855.yml +0 -20
  73. data/data/ruby-advisory-db/gems/actionpack/CVE-2013-1857.yml +0 -23
  74. data/data/ruby-advisory-db/gems/actionpack/CVE-2014-0081.yml +0 -24
  75. data/data/ruby-advisory-db/gems/actionpack/CVE-2014-0082.yml +0 -22
  76. data/data/ruby-advisory-db/gems/actionpack/CVE-2014-0130.yml +0 -23
  77. data/data/ruby-advisory-db/gems/actionpack/CVE-2014-7818.yml +0 -24
  78. data/data/ruby-advisory-db/gems/actionpack/CVE-2014-7829.yml +0 -26
  79. data/data/ruby-advisory-db/gems/actionpack/CVE-2015-7576.yml +0 -119
  80. data/data/ruby-advisory-db/gems/actionpack/CVE-2015-7581.yml +0 -55
  81. data/data/ruby-advisory-db/gems/actionpack/CVE-2016-0751.yml +0 -74
  82. data/data/ruby-advisory-db/gems/actionpack/CVE-2016-0752.yml +0 -96
  83. data/data/ruby-advisory-db/gems/actionpack/CVE-2016-2097.yml +0 -91
  84. data/data/ruby-advisory-db/gems/actionpack/CVE-2016-2098.yml +0 -89
  85. data/data/ruby-advisory-db/gems/actionpack/CVE-2016-6316.yml +0 -57
  86. data/data/ruby-advisory-db/gems/actionpack/CVE-2020-8164.yml +0 -49
  87. data/data/ruby-advisory-db/gems/actionpack/CVE-2020-8166.yml +0 -31
  88. data/data/ruby-advisory-db/gems/actionpack/OSVDB-100524.yml +0 -20
  89. data/data/ruby-advisory-db/gems/actionpack/OSVDB-100525.yml +0 -21
  90. data/data/ruby-advisory-db/gems/actionpack/OSVDB-100526.yml +0 -27
  91. data/data/ruby-advisory-db/gems/actionpack/OSVDB-100527.yml +0 -24
  92. data/data/ruby-advisory-db/gems/actionpack/OSVDB-100528.yml +0 -22
  93. data/data/ruby-advisory-db/gems/actionpack/OSVDB-74616.yml +0 -18
  94. data/data/ruby-advisory-db/gems/actionpack/OSVDB-77199.yml +0 -23
  95. data/data/ruby-advisory-db/gems/actionview/CVE-2016-0752.yml +0 -95
  96. data/data/ruby-advisory-db/gems/actionview/CVE-2016-2097.yml +0 -89
  97. data/data/ruby-advisory-db/gems/actionview/CVE-2016-6316.yml +0 -56
  98. data/data/ruby-advisory-db/gems/actionview/CVE-2019-5418.yml +0 -98
  99. data/data/ruby-advisory-db/gems/actionview/CVE-2019-5419.yml +0 -95
  100. data/data/ruby-advisory-db/gems/actionview/CVE-2020-5267.yml +0 -69
  101. data/data/ruby-advisory-db/gems/actionview/CVE-2020-8163.yml +0 -29
  102. data/data/ruby-advisory-db/gems/actionview/CVE-2020-8167.yml +0 -45
  103. data/data/ruby-advisory-db/gems/active-support/CVE-2018-3779.yml +0 -17
  104. data/data/ruby-advisory-db/gems/activejob/CVE-2018-16476.yml +0 -36
  105. data/data/ruby-advisory-db/gems/activemodel/CVE-2016-0753.yml +0 -95
  106. data/data/ruby-advisory-db/gems/activerecord-jdbc-adapter/OSVDB-114854.yml +0 -20
  107. data/data/ruby-advisory-db/gems/activerecord-oracle_enhanced-adapter/OSVDB-95376.yml +0 -15
  108. data/data/ruby-advisory-db/gems/activerecord/CVE-2012-2660.yml +0 -24
  109. data/data/ruby-advisory-db/gems/activerecord/CVE-2012-2661.yml +0 -25
  110. data/data/ruby-advisory-db/gems/activerecord/CVE-2013-0155.yml +0 -24
  111. data/data/ruby-advisory-db/gems/activerecord/CVE-2013-0276.yml +0 -21
  112. data/data/ruby-advisory-db/gems/activerecord/CVE-2013-0277.yml +0 -23
  113. data/data/ruby-advisory-db/gems/activerecord/CVE-2013-1854.yml +0 -26
  114. data/data/ruby-advisory-db/gems/activerecord/CVE-2014-0080.yml +0 -23
  115. data/data/ruby-advisory-db/gems/activerecord/CVE-2014-3482.yml +0 -23
  116. data/data/ruby-advisory-db/gems/activerecord/CVE-2014-3483.yml +0 -24
  117. data/data/ruby-advisory-db/gems/activerecord/CVE-2014-3514.yml +0 -23
  118. data/data/ruby-advisory-db/gems/activerecord/CVE-2015-7577.yml +0 -110
  119. data/data/ruby-advisory-db/gems/activerecord/CVE-2016-6317.yml +0 -73
  120. data/data/ruby-advisory-db/gems/activerecord/OSVDB-88661.yml +0 -20
  121. data/data/ruby-advisory-db/gems/activeresource/CVE-2020-8151.yml +0 -48
  122. data/data/ruby-advisory-db/gems/activeresource/OSVDB-95749.yml +0 -15
  123. data/data/ruby-advisory-db/gems/activestorage/CVE-2018-16477.yml +0 -43
  124. data/data/ruby-advisory-db/gems/activestorage/CVE-2020-8162.yml +0 -31
  125. data/data/ruby-advisory-db/gems/activesupport/CVE-2012-1098.yml +0 -26
  126. data/data/ruby-advisory-db/gems/activesupport/CVE-2012-3464.yml +0 -23
  127. data/data/ruby-advisory-db/gems/activesupport/CVE-2013-0333.yml +0 -25
  128. data/data/ruby-advisory-db/gems/activesupport/CVE-2013-1856.yml +0 -28
  129. data/data/ruby-advisory-db/gems/activesupport/CVE-2015-3226.yml +0 -55
  130. data/data/ruby-advisory-db/gems/activesupport/CVE-2015-3227.yml +0 -33
  131. data/data/ruby-advisory-db/gems/activesupport/CVE-2020-8165.yml +0 -41
  132. data/data/ruby-advisory-db/gems/administrate/CVE-2016-3098.yml +0 -14
  133. data/data/ruby-advisory-db/gems/administrate/CVE-2020-5257.yml +0 -24
  134. data/data/ruby-advisory-db/gems/aescrypt/CVE-2013-7463.yml +0 -10
  135. data/data/ruby-advisory-db/gems/airbrake-ruby/CVE-2019-16060.yml +0 -18
  136. data/data/ruby-advisory-db/gems/archive-tar-minitar/CVE-2016-10173.yml +0 -16
  137. data/data/ruby-advisory-db/gems/as/OSVDB-112683.yml +0 -10
  138. data/data/ruby-advisory-db/gems/authlogic/CVE-2012-6497.yml +0 -15
  139. data/data/ruby-advisory-db/gems/auto_awesomplete/OSVDB-132800.yml +0 -11
  140. data/data/ruby-advisory-db/gems/auto_select2/OSVDB-132800.yml +0 -13
  141. data/data/ruby-advisory-db/gems/awesome-bot/CVE-2019-15224.yml +0 -19
  142. data/data/ruby-advisory-db/gems/awesome_spawn/CVE-2014-0156.yml +0 -19
  143. data/data/ruby-advisory-db/gems/backup-agoddard/CVE-2014-4993.yml +0 -8
  144. data/data/ruby-advisory-db/gems/backup_checksum/CVE-2014-4993.yml +0 -12
  145. data/data/ruby-advisory-db/gems/backup_checksum/OSVDB-108570.yml +0 -10
  146. data/data/ruby-advisory-db/gems/bcrypt-ruby/OSVDB-62067.yml +0 -19
  147. data/data/ruby-advisory-db/gems/bcrypt/OSVDB-62067.yml +0 -17
  148. data/data/ruby-advisory-db/gems/bibtex-ruby/CVE-2019-10780.yml +0 -16
  149. data/data/ruby-advisory-db/gems/bio-basespace-sdk/CVE-2013-7111.yml +0 -8
  150. data/data/ruby-advisory-db/gems/bitcoin_vanity/CVE-2019-15224.yml +0 -18
  151. data/data/ruby-advisory-db/gems/blockchain_wallet/CVE-2019-15224.yml +0 -19
  152. data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2016-10735.yml +0 -20
  153. data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2019-10842.yml +0 -25
  154. data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2019-8331.yml +0 -20
  155. data/data/ruby-advisory-db/gems/bootstrap/CVE-2016-10735.yml +0 -20
  156. data/data/ruby-advisory-db/gems/bootstrap/CVE-2018-14040.yml +0 -24
  157. data/data/ruby-advisory-db/gems/bootstrap/CVE-2019-8331.yml +0 -20
  158. data/data/ruby-advisory-db/gems/brakeman/CVE-2019-18409.yml +0 -26
  159. data/data/ruby-advisory-db/gems/brbackup/CVE-2014-5004.yml +0 -11
  160. data/data/ruby-advisory-db/gems/brbackup/OSVDB-108899.yml +0 -12
  161. data/data/ruby-advisory-db/gems/brbackup/OSVDB-108900.yml +0 -11
  162. data/data/ruby-advisory-db/gems/bson/CVE-2015-4411.yml +0 -21
  163. data/data/ruby-advisory-db/gems/bson/CVE-2015-4412.yml +0 -18
  164. data/data/ruby-advisory-db/gems/builder/OSVDB-95668.yml +0 -13
  165. data/data/ruby-advisory-db/gems/bundler/CVE-2013-0334.yml +0 -15
  166. data/data/ruby-advisory-db/gems/bundler/OSVDB-115090.yml +0 -13
  167. data/data/ruby-advisory-db/gems/bundler/OSVDB-115091.yml +0 -12
  168. data/data/ruby-advisory-db/gems/bundler/OSVDB-115917.yml +0 -12
  169. data/data/ruby-advisory-db/gems/cairo/CVE-2017-7475.yml +0 -15
  170. data/data/ruby-advisory-db/gems/cap-strap/CVE-2014-4992.yml +0 -8
  171. data/data/ruby-advisory-db/gems/cap-strap/OSVDB-108575.yml +0 -7
  172. data/data/ruby-advisory-db/gems/capistrano-colors/CVE-2019-15224.yml +0 -19
  173. data/data/ruby-advisory-db/gems/chartkick/CVE-2019-12732.yml +0 -21
  174. data/data/ruby-advisory-db/gems/chartkick/CVE-2019-18841.yml +0 -13
  175. data/data/ruby-advisory-db/gems/chloride/CVE-2018-6517.yml +0 -17
  176. data/data/ruby-advisory-db/gems/ciborg/CVE-2014-5003.yml +0 -8
  177. data/data/ruby-advisory-db/gems/cocaine/CVE-2013-4457.yml +0 -15
  178. data/data/ruby-advisory-db/gems/codders-dataset/CVE-2014-4991.yml +0 -8
  179. data/data/ruby-advisory-db/gems/coin_base/CVE-2019-15224.yml +0 -18
  180. data/data/ruby-advisory-db/gems/colorscore/CVE-2015-7541.yml +0 -21
  181. data/data/ruby-advisory-db/gems/coming-soon/CVE-2019-15224.yml +0 -18
  182. data/data/ruby-advisory-db/gems/command_wrap/CVE-2013-1875.yml +0 -9
  183. data/data/ruby-advisory-db/gems/consul/CVE-2019-16377.yml +0 -15
  184. data/data/ruby-advisory-db/gems/crack/CVE-2013-1800.yml +0 -17
  185. data/data/ruby-advisory-db/gems/cremefraiche/CVE-2013-2090.yml +0 -11
  186. data/data/ruby-advisory-db/gems/cron_parser/CVE-2019-15224.yml +0 -20
  187. data/data/ruby-advisory-db/gems/curb/OSVDB-114600.yml +0 -12
  188. data/data/ruby-advisory-db/gems/curl/CVE-2013-2617.yml +0 -13
  189. data/data/ruby-advisory-db/gems/datagrid/CVE-2019-14281.yml +0 -14
  190. data/data/ruby-advisory-db/gems/delayed_job_web/CVE-2017-12097.yml +0 -17
  191. data/data/ruby-advisory-db/gems/devise-two-factor/CVE-2015-7225.yml +0 -22
  192. data/data/ruby-advisory-db/gems/devise/CVE-2013-0233.yml +0 -20
  193. data/data/ruby-advisory-db/gems/devise/CVE-2015-8314.yml +0 -14
  194. data/data/ruby-advisory-db/gems/devise/CVE-2019-16109.yml +0 -13
  195. data/data/ruby-advisory-db/gems/devise/CVE-2019-5421.yml +0 -16
  196. data/data/ruby-advisory-db/gems/devise/OSVDB-114435.yml +0 -17
  197. data/data/ruby-advisory-db/gems/doge-coin/CVE-2019-15224.yml +0 -19
  198. data/data/ruby-advisory-db/gems/doorkeeper-openid_connect/CVE-2019-9837.yml +0 -16
  199. data/data/ruby-advisory-db/gems/doorkeeper/CVE-2014-8144.yml +0 -26
  200. data/data/ruby-advisory-db/gems/doorkeeper/CVE-2016-6582.yml +0 -43
  201. data/data/ruby-advisory-db/gems/doorkeeper/CVE-2018-1000088.yml +0 -39
  202. data/data/ruby-advisory-db/gems/doorkeeper/CVE-2018-1000211.yml +0 -39
  203. data/data/ruby-advisory-db/gems/doorkeeper/CVE-2020-10187.yml +0 -34
  204. data/data/ruby-advisory-db/gems/doorkeeper/OSVDB-118830.yml +0 -17
  205. data/data/ruby-advisory-db/gems/dragonfly/CVE-2013-1756.yml +0 -16
  206. data/data/ruby-advisory-db/gems/dragonfly/CVE-2013-5671.yml +0 -14
  207. data/data/ruby-advisory-db/gems/dragonfly/OSVDB-110439.yml +0 -13
  208. data/data/ruby-advisory-db/gems/dragonfly/OSVDB-97854.yml +0 -12
  209. data/data/ruby-advisory-db/gems/easymon/CVE-2018-1000855.yml +0 -16
  210. data/data/ruby-advisory-db/gems/echor/CVE-2014-1834.yml +0 -12
  211. data/data/ruby-advisory-db/gems/echor/CVE-2014-1835.yml +0 -11
  212. data/data/ruby-advisory-db/gems/ember-source/CVE-2013-4170.yml +0 -25
  213. data/data/ruby-advisory-db/gems/ember-source/CVE-2014-0013.yml +0 -33
  214. data/data/ruby-advisory-db/gems/ember-source/CVE-2014-0014.yml +0 -30
  215. data/data/ruby-advisory-db/gems/ember-source/CVE-2014-0046.yml +0 -26
  216. data/data/ruby-advisory-db/gems/ember-source/CVE-2015-1866.yml +0 -26
  217. data/data/ruby-advisory-db/gems/ember-source/CVE-2015-7565.yml +0 -30
  218. data/data/ruby-advisory-db/gems/enum_column3/OSVDB-94679.yml +0 -9
  219. data/data/ruby-advisory-db/gems/espeak-ruby/CVE-2016-10193.yml +0 -15
  220. data/data/ruby-advisory-db/gems/excon/CVE-2019-16779.yml +0 -23
  221. data/data/ruby-advisory-db/gems/extlib/CVE-2013-1802.yml +0 -18
  222. data/data/ruby-advisory-db/gems/fastreader/CVE-2013-2615.yml +0 -13
  223. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2013-7222.yml +0 -17
  224. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2013-7223.yml +0 -19
  225. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2013-7224.yml +0 -17
  226. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2013-7225.yml +0 -19
  227. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2013-7249.yml +0 -16
  228. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2014-5441.yml +0 -19
  229. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2015-1585.yml +0 -17
  230. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2018-1000842.yml +0 -23
  231. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2018-20975.yml +0 -12
  232. data/data/ruby-advisory-db/gems/faye/CVE-2020-11020.yml +0 -91
  233. data/data/ruby-advisory-db/gems/features/CVE-2013-4318.yml +0 -8
  234. data/data/ruby-advisory-db/gems/festivaltts4r/CVE-2016-10194.yml +0 -12
  235. data/data/ruby-advisory-db/gems/ffi/CVE-2018-1000201.yml +0 -22
  236. data/data/ruby-advisory-db/gems/field_test/CVE-2019-13146.yml +0 -20
  237. data/data/ruby-advisory-db/gems/fileutils/CVE-2013-2516.yml +0 -11
  238. data/data/ruby-advisory-db/gems/fileutils/OSVDB-90715.yml +0 -7
  239. data/data/ruby-advisory-db/gems/fileutils/OSVDB-90716.yml +0 -7
  240. data/data/ruby-advisory-db/gems/fileutils/OSVDB-90718.yml +0 -7
  241. data/data/ruby-advisory-db/gems/flash_tool/CVE-2013-2513.yml +0 -8
  242. data/data/ruby-advisory-db/gems/flavour_saver/OSVDB-110796.yml +0 -14
  243. data/data/ruby-advisory-db/gems/flukso4r/OSVDB-101577.yml +0 -7
  244. data/data/ruby-advisory-db/gems/fog-dragonfly/CVE-2013-1756.yml +0 -18
  245. data/data/ruby-advisory-db/gems/fog-dragonfly/CVE-2013-5671.yml +0 -16
  246. data/data/ruby-advisory-db/gems/fog-dragonfly/OSVDB-110439.yml +0 -15
  247. data/data/ruby-advisory-db/gems/fog-dragonfly/OSVDB-97854.yml +0 -12
  248. data/data/ruby-advisory-db/gems/ftpd/CVE-2013-2512.yml +0 -18
  249. data/data/ruby-advisory-db/gems/geminabox/CVE-2017-16792.yml +0 -21
  250. data/data/ruby-advisory-db/gems/gemirro/CVE-2017-16833.yml +0 -22
  251. data/data/ruby-advisory-db/gems/git-fastclone/CVE-2015-8968.yml +0 -21
  252. data/data/ruby-advisory-db/gems/git-fastclone/CVE-2015-8969.yml +0 -13
  253. data/data/ruby-advisory-db/gems/gitlab-grit/CVE-2013-4489.yml +0 -14
  254. data/data/ruby-advisory-db/gems/gnms/OSVDB-108594.yml +0 -7
  255. data/data/ruby-advisory-db/gems/gollum-grit_adapter/CVE-2014-9489.yml +0 -23
  256. data/data/ruby-advisory-db/gems/gollum/CVE-2015-7314.yml +0 -13
  257. data/data/ruby-advisory-db/gems/grape/CVE-2018-3769.yml +0 -20
  258. data/data/ruby-advisory-db/gems/gtk2/CVE-2007-6183.yml +0 -20
  259. data/data/ruby-advisory-db/gems/gyazo/CVE-2014-4994.yml +0 -10
  260. data/data/ruby-advisory-db/gems/haml/CVE-2017-1002201.yml +0 -19
  261. data/data/ruby-advisory-db/gems/handlebars-source/OSVDB-131671.yml +0 -17
  262. data/data/ruby-advisory-db/gems/http/CVE-2015-1828.yml +0 -14
  263. data/data/ruby-advisory-db/gems/httparty/CVE-2013-1801.yml +0 -14
  264. data/data/ruby-advisory-db/gems/i18n/CVE-2014-10077.yml +0 -18
  265. data/data/ruby-advisory-db/gems/i18n/OSVDB-100528.yml +0 -17
  266. data/data/ruby-advisory-db/gems/iodine/GHSA-85rf-xh54-whp3.yml +0 -21
  267. data/data/ruby-advisory-db/gems/jekyll/CVE-2018-17567.yml +0 -14
  268. data/data/ruby-advisory-db/gems/jquery-rails/CVE-2015-1840.yml +0 -36
  269. data/data/ruby-advisory-db/gems/jquery-rails/CVE-2019-11358.yml +0 -24
  270. data/data/ruby-advisory-db/gems/jquery-ui-rails/CVE-2016-7103.yml +0 -23
  271. data/data/ruby-advisory-db/gems/jquery-ujs/CVE-2015-1840.yml +0 -35
  272. data/data/ruby-advisory-db/gems/jruby-openssl/CVE-2009-4123.yml +0 -16
  273. data/data/ruby-advisory-db/gems/jruby-sandbox/OSVDB-106279.yml +0 -12
  274. data/data/ruby-advisory-db/gems/json-jwt/CVE-2018-1000539.yml +0 -21
  275. data/data/ruby-advisory-db/gems/json-jwt/CVE-2019-18848.yml +0 -15
  276. data/data/ruby-advisory-db/gems/json/CVE-2013-0269.yml +0 -20
  277. data/data/ruby-advisory-db/gems/json/CVE-2020-10663.yml +0 -35
  278. data/data/ruby-advisory-db/gems/json/OSVDB-101157.yml +0 -14
  279. data/data/ruby-advisory-db/gems/kafo/CVE-2014-0135.yml +0 -15
  280. data/data/ruby-advisory-db/gems/kajam/CVE-2014-4999.yml +0 -12
  281. data/data/ruby-advisory-db/gems/kajam/OSVDB-108530.yml +0 -11
  282. data/data/ruby-advisory-db/gems/kaminari/CVE-2020-11082.yml +0 -34
  283. data/data/ruby-advisory-db/gems/karo/OSVDB-108573.yml +0 -10
  284. data/data/ruby-advisory-db/gems/karteek-docsplit/CVE-2013-1933.yml +0 -9
  285. data/data/ruby-advisory-db/gems/kcapifony/CVE-2014-5001.yml +0 -8
  286. data/data/ruby-advisory-db/gems/kcapifony/OSVDB-108572.yml +0 -7
  287. data/data/ruby-advisory-db/gems/kelredd-pruview/CVE-2013-1947.yml +0 -9
  288. data/data/ruby-advisory-db/gems/kompanee-recipes/OSVDB-108593.yml +0 -12
  289. data/data/ruby-advisory-db/gems/lawn-login/CVE-2014-5000.yml +0 -8
  290. data/data/ruby-advisory-db/gems/ldap_fluff/CVE-2012-5604.yml +0 -15
  291. data/data/ruby-advisory-db/gems/ldoce/CVE-2013-1911.yml +0 -9
  292. data/data/ruby-advisory-db/gems/lean-ruport/CVE-2014-4998.yml +0 -8
  293. data/data/ruby-advisory-db/gems/lingq/OSVDB-108585.yml +0 -7
  294. data/data/ruby-advisory-db/gems/lita_coin/CVE-2019-15224.yml +0 -18
  295. data/data/ruby-advisory-db/gems/loofah/CVE-2018-16468.yml +0 -16
  296. data/data/ruby-advisory-db/gems/loofah/CVE-2018-8048.yml +0 -11
  297. data/data/ruby-advisory-db/gems/loofah/CVE-2019-15587.yml +0 -13
  298. data/data/ruby-advisory-db/gems/loofah/OSVDB-90945.yml +0 -21
  299. data/data/ruby-advisory-db/gems/lynx/CVE-2014-5002.yml +0 -11
  300. data/data/ruby-advisory-db/gems/lynx/OSVDB-108579.yml +0 -7
  301. data/data/ruby-advisory-db/gems/mail/CVE-2011-0739.yml +0 -21
  302. data/data/ruby-advisory-db/gems/mail/CVE-2012-2139.yml +0 -14
  303. data/data/ruby-advisory-db/gems/mail/CVE-2012-2140.yml +0 -16
  304. data/data/ruby-advisory-db/gems/mail/CVE-2015-9097.yml +0 -26
  305. data/data/ruby-advisory-db/gems/mapbox-rails/OSVDB-129854.yml +0 -25
  306. data/data/ruby-advisory-db/gems/mapbox-rails/OSVDB-132871.yml +0 -26
  307. data/data/ruby-advisory-db/gems/marginalia/CVE-2019-1010191.yml +0 -17
  308. data/data/ruby-advisory-db/gems/matestack-ui-core/CVE-2020-5241.yml +0 -18
  309. data/data/ruby-advisory-db/gems/md2pdf/CVE-2013-1948.yml +0 -9
  310. data/data/ruby-advisory-db/gems/mini_magick/CVE-2013-2616.yml +0 -15
  311. data/data/ruby-advisory-db/gems/mini_magick/CVE-2019-13574.yml +0 -14
  312. data/data/ruby-advisory-db/gems/minitar/CVE-2016-10173.yml +0 -20
  313. data/data/ruby-advisory-db/gems/moped/CVE-2015-4410.yml +0 -17
  314. data/data/ruby-advisory-db/gems/multi_xml/CVE-2013-0175.yml +0 -16
  315. data/data/ruby-advisory-db/gems/mustache-js-rails/OSVDB-131671.yml +0 -17
  316. data/data/ruby-advisory-db/gems/mysql-binuuid-rails/CVE-2018-18476.yml +0 -21
  317. data/data/ruby-advisory-db/gems/net-ldap/CVE-2014-0083.yml +0 -14
  318. data/data/ruby-advisory-db/gems/net-ldap/CVE-2017-17718.yml +0 -17
  319. data/data/ruby-advisory-db/gems/netaddr/CVE-2019-17383.yml +0 -13
  320. data/data/ruby-advisory-db/gems/newrelic_rpm/CVE-2013-0284.yml +0 -17
  321. data/data/ruby-advisory-db/gems/nokogiri/CVE-2012-6685.yml +0 -15
  322. data/data/ruby-advisory-db/gems/nokogiri/CVE-2013-6460.yml +0 -18
  323. data/data/ruby-advisory-db/gems/nokogiri/CVE-2013-6461.yml +0 -15
  324. data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-1819.yml +0 -52
  325. data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-5312.yml +0 -92
  326. data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-7499.yml +0 -37
  327. data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-8806.yml +0 -42
  328. data/data/ruby-advisory-db/gems/nokogiri/CVE-2016-4658.yml +0 -33
  329. data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-15412.yml +0 -23
  330. data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-16932.yml +0 -21
  331. data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-5029.yml +0 -44
  332. data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-9050.yml +0 -60
  333. data/data/ruby-advisory-db/gems/nokogiri/CVE-2018-14404.yml +0 -69
  334. data/data/ruby-advisory-db/gems/nokogiri/CVE-2018-8048.yml +0 -36
  335. data/data/ruby-advisory-db/gems/nokogiri/CVE-2019-11068.yml +0 -49
  336. data/data/ruby-advisory-db/gems/nokogiri/CVE-2019-13117.yml +0 -80
  337. data/data/ruby-advisory-db/gems/nokogiri/CVE-2019-5477.yml +0 -31
  338. data/data/ruby-advisory-db/gems/nokogiri/CVE-2020-7595.yml +0 -20
  339. data/data/ruby-advisory-db/gems/nokogiri/OSVDB-118481.yml +0 -15
  340. data/data/ruby-advisory-db/gems/nori/CVE-2013-0285.yml +0 -19
  341. data/data/ruby-advisory-db/gems/omniauth-facebook/CVE-2013-4562.yml +0 -22
  342. data/data/ruby-advisory-db/gems/omniauth-facebook/CVE-2013-4593.yml +0 -17
  343. data/data/ruby-advisory-db/gems/omniauth-oauth2/CVE-2012-6134.yml +0 -16
  344. data/data/ruby-advisory-db/gems/omniauth-saml/CVE-2017-11430.yml +0 -17
  345. data/data/ruby-advisory-db/gems/omniauth/CVE-2015-9284.yml +0 -25
  346. data/data/ruby-advisory-db/gems/omniauth/CVE-2017-18076.yml +0 -18
  347. data/data/ruby-advisory-db/gems/omniauth_amazon/CVE-2019-15224.yml +0 -19
  348. data/data/ruby-advisory-db/gems/open-uri-cached/OSVDB-121701.yml +0 -13
  349. data/data/ruby-advisory-db/gems/openssl/CVE-2016-7798.yml +0 -16
  350. data/data/ruby-advisory-db/gems/ox/CVE-2017-15928.yml +0 -16
  351. data/data/ruby-advisory-db/gems/ox/CVE-2017-16229.yml +0 -16
  352. data/data/ruby-advisory-db/gems/padrino-contrib/CVE-2019-16145.yml +0 -11
  353. data/data/ruby-advisory-db/gems/paperclip/CVE-2015-2963.yml +0 -16
  354. data/data/ruby-advisory-db/gems/paperclip/CVE-2017-0889.yml +0 -23
  355. data/data/ruby-advisory-db/gems/paperclip/OSVDB-103151.yml +0 -13
  356. data/data/ruby-advisory-db/gems/paranoid2/CVE-2019-13589.yml +0 -16
  357. data/data/ruby-advisory-db/gems/paratrooper-newrelic/CVE-2014-1234.yml +0 -13
  358. data/data/ruby-advisory-db/gems/paratrooper-pingdom/CVE-2014-1233.yml +0 -13
  359. data/data/ruby-advisory-db/gems/passenger/CVE-2013-2119.yml +0 -15
  360. data/data/ruby-advisory-db/gems/passenger/CVE-2013-4136.yml +0 -14
  361. data/data/ruby-advisory-db/gems/passenger/CVE-2014-1831.yml +0 -13
  362. data/data/ruby-advisory-db/gems/passenger/CVE-2014-1832.yml +0 -13
  363. data/data/ruby-advisory-db/gems/passenger/CVE-2015-7519.yml +0 -17
  364. data/data/ruby-advisory-db/gems/passenger/CVE-2016-10345.yml +0 -17
  365. data/data/ruby-advisory-db/gems/passenger/OSVDB-90738.yml +0 -16
  366. data/data/ruby-advisory-db/gems/pdfkit/CVE-2013-1607.yml +0 -11
  367. data/data/ruby-advisory-db/gems/point-cli/CVE-2014-4997.yml +0 -8
  368. data/data/ruby-advisory-db/gems/private_address_check/CVE-2017-0904.yml +0 -17
  369. data/data/ruby-advisory-db/gems/private_address_check/CVE-2017-0909.yml +0 -15
  370. data/data/ruby-advisory-db/gems/private_address_check/CVE-2018-3759.yml +0 -14
  371. data/data/ruby-advisory-db/gems/puma/CVE-2019-16770.yml +0 -21
  372. data/data/ruby-advisory-db/gems/puma/CVE-2020-11076.yml +0 -22
  373. data/data/ruby-advisory-db/gems/puma/CVE-2020-11077.yml +0 -31
  374. data/data/ruby-advisory-db/gems/puma/CVE-2020-5247.yml +0 -25
  375. data/data/ruby-advisory-db/gems/puma/CVE-2020-5249.yml +0 -36
  376. data/data/ruby-advisory-db/gems/quick_magick/OSVDB-106954.yml +0 -7
  377. data/data/ruby-advisory-db/gems/rack-attack/OSVDB-132234.yml +0 -26
  378. data/data/ruby-advisory-db/gems/rack-cache/CVE-2012-2671.yml +0 -18
  379. data/data/ruby-advisory-db/gems/rack-cors/CVE-2017-11173.yml +0 -21
  380. data/data/ruby-advisory-db/gems/rack-cors/CVE-2019-18978.yml +0 -13
  381. data/data/ruby-advisory-db/gems/rack-mini-profiler/CVE-2016-4442.yml +0 -17
  382. data/data/ruby-advisory-db/gems/rack-protection/CVE-2018-1000119.yml +0 -18
  383. data/data/ruby-advisory-db/gems/rack-protection/CVE-2018-7212.yml +0 -12
  384. data/data/ruby-advisory-db/gems/rack-ssl/CVE-2014-2538.yml +0 -11
  385. data/data/ruby-advisory-db/gems/rack/CVE-2011-5036.yml +0 -21
  386. data/data/ruby-advisory-db/gems/rack/CVE-2012-6109.yml +0 -21
  387. data/data/ruby-advisory-db/gems/rack/CVE-2013-0183.yml +0 -19
  388. data/data/ruby-advisory-db/gems/rack/CVE-2013-0184.yml +0 -20
  389. data/data/ruby-advisory-db/gems/rack/CVE-2013-0262.yml +0 -18
  390. data/data/ruby-advisory-db/gems/rack/CVE-2013-0263.yml +0 -23
  391. data/data/ruby-advisory-db/gems/rack/CVE-2015-3225.yml +0 -18
  392. data/data/ruby-advisory-db/gems/rack/CVE-2018-16470.yml +0 -56
  393. data/data/ruby-advisory-db/gems/rack/CVE-2018-16471.yml +0 -80
  394. data/data/ruby-advisory-db/gems/rack/CVE-2019-16782.yml +0 -32
  395. data/data/ruby-advisory-db/gems/rack/CVE-2020-8161.yml +0 -32
  396. data/data/ruby-advisory-db/gems/radiant/CVE-2018-5216.yml +0 -12
  397. data/data/ruby-advisory-db/gems/radiant/CVE-2018-7261.yml +0 -13
  398. data/data/ruby-advisory-db/gems/rails-html-sanitizer/CVE-2015-7578.yml +0 -47
  399. data/data/ruby-advisory-db/gems/rails-html-sanitizer/CVE-2015-7579.yml +0 -75
  400. data/data/ruby-advisory-db/gems/rails-html-sanitizer/CVE-2015-7580.yml +0 -70
  401. data/data/ruby-advisory-db/gems/rails-html-sanitizer/CVE-2018-3741.yml +0 -20
  402. data/data/ruby-advisory-db/gems/rails_admin/CVE-2016-10522.yml +0 -21
  403. data/data/ruby-advisory-db/gems/rails_admin/CVE-2017-12098.yml +0 -22
  404. data/data/ruby-advisory-db/gems/railties/CVE-2019-5420.yml +0 -49
  405. data/data/ruby-advisory-db/gems/rake/CVE-2020-8130.yml +0 -18
  406. data/data/ruby-advisory-db/gems/rbovirt/CVE-2014-0036.yml +0 -20
  407. data/data/ruby-advisory-db/gems/rdoc/CVE-2013-0256.yml +0 -27
  408. data/data/ruby-advisory-db/gems/recurly/CVE-2017-0905.yml +0 -35
  409. data/data/ruby-advisory-db/gems/redcarpet/CVE-2015-5147.yml +0 -17
  410. data/data/ruby-advisory-db/gems/redcarpet/OSVDB-120415.yml +0 -16
  411. data/data/ruby-advisory-db/gems/redis-namespace/OSVDB-96425.yml +0 -15
  412. data/data/ruby-advisory-db/gems/redis-store/CVE-2017-1000248.yml +0 -17
  413. data/data/ruby-advisory-db/gems/refile/OSVDB-120857.yml +0 -16
  414. data/data/ruby-advisory-db/gems/rest-client/CVE-2015-1820.yml +0 -23
  415. data/data/ruby-advisory-db/gems/rest-client/CVE-2015-3448.yml +0 -15
  416. data/data/ruby-advisory-db/gems/rest-client/CVE-2019-15224.yml +0 -13
  417. data/data/ruby-advisory-db/gems/restforce/CVE-2018-3777.yml +0 -36
  418. data/data/ruby-advisory-db/gems/rexical/CVE-2019-5477.yml +0 -21
  419. data/data/ruby-advisory-db/gems/rgpg/CVE-2013-4203.yml +0 -15
  420. data/data/ruby-advisory-db/gems/rubocop/CVE-2017-8418.yml +0 -20
  421. data/data/ruby-advisory-db/gems/ruby-openid/CVE-2019-11027.yml +0 -16
  422. data/data/ruby-advisory-db/gems/ruby-saml/CVE-2016-5697.yml +0 -20
  423. data/data/ruby-advisory-db/gems/ruby-saml/CVE-2017-11428.yml +0 -27
  424. data/data/ruby-advisory-db/gems/ruby-saml/OSVDB-117903.yml +0 -13
  425. data/data/ruby-advisory-db/gems/ruby-saml/OSVDB-124383.yml +0 -11
  426. data/data/ruby-advisory-db/gems/ruby-saml/OSVDB-124991.yml +0 -13
  427. data/data/ruby-advisory-db/gems/ruby_parser-legacy/CVE-2019-18409.yml +0 -16
  428. data/data/ruby-advisory-db/gems/ruby_parser/CVE-2013-0162.yml +0 -11
  429. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2007-0469.yml +0 -18
  430. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2012-2125.yml +0 -17
  431. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2012-2126.yml +0 -15
  432. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2013-4287.yml +0 -20
  433. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2013-4363.yml +0 -21
  434. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2015-3900.yml +0 -20
  435. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2015-4020.yml +0 -20
  436. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0899.yml +0 -16
  437. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0900.yml +0 -16
  438. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0901.yml +0 -16
  439. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0902.yml +0 -16
  440. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0903.yml +0 -17
  441. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8320.yml +0 -21
  442. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8321.yml +0 -16
  443. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8322.yml +0 -16
  444. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8323.yml +0 -17
  445. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8324.yml +0 -18
  446. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8325.yml +0 -16
  447. data/data/ruby-advisory-db/gems/rubyzip/CVE-2017-5946.yml +0 -17
  448. data/data/ruby-advisory-db/gems/rubyzip/CVE-2018-1000544.yml +0 -19
  449. data/data/ruby-advisory-db/gems/rubyzip/CVE-2019-16892.yml +0 -13
  450. data/data/ruby-advisory-db/gems/safemode/CVE-2016-3693.yml +0 -13
  451. data/data/ruby-advisory-db/gems/safemode/CVE-2017-7540.yml +0 -16
  452. data/data/ruby-advisory-db/gems/samlr/CVE-2018-20857.yml +0 -16
  453. data/data/ruby-advisory-db/gems/sanitize/CVE-2018-3740.yml +0 -22
  454. data/data/ruby-advisory-db/gems/screen_capture/OSVDB-107783.yml +0 -7
  455. data/data/ruby-advisory-db/gems/secure_headers/CVE-2020-5216.yml +0 -52
  456. data/data/ruby-advisory-db/gems/secure_headers/CVE-2020-5217.yml +0 -42
  457. data/data/ruby-advisory-db/gems/sentry-raven/CVE-2014-9490.yml +0 -14
  458. data/data/ruby-advisory-db/gems/sfpagent/CVE-2014-2888.yml +0 -15
  459. data/data/ruby-advisory-db/gems/show_in_browser/CVE-2013-2105.yml +0 -8
  460. data/data/ruby-advisory-db/gems/sidekiq-pro/OSVDB-126329.yml +0 -12
  461. data/data/ruby-advisory-db/gems/sidekiq-pro/OSVDB-126330.yml +0 -10
  462. data/data/ruby-advisory-db/gems/sidekiq-pro/OSVDB-126331.yml +0 -14
  463. data/data/ruby-advisory-db/gems/sidekiq/OSVDB-125675.yml +0 -9
  464. data/data/ruby-advisory-db/gems/sidekiq/OSVDB-125676.yml +0 -14
  465. data/data/ruby-advisory-db/gems/sidekiq/OSVDB-125678.yml +0 -9
  466. data/data/ruby-advisory-db/gems/simple_captcha2/CVE-2019-14282.yml +0 -13
  467. data/data/ruby-advisory-db/gems/simple_form/CVE-2019-16676.yml +0 -15
  468. data/data/ruby-advisory-db/gems/sinatra/CVE-2018-11627.yml +0 -16
  469. data/data/ruby-advisory-db/gems/sinatra/CVE-2018-7212.yml +0 -19
  470. data/data/ruby-advisory-db/gems/slanger/CVE-2019-1010306.yml +0 -16
  471. data/data/ruby-advisory-db/gems/smart_proxy_dynflow/CVE-2018-14643.yml +0 -18
  472. data/data/ruby-advisory-db/gems/sorcery/CVE-2020-11052.yml +0 -27
  473. data/data/ruby-advisory-db/gems/sounder/CVE-2013-5647.yml +0 -14
  474. data/data/ruby-advisory-db/gems/spina/CVE-2015-4619.yml +0 -16
  475. data/data/ruby-advisory-db/gems/spree/OSVDB-119205.yml +0 -18
  476. data/data/ruby-advisory-db/gems/spree/OSVDB-125699.yml +0 -18
  477. data/data/ruby-advisory-db/gems/spree/OSVDB-125701.yml +0 -17
  478. data/data/ruby-advisory-db/gems/spree/OSVDB-125712.yml +0 -16
  479. data/data/ruby-advisory-db/gems/spree/OSVDB-125713.yml +0 -15
  480. data/data/ruby-advisory-db/gems/spree/OSVDB-69098.yml +0 -19
  481. data/data/ruby-advisory-db/gems/spree/OSVDB-73751.yml +0 -11
  482. data/data/ruby-advisory-db/gems/spree/OSVDB-76011.yml +0 -15
  483. data/data/ruby-advisory-db/gems/spree/OSVDB-81505.yml +0 -14
  484. data/data/ruby-advisory-db/gems/spree/OSVDB-81506.yml +0 -16
  485. data/data/ruby-advisory-db/gems/spree/OSVDB-90865.yml +0 -20
  486. data/data/ruby-advisory-db/gems/spree/OSVDB-91216.yml +0 -17
  487. data/data/ruby-advisory-db/gems/spree/OSVDB-91217.yml +0 -17
  488. data/data/ruby-advisory-db/gems/spree/OSVDB-91218.yml +0 -17
  489. data/data/ruby-advisory-db/gems/spree/OSVDB-91219.yml +0 -17
  490. data/data/ruby-advisory-db/gems/spree_auth/OSVDB-90865.yml +0 -16
  491. data/data/ruby-advisory-db/gems/spree_auth_devise/OSVDB-90865.yml +0 -20
  492. data/data/ruby-advisory-db/gems/sprockets/CVE-2014-7819.yml +0 -27
  493. data/data/ruby-advisory-db/gems/sprockets/CVE-2018-3760.yml +0 -23
  494. data/data/ruby-advisory-db/gems/sprout/CVE-2013-6421.yml +0 -16
  495. data/data/ruby-advisory-db/gems/strong_password/CVE-2019-13354.yml +0 -19
  496. data/data/ruby-advisory-db/gems/sup/CVE-2013-4478.yml +0 -14
  497. data/data/ruby-advisory-db/gems/sup/CVE-2013-4479.yml +0 -14
  498. data/data/ruby-advisory-db/gems/thumbshooter/CVE-2013-1898.yml +0 -9
  499. data/data/ruby-advisory-db/gems/twitter-bootstrap-rails/OSVDB-109206.yml +0 -22
  500. data/data/ruby-advisory-db/gems/uglifier/OSVDB-126747.yml +0 -19
  501. data/data/ruby-advisory-db/gems/user_agent_parser/CVE-2020-5243.yml +0 -28
  502. data/data/ruby-advisory-db/gems/web-console/CVE-2015-3224.yml +0 -22
  503. data/data/ruby-advisory-db/gems/web-console/OSVDB-112346.yml +0 -12
  504. data/data/ruby-advisory-db/gems/webbynode/CVE-2013-7086.yml +0 -12
  505. data/data/ruby-advisory-db/gems/websocket-extensions/CVE-2020-7663.yml +0 -35
  506. data/data/ruby-advisory-db/gems/wicked/CVE-2013-4413.yml +0 -14
  507. data/data/ruby-advisory-db/gems/will_paginate/CVE-2013-6459.yml +0 -15
  508. data/data/ruby-advisory-db/gems/xaviershay-dm-rails/CVE-2015-2179.yml +0 -13
  509. data/data/ruby-advisory-db/gems/yajl-ruby/CVE-2017-16516.yml +0 -19
  510. data/data/ruby-advisory-db/gems/yard/CVE-2017-17042.yml +0 -16
  511. data/data/ruby-advisory-db/gems/yard/CVE-2019-1020001.yml +0 -17
  512. data/data/ruby-advisory-db/gems/yard/GHSA-xfhh-rx56-rxcr.yml +0 -12
  513. data/data/ruby-advisory-db/lib/cf_scrape.py +0 -5
  514. data/data/ruby-advisory-db/lib/github_advisory_sync.rb +0 -296
  515. data/data/ruby-advisory-db/libraries/rubygems +0 -1
  516. data/data/ruby-advisory-db/rubies/jruby/CVE-2010-1330.yml +0 -17
  517. data/data/ruby-advisory-db/rubies/jruby/CVE-2011-4838.yml +0 -15
  518. data/data/ruby-advisory-db/rubies/jruby/CVE-2012-5370.yml +0 -17
  519. data/data/ruby-advisory-db/rubies/jruby/OSVDB-94644.yml +0 -12
  520. data/data/ruby-advisory-db/rubies/rbx/CVE-2012-5372.yml +0 -17
  521. data/data/ruby-advisory-db/rubies/rbx/OSVDB-78119.yml +0 -13
  522. data/data/ruby-advisory-db/rubies/ruby/CVE-2007-5162.yml +0 -16
  523. data/data/ruby-advisory-db/rubies/ruby/CVE-2007-5770.yml +0 -17
  524. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-1447.yml +0 -15
  525. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-1891.yml +0 -21
  526. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-2376.yml +0 -18
  527. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-2662.yml +0 -22
  528. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-2663.yml +0 -21
  529. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-2664.yml +0 -21
  530. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-2725.yml +0 -22
  531. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-2726.yml +0 -18
  532. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-3443.yml +0 -17
  533. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-3655.yml +0 -18
  534. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-3656.yml +0 -19
  535. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-3657.yml +0 -16
  536. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-3790.yml +0 -16
  537. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-3905.yml +0 -17
  538. data/data/ruby-advisory-db/rubies/ruby/CVE-2009-0642.yml +0 -17
  539. data/data/ruby-advisory-db/rubies/ruby/CVE-2009-1904.yml +0 -17
  540. data/data/ruby-advisory-db/rubies/ruby/CVE-2009-4124.yml +0 -17
  541. data/data/ruby-advisory-db/rubies/ruby/CVE-2009-4492.yml +0 -20
  542. data/data/ruby-advisory-db/rubies/ruby/CVE-2009-5147.yml +0 -13
  543. data/data/ruby-advisory-db/rubies/ruby/CVE-2010-0541.yml +0 -17
  544. data/data/ruby-advisory-db/rubies/ruby/CVE-2010-2489.yml +0 -17
  545. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-0188.yml +0 -17
  546. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-1004.yml +0 -20
  547. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-1005.yml +0 -15
  548. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-2686.yml +0 -17
  549. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-2705.yml +0 -16
  550. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-3009.yml +0 -17
  551. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-3389.yml +0 -18
  552. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-4815.yml +0 -14
  553. data/data/ruby-advisory-db/rubies/ruby/CVE-2012-4464.yml +0 -17
  554. data/data/ruby-advisory-db/rubies/ruby/CVE-2012-4466.yml +0 -16
  555. data/data/ruby-advisory-db/rubies/ruby/CVE-2012-4481.yml +0 -15
  556. data/data/ruby-advisory-db/rubies/ruby/CVE-2012-4522.yml +0 -16
  557. data/data/ruby-advisory-db/rubies/ruby/CVE-2012-5371.yml +0 -18
  558. data/data/ruby-advisory-db/rubies/ruby/CVE-2013-1821.yml +0 -16
  559. data/data/ruby-advisory-db/rubies/ruby/CVE-2013-2065.yml +0 -19
  560. data/data/ruby-advisory-db/rubies/ruby/CVE-2013-4073.yml +0 -21
  561. data/data/ruby-advisory-db/rubies/ruby/CVE-2013-4164.yml +0 -17
  562. data/data/ruby-advisory-db/rubies/ruby/CVE-2014-2525.yml +0 -20
  563. data/data/ruby-advisory-db/rubies/ruby/CVE-2014-3916.yml +0 -16
  564. data/data/ruby-advisory-db/rubies/ruby/CVE-2014-4975.yml +0 -17
  565. data/data/ruby-advisory-db/rubies/ruby/CVE-2014-8080.yml +0 -19
  566. data/data/ruby-advisory-db/rubies/ruby/CVE-2014-8090.yml +0 -22
  567. data/data/ruby-advisory-db/rubies/ruby/CVE-2015-1855.yml +0 -17
  568. data/data/ruby-advisory-db/rubies/ruby/CVE-2015-7551.yml +0 -19
  569. data/data/ruby-advisory-db/rubies/ruby/CVE-2015-9096.yml +0 -20
  570. data/data/ruby-advisory-db/rubies/ruby/CVE-2017-0898.yml +0 -19
  571. data/data/ruby-advisory-db/rubies/ruby/CVE-2017-10784.yml +0 -25
  572. data/data/ruby-advisory-db/rubies/ruby/CVE-2017-14033.yml +0 -22
  573. data/data/ruby-advisory-db/rubies/ruby/CVE-2017-14064.yml +0 -20
  574. data/data/ruby-advisory-db/rubies/ruby/CVE-2017-17405.yml +0 -22
  575. data/data/ruby-advisory-db/rubies/ruby/CVE-2017-17742.yml +0 -22
  576. data/data/ruby-advisory-db/rubies/ruby/CVE-2018-16395.yml +0 -36
  577. data/data/ruby-advisory-db/rubies/ruby/CVE-2018-16396.yml +0 -26
  578. data/data/ruby-advisory-db/rubies/ruby/CVE-2018-6914.yml +0 -27
  579. data/data/ruby-advisory-db/rubies/ruby/CVE-2018-8777.yml +0 -21
  580. data/data/ruby-advisory-db/rubies/ruby/CVE-2018-8778.yml +0 -20
  581. data/data/ruby-advisory-db/rubies/ruby/CVE-2018-8779.yml +0 -28
  582. data/data/ruby-advisory-db/rubies/ruby/CVE-2018-8780.yml +0 -22
  583. data/data/ruby-advisory-db/rubies/ruby/CVE-2019-15845.yml +0 -18
  584. data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16201.yml +0 -15
  585. data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16254.yml +0 -19
  586. data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16255.yml +0 -20
  587. data/data/ruby-advisory-db/rubies/ruby/CVE-2020-10663.yml +0 -29
  588. data/data/ruby-advisory-db/rubies/ruby/CVE-2020-10933.yml +0 -25
  589. data/data/ruby-advisory-db/scripts/post-advisories.sh +0 -18
  590. data/data/ruby-advisory-db/spec/advisories_spec.rb +0 -23
  591. data/data/ruby-advisory-db/spec/advisory_example.rb +0 -228
  592. data/data/ruby-advisory-db/spec/gem_example.rb +0 -44
  593. data/data/ruby-advisory-db/spec/library_example.rb +0 -21
  594. data/data/ruby-advisory-db/spec/ruby_example.rb +0 -29
  595. data/data/ruby-advisory-db/spec/schemas/gem.yml +0 -71
  596. data/data/ruby-advisory-db/spec/schemas/ruby.yml +0 -36
  597. data/data/ruby-advisory-db/spec/spec_helper.rb +0 -2
@@ -1,3 +0,0 @@
1
- [submodule "data/ruby-advisory-db"]
2
- path = data/ruby-advisory-db
3
- url = https://github.com/rubysec/ruby-advisory-db.git
@@ -1,14 +0,0 @@
1
- language: ruby
2
- rvm:
3
- - 2.3
4
- - 2.4
5
- - 2.5
6
- - 2.6
7
- - 2.7
8
- - jruby
9
- - truffleruby
10
-
11
- matrix:
12
- allow_failures:
13
- - rvm: jruby
14
- - rvm: truffleruby
@@ -1 +0,0 @@
1
- 2020-06-12 22:55:28 UTC
@@ -1 +0,0 @@
1
- _site
@@ -1 +0,0 @@
1
- --colour
@@ -1,12 +0,0 @@
1
- language: ruby
2
-
3
- sudo: false
4
-
5
- cache: bundler
6
-
7
- notifications:
8
- irc: chat.freenode.net#rubysec
9
-
10
- env:
11
- global:
12
- - secure: ZXwsZdbCej15IcIazEIjy12o5v5EI8/Hle/VP1EabfbHsA5Mw+lrliMAV80C8Iy+p4mI66WIO/3Ovm64L1nGDBGs3dKUjtDvNPCKHlK2xK7AhvkcJnzbjWTAzWZY17STJO45DUdr/vuVbvQZ8llLosSOBs+grGsszCSEIOibqjU=
@@ -1,71 +0,0 @@
1
- # Contributing Guidelines
2
-
3
- * All text must be within 80 columns.
4
- * YAML must be indented by 2 spaces.
5
- * Have any questions? Feel free to open an issue.
6
- * Prior to submitting a pull request, run the tests:
7
-
8
- ```
9
- bundle install
10
- bundle exec rspec
11
- ```
12
-
13
- * Follow the schema. Here is an example advisory:
14
-
15
- ```yaml
16
- ---
17
- gem: examplegem
18
- cve: 2013-0156
19
- date: 2013-05-01
20
- url: https://github.com/rubysec/ruby-advisory-db/issues/123456
21
- title: |
22
- Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing
23
- Remote Code Execution
24
-
25
- description: |
26
- Ruby on Rails contains a flaw in params_parser.rb of the Action Pack.
27
- The issue is triggered when a type casting error occurs during the parsing
28
- of parameters. This may allow a remote attacker to potentially execute
29
- arbitrary code.
30
-
31
- cvss_v2: 10.0
32
- cvss_v3: 9.8
33
-
34
- patched_versions:
35
- - ~> 2.3.15
36
- - ~> 3.0.19
37
- - ~> 3.1.10
38
- - ">= 3.2.11"
39
- unaffected_versions:
40
- - ~> 2.4.3
41
-
42
- related:
43
- cve:
44
- - 2013-1234567
45
- - 2013-1234568
46
- url:
47
- - https://github.com/rubysec/ruby-advisory-db/issues/123457
48
-
49
- ```
50
- ### Schema
51
-
52
- * `gem` \[String\] (required): Name of the affected gem.
53
- * `framework` \[String\] (optional): Name of the framework which the affected gem belongs to.
54
- * `platform` \[String\] (optional): If this vulnerability is platform-specific, name of platform this vulnerability affects (e.g. jruby)
55
- * `cve` \[String\] (optional): Common Vulnerabilities and Exposures (CVE) ID.
56
- * `osvdb` \[Integer\] (optional): Open Sourced Vulnerability Database (OSVDB) ID.
57
- * `ghsa` \[String\] (optional): GitHub Security Advisory (GHSA) ID.
58
- * `url` \[String\] (required): The URL to the full advisory.
59
- * `title` \[String\] (required): The title of the advisory or individual vulnerability.
60
- * `date` \[Date\] (required): The public disclosure date of the advisory.
61
- * `description` \[String\] (required): One or more paragraphs describing the vulnerability.
62
- * `cvss_v2` \[Float\] (optional): The [CVSSv2] score for the vulnerability.
63
- * `cvss_v3` \[Float\] (optional): The [CVSSv3] score for the vulnerability.
64
- * `unaffected_versions` \[Array\<String\>\] (optional): The version requirements for the
65
- unaffected versions of the Ruby library.
66
- * `patched_versions` \[Array\<String\>\] (optional): The version requirements for the
67
- patched versions of the Ruby library.
68
- * `related` \[Hash\<Array\<String\>\>\] (optional): Sometimes an advisory references many urls and cves. Supported keys: `cve` and `url`
69
-
70
- [CVSSv2]: https://www.first.org/cvss/v2/guide
71
- [CVSSv3]: https://www.first.org/cvss/user-guide
@@ -1,41 +0,0 @@
1
- ### Acknowledgements
2
-
3
- This database would not be possible without volunteers willing to submit pull requests. In no particular order, we'd like to thank:
4
-
5
- * [Postmodern](https://github.com/postmodern/)
6
- * [Max Veytsman](https://twitter.com/mveytsman)
7
- * [Pietro Monteiro](https://github.com/pietro)
8
- * [Eric Hodel](https://github.com/drbrain)
9
- * [Brendon Murphy](https://github.com/bemurphy)
10
- * [Oliver Legg](https://github.com/olly)
11
- * [Larry W. Cashdollar](http://vapid.dhs.org/)
12
- * [Michael Grosser](https://github.com/grosser)
13
- * [Sascha Korth](https://github.com/skorth)
14
- * [David Radcliffe](https://github.com/dwradcliffe)
15
- * [Jörg Schiller](https://github.com/joergschiller)
16
- * [Derek Prior](https://github.com/derekprior)
17
- * [Joel Chippindale](https://github.com/mocoso)
18
- * [Josef Šimánek](https://github.com/simi)
19
- * [Amiel Martin](https://github.com/amiel)
20
- * [Jeremy Olliver](https://github.com/jeremyolliver)
21
- * [Vasily Vasinov](https://github.com/vasinov)
22
- * [Phill MV](https://twitter.com/phillmv)
23
- * [Jon Kessler](https://github.com/jonkessler)
24
- * [James Harton](https://github.com/jamesotron)
25
- * [Justin Collins](https://github.com/presidentbeef)
26
- * [Andy Brody](https://github.com/ab)
27
- * [Alexey Zapparov](https://github.com/ixti)
28
- * [Toni Reina](https://github.com/areina)
29
- * [Bernard Lambeau](https://github.com/blambeau)
30
- * [Don Morrison](https://github.com/elskwid)
31
- * [John Poulin](https://github.com/forced-request)
32
- * [Neal Harris](https://github.com/nealharris)
33
- * [Justin Bull](https://github.com/f3ndot)
34
- * [Andrew Selder](https://github.com/aselder)
35
- * [Vanessa Henderson](https://github.com/VanessaHenderson)
36
- * [Reed Loden](https://github.com/reedloden)
37
- * [ecneladis](https://github.com/ecneladis)
38
- * [Brendan Coles](https://github.com/bcoles)
39
- * [Florian Wininger](https://github.com/fwininger)
40
-
41
- The rubysec.com domain was graciously donated by [Jordi Massaguer](https://github.com/jordimassaguerpla).
@@ -1,11 +0,0 @@
1
- source 'https://rubygems.org'
2
-
3
- gem 'faraday'
4
- gem 'rake'
5
- gem 'kwalify'
6
- gem 'rspec'
7
-
8
- group :development do
9
- gem 'pry'
10
- gem 'nokogiri'
11
- end
@@ -1,5 +0,0 @@
1
- If you submit code or data to the ruby-advisory-db that is copyrighted by yourself, upon submission you hereby agree to release it into the public domain.
2
-
3
- However, not all of the ruby-advisory-db can be considered public domain. The ruby-advisory-db may contain some information copyrighted by the Open Source Vulnerability Database (http://osvdb.org). If you use ruby-advisory-db data to build a product or a service, it is your responsibility to familiarize yourself with the terms of their license: http://www.osvdb.org/osvdb_license
4
-
5
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
@@ -1,133 +0,0 @@
1
- # Ruby Advisory Database
2
-
3
- The Ruby Advisory Database is a community effort to compile all security advisories that are relevant to Ruby libraries.
4
-
5
- You can check your own Gemfile.locks against this database by using [bundler-audit](https://github.com/rubysec/bundler-audit).
6
-
7
- ## Support Ruby security!
8
-
9
- Do you know about a vulnerability that isn't listed in this database? Open an issue, submit a PR, or [use this form](https://rubysec.com/advisories/new) which will email the maintainers.
10
-
11
- ## Directory Structure
12
-
13
- The database is a list of directories that match the names of Ruby libraries on
14
- [rubygems.org]. Within each directory are one or more advisory files
15
- for the Ruby library. These advisory files are named using
16
- the advisories' [CVE] identifier number.
17
-
18
- gems/:
19
- actionpack/:
20
- CVE-2014-0130.yml CVE-2014-7818.yml CVE-2014-7829.yml CVE-2015-7576.yml
21
- CVE-2015-7581.yml CVE-2016-0751.yml CVE-2016-0752.yml
22
-
23
- ## Format
24
-
25
- Each advisory file contains the advisory information in [YAML] format:
26
-
27
- ---
28
- gem: examplegem
29
- cve: 2013-0156
30
- date: 2013-05-01
31
- url: https://github.com/rubysec/ruby-advisory-db/issues/123456
32
- title: |
33
- Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing
34
- Remote Code Execution
35
-
36
- description: |
37
- Ruby on Rails contains a flaw in params_parser.rb of the Action Pack.
38
- The issue is triggered when a type casting error occurs during the parsing
39
- of parameters. This may allow a remote attacker to potentially execute
40
- arbitrary code.
41
-
42
- cvss_v2: 10.0
43
- cvss_v3: 9.8
44
-
45
- patched_versions:
46
- - ~> 2.3.15
47
- - ~> 3.0.19
48
- - ~> 3.1.10
49
- - ">= 3.2.11"
50
- unaffected_versions:
51
- - ~> 2.4.3
52
-
53
- related:
54
- cve:
55
- - 2013-1234567
56
- - 2013-1234568
57
- url:
58
- - https://github.com/rubysec/ruby-advisory-db/issues/123457
59
-
60
-
61
- ### Schema
62
-
63
- * `gem` \[String\] (required): Name of the affected gem.
64
- * `framework` \[String\] (optional): Name of the framework which the affected
65
- gem belongs to.
66
- * `platform` \[String\] (optional): If this vulnerability is platform-specific, name of platform this vulnerability affects (e.g. jruby)
67
- * `cve` \[String\] (optional): Common Vulnerabilities and Exposures (CVE) ID.
68
- * `osvdb` \[Integer\] (optional): Open Sourced Vulnerability Database (OSVDB) ID.
69
- * `ghsa` \[String\] (optional): GitHub Security Advisory (GHSA) ID.
70
- * `url` \[String\] (required): The URL to the full advisory.
71
- * `title` \[String\] (required): The title of the advisory or individual vulnerability.
72
- * `date` \[Date\] (required): The public disclosure date of the advisory.
73
- * `description` \[String\] (required): One or more paragraphs describing the vulnerability.
74
- * `cvss_v2` \[Float\] (optional): The [CVSSv2] score for the vulnerability.
75
- * `cvss_v3` \[Float\] (optional): The [CVSSv3] score for the vulnerability.
76
- * `unaffected_versions` \[Array\<String\>\] (optional): The version requirements for the
77
- unaffected versions of the Ruby library.
78
- * `patched_versions` \[Array\<String\>\] (optional): The version requirements for the
79
- patched versions of the Ruby library.
80
- * `related` \[Hash\<Array\<String\>\>\] (optional): Sometimes an advisory references many urls and other identifiers. Supported keys: `cve`, `ghsa`, `osvdb`, and `url`
81
-
82
- ### Tests
83
- Prior to submitting a pull request, run the tests:
84
-
85
- ```
86
- bundle install
87
- bundle exec rspec
88
- ```
89
-
90
- ### GitHub Advisory Sync
91
-
92
- There is a script that will create initial yaml files for RubyGem advisories which
93
- are in the [GitHub Security Advisory API](https://developer.github.com/v4/object/securityadvisory/),
94
- but are not already in this dataset. This script can be periodically run to ensure
95
- this repo has all the data that is present in the GitHub Advisory data.
96
-
97
- The GitHub Advisory API requires a token to access it.
98
- - It can be a completely scopeless token (recommended); it does not require any permissions at all.
99
- - Get yours at https://github.com/settings/tokens
100
-
101
- To run the GitHub Advisory sync, start by executing the rake task:
102
- ```
103
- GH_API_TOKEN=<your GitHub API Token> bundle exec rake sync_github_advisories
104
- ```
105
-
106
- - The rake task will write yaml files for any missing advisories.
107
- - Those files must be further edited.
108
- - Fill in `cvss_v3` field by following the CVE link and getting it from page
109
- - Fill in `patched_versions` field, using the comments at the bottom of the file
110
- - Fill in `unaffected_versions`, optional, if there are unaffected_versions
111
- - delete the GitHub data at the bottom of the yaml file
112
- - double check all the data, commit it, and make a PR
113
- - *The GitHub Advisory data is structured opposite of RubySec unfortunately:
114
- GitHub identifies version range which are vulnerable; RubySec identifies
115
- version ranges which are not vulnerable. This is why some manual
116
- work to translate is needed.*
117
-
118
-
119
- ## Credits
120
-
121
- Please see [CONTRIBUTORS.md].
122
-
123
- This database also includes data from the [Open Sourced Vulnerability Database][OSVDB]
124
- developed by the Open Security Foundation (OSF) and its contributors.
125
-
126
- [rubygems.org]: https://rubygems.org/
127
- [CVE]: https://cve.mitre.org/
128
- [OSVDB]: http://www.osvdb.org/
129
- [GHSA]: https://help.github.com/en/articles/about-maintainer-security-advisories
130
- [CVSSv2]: https://www.first.org/cvss/v2/guide
131
- [CVSSv3]: https://www.first.org/cvss/user-guide
132
- [YAML]: http://www.yaml.org/
133
- [CONTRIBUTORS.md]: https://github.com/rubysec/ruby-advisory-db/blob/master/CONTRIBUTORS.md
@@ -1,22 +0,0 @@
1
- require 'yaml'
2
-
3
- namespace :lint do
4
- begin
5
- require 'rspec/core/rake_task'
6
-
7
- RSpec::Core::RakeTask.new(:yaml)
8
- rescue LoadError => e
9
- task :spec do
10
- abort "Please run `gem install rspec` to install RSpec."
11
- end
12
- end
13
- end
14
-
15
- desc "Sync GitHub RubyGem Advisories into this project"
16
- task :sync_github_advisories do
17
- require_relative "lib/github_advisory_sync"
18
- GitHub::GitHubAdvisorySync.sync
19
- end
20
-
21
- task :lint => ['lint:yaml']
22
- task :default => :lint
@@ -1,12 +0,0 @@
1
- ---
2
- gem: Arabic-Prawn
3
- cve: 2014-2322
4
- osvdb: 104365
5
- url: https://nvd.nist.gov/vuln/detail/CVE-2014-2322
6
- title: Arabic Prawn Gem for Ruby lib/string_utf_support.rb User Input Handling Remote Command Injection
7
- date: 2014-03-10
8
- description: |
9
- Arabic Prawn Gem for Ruby contains a flaw in the lib/string_utf_support.rb
10
- file. The issue is due to the program failing to sanitize user input. This may
11
- allow a remote attacker to inject arbitrary commands.
12
- cvss_v2: 7.5
@@ -1,21 +0,0 @@
1
- ---
2
- gem: RedCloth
3
- cve: 2012-6684
4
- osvdb: 115941
5
- url: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6684
6
- title: RedCloth Gem for Ruby Textile Link Parsing XSS
7
- date: 2012-02-29
8
- description: |
9
- RedCloth Gem for Ruby contains a flaw that allows a cross-site scripting (XSS)
10
- attack. This flaw exists because the program does not validate input when
11
- parsing textile links before returning it to users. This may allow a remote
12
- attacker to create a specially crafted request that would execute arbitrary
13
- script code in a user's browser session within the trust relationship between
14
- their browser and the server.
15
- cvss_v2: 4.3
16
- patched_versions:
17
- - ">= 4.3.0"
18
- related:
19
- url:
20
- - https://github.com/jgarber/redcloth/commit/2f6dab4d6aea5cee778d2f37a135637fe3f1573c
21
- - http://co3k.org/blog/redcloth-unfixed-xss-en
@@ -1,13 +0,0 @@
1
- ---
2
- gem: VladTheEnterprising
3
- cve: 2014-4995
4
- osvdb: 108728
5
- url: https://nvd.nist.gov/vuln/detail/CVE-2014-4995
6
- title: VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} Symlink Multiple Impact
7
- date: 2014-06-30
8
- description: |
9
- VladTheEnterprising Gem for Ruby contains a flaw as the program creates
10
- temporary files insecurely. It is possible for a local attacker to use
11
- a symlink attack against the /tmp/my.cnf.#{target_host} file they can
12
- overwrite arbitrary files, gain access to the MySQL root password,
13
- or inject arbitrary commands.
@@ -1,13 +0,0 @@
1
- ---
2
- gem: VladTheEnterprising
3
- cve: 2014-4996
4
- osvdb: 108728
5
- url: https://nvd.nist.gov/vuln/detail/CVE-2014-4996
6
- title: VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} Symlink Multiple Impact
7
- date: 2014-06-30
8
- description: |
9
- VladTheEnterprising Gem for Ruby contains a flaw as the program creates
10
- temporary files insecurely. It is possible for a local attacker to use
11
- a symlink attack against the /tmp/my.cnf.#{target_host} file they can
12
- overwrite arbitrary files, gain access to the MySQL root password,
13
- or inject arbitrary commands.
@@ -1,17 +0,0 @@
1
- ---
2
- gem: actionmailer
3
- cve: 2013-4389
4
- osvdb: 98629
5
- url: https://nvd.nist.gov/vuln/detail/CVE-2013-4389
6
- title: Action Mailer Gem for Ruby contains a possible DoS Vulnerability
7
- date: 2013-10-16
8
- description: Action Mailer Gem for Ruby contains a format string flaw in
9
- the Log Subscriber component. The issue is triggered as format string
10
- specifiers (e.g. %s and %x) are not properly sanitized in user-supplied
11
- input when handling email addresses. This may allow a remote attacker
12
- to cause a denial of service
13
- cvss_v2: 4.3
14
- unaffected_versions:
15
- - ~> 2.3.2
16
- patched_versions:
17
- - '>= 3.2.15'
@@ -1,40 +0,0 @@
1
- ---
2
- gem: actionpack-page_caching
3
- cve: 2020-8159
4
- url: https://groups.google.com/forum/#!topic/rubyonrails-security/CFRVkEytdP8
5
- date: 2020-05-06
6
- title: Arbitrary file write/potential remote code execution in actionpack-page_caching
7
- description: |
8
- There is a vulnerability in the actionpack-page_caching gem that allows an attacker
9
- to write arbitrary files to a web server, potentially resulting in remote code execution
10
- if the attacker can write unescaped ERB to a view.
11
-
12
- Versions Affected: All versions of actionpack-page_caching (part of Rails prior to Rails 4.0)
13
- Not affected: Applications not using actionpack-page_caching
14
- Fixed Versions: actionpack-page_caching >= 1.2.1
15
-
16
- Impact
17
- ------
18
-
19
- The Action Pack Page Caching gem writes cache files to the file system in
20
- order for the front end webserver (nginx, Apache, etc) to serve the cached
21
- file without making a request to the application server. Paths contain what
22
- is effectively user input can be used to manipulate the location of the cache
23
- file.
24
-
25
- For example "/users/123" could be changed to "/users/../../../foo" and this
26
- will escape the cache directory. Attackers can use this technique to
27
- springboard to an RCE if they can write arbitrary ERb to a view folder.
28
-
29
- Impacted code looks like this:
30
-
31
- ```
32
- class BooksController < ApplicationController
33
- caches_page :show
34
- end
35
- ```
36
-
37
- Where the `show` action of the `BooksController` may be vulnerable.
38
-
39
- patched_versions:
40
- - ">= 1.2.1"