bundler-audit 0.7.0.1 → 0.9.0

data/data/ruby-advisory-db/gems/actionmailer/CVE-2013-4389.yml

@@ -1,17 +0,0 @@
----
-gem: actionmailer
-cve: 2013-4389
-osvdb: 98629
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-4389
-title: Action Mailer Gem for Ruby contains a possible DoS Vulnerability
-date: 2013-10-16
-description: Action Mailer Gem for Ruby contains a format string flaw in
-  the Log Subscriber component. The issue is triggered as format string
-  specifiers (e.g. %s and %x) are not properly sanitized in user-supplied
-  input when handling email addresses. This may allow a remote attacker
-  to cause a denial of service
-cvss_v2: 4.3
-unaffected_versions:
-  - ~> 2.3.2
-patched_versions: 
-  - '>= 3.2.15'

data/data/ruby-advisory-db/gems/actionpack/CVE-2012-1099.yml

@@ -1,26 +0,0 @@
---- 
-gem: actionpack
-framework: rails
-cve: 2012-1099
-osvdb: 79727
-url: https://nvd.nist.gov/vuln/detail/CVE-2012-1099
-title:
-  Ruby on Rails actionpack/lib/action_view/helpers/form_options_helper.rb
-  Manually Generated Select Tag Options XSS
-date: 2012-03-01
-
-description: |
-  Ruby on Rails contains a flaw that allows a remote cross-site scripting (XSS) 
-  attack. This flaw exists because the application does not validate manually
-  generated 'select tag options' upon submission to
-  actionpack/lib/action_view/helpers/form_options_helper.rb. This may allow a
-  user to create a specially crafted request that would execute arbitrary
-  script code in a user's browser within the trust relationship between their
-  browser and the server.
-
-cvss_v2: 4.3
-
-patched_versions: 
-  - ~> 3.0.12
-  - ~> 3.1.4
-  - ">= 3.2.2"

data/data/ruby-advisory-db/gems/actionpack/CVE-2012-3424.yml

@@ -1,28 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2012-3424
-osvdb: 84243
-url: https://nvd.nist.gov/vuln/detail/CVE-2012-3424
-title:
-  Ruby on Rails actionpack/lib/action_controller/metal/http_authentication.rb
-  with_http_digest Helper Method Remote DoS
-date: 2012-07-26
-
-description: |
-  Ruby on Rails contains a flaw that may allow a remote denial of service.
-  The issue is triggered when an error occurs in
-  actionpack/lib/action_controller/metal/http_authentication.rb when the
-  with_http_digest helper method is being used. This may allow a remote
-  attacker to cause a loss of availability for the program.
-
-cvss_v2: 5.0
-
-unaffected_versions:
-  - ">= 2.3.5, <= 2.3.14"
-
-patched_versions:
-  - ~> 3.0.16
-  - ~> 3.1.7
-  - ">= 3.2.7"
-

data/data/ruby-advisory-db/gems/actionpack/CVE-2012-3463.yml

@@ -1,26 +0,0 @@
---- 
-gem: actionpack
-framework: rails
-cve: 2012-3463
-osvdb: 84515
-url: https://nvd.nist.gov/vuln/detail/CVE-2012-3463
-title: Ruby on Rails select_tag Helper Method prompt Value XSS
-date: 2012-08-09
-
-description: |
-  Ruby on Rails contains a flaw that allows a remote cross-site scripting (XSS)
-  attack. This flaw exists because input passed via the prompt value is not
-  properly sanitized by the select_tag helper method before returning it to
-  the user. This may allow a user to create a specially crafted request that
-  would execute arbitrary script code in a user's browser within the trust
-  relationship between their browser and the server.
-
-cvss_v2: 4.3
-
-unaffected_versions:
-  - ~> 2.3.0
-
-patched_versions: 
-  - ~> 3.0.17
-  - ~> 3.1.8
-  - ">= 3.2.8"

data/data/ruby-advisory-db/gems/actionpack/CVE-2012-3465.yml

@@ -1,23 +0,0 @@
---- 
-gem: actionpack
-framework: rails
-cve: 2012-3465
-osvdb: 84513
-url: https://nvd.nist.gov/vuln/detail/CVE-2012-3465
-title: Ruby on Rails strip_tags Helper Method XSS
-date: 2012-08-09
-
-description: |
-  Ruby on Rails contains a flaw that allows a remote cross-site scripting (XSS)
-  attack. This flaw exists because the application does not validate input
-  passed via the 'strip_tags' helper method before returning it to the user.
-  This may allow a user to create a specially crafted request that would
-  execute arbitrary script code in a user's browser within the trust
-  relationship between their browser and the server.
-
-cvss_v2: 4.3
-
-patched_versions: 
-  - ~> 3.0.17
-  - ~> 3.1.8
-  - ">= 3.2.8"

data/data/ruby-advisory-db/gems/actionpack/CVE-2013-0156.yml

@@ -1,24 +0,0 @@
---- 
-gem: actionpack
-framework: rails
-cve: 2013-0156
-osvdb: 89026
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-0156
-title:
-  Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing
-  Remote Code Execution 
-date: 2013-01-08
-
-description: |
-  Ruby on Rails contains a flaw in params_parser.rb of the Action Pack.
-  The issue is triggered when a type casting error occurs during the parsing
-  of parameters. This may allow a remote attacker to potentially execute
-  arbitrary code.
-
-cvss_v2: 10.0
-
-patched_versions: 
-  - ~> 2.3.15
-  - ~> 3.0.19
-  - ~> 3.1.10
-  - ">= 3.2.11"

data/data/ruby-advisory-db/gems/actionpack/CVE-2013-1855.yml

@@ -1,20 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2013-1855
-osvdb: 91452
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-1855
-title: XSS vulnerability in sanitize_css in Action Pack
-date: 2013-03-19
-
-description: |
-  There is an XSS vulnerability in the `sanitize_css` method in Action
-  Pack. Carefully crafted text can bypass the sanitization provided in
-  the `sanitize_css` method in Action Pack
-
-cvss_v2: 4.3
-
-patched_versions:
-  - ~> 2.3.18
-  - ~> 3.1.12
-  - ">= 3.2.13"

data/data/ruby-advisory-db/gems/actionpack/CVE-2013-1857.yml

@@ -1,23 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2013-1857
-osvdb: 91454
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-1857
-title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails
-date: 2013-03-19
-
-description: |
-  The sanitize helper in Ruby on Rails is designed to
-  filter HTML and remove all tags and attributes which could be
-  malicious. The code which ensured that URLs only contain supported
-  protocols contained several bugs which could allow an attacker to
-  embed a tag containing a URL which executes arbitrary javascript
-  code.
-
-cvss_v2: 4.3
-
-patched_versions:
-  - ~> 2.3.18
-  - ~> 3.1.12
-  - ">= 3.2.13"

data/data/ruby-advisory-db/gems/actionpack/CVE-2014-0081.yml

@@ -1,24 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2014-0081
-osvdb: 103439
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-0081
-title: XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human
-date: 2014-02-18
-
-description: |
-  Ruby on Rails contains a flaw that allows a cross-site scripting (XSS) attack.
-  This flaw exists because the actionpack/lib/action_view/helpers/number_helper.rb
-  script does not validate input to the 'number_to_currency', 'number_to_percentage',
-  and 'number_to_human' helpers before returning it to users. This may allow a
-  remote attacker to create a specially crafted request that would execute arbitrary
-  script code in a user's browser session within the trust relationship between
-  their browser and the server.
-
-cvss_v2: 4.3
-
-patched_versions:
-  - ~> 3.2.17
-  - ~> 4.0.3
-  - ">= 4.1.0.beta2"

data/data/ruby-advisory-db/gems/actionpack/CVE-2014-0082.yml

@@ -1,22 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2014-0082
-osvdb: 103440
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-0082
-title: Denial of Service Vulnerability in Action View when using render :text
-date: 2014-02-18
-
-description: |
-  Ruby on Rails contains a flaw in actionpack/lib/action_view/template/text.rb
-  in the text rendering component of Action View that is triggered when
-  handling MIME types that are converted to symbols. This may allow a
-  remote attacker to cause a denial of service.
-
-cvss_v2: 5.0
-
-unaffected_versions:
-  - ">= 4.0.0"
-
-patched_versions:
-  - ">= 3.2.17"

data/data/ruby-advisory-db/gems/actionpack/CVE-2014-0130.yml

@@ -1,23 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2014-0130
-url: https://groups.google.com/forum/#!topic/rubyonrails-security/NkKc7vTW70o
-title: Directory Traversal Vulnerability With Certain Route Configurations
-date: 2014-05-06
-
-description: |
-  There is a vulnerability in the 'implicit render'
-  functionality in Ruby on Rails.The implicit render functionality
-  allows controllers to render a template, even if there is no
-  explicit action with the corresponding name.  This module does not
-  perform adequate input sanitization which could allow an attacker to
-  use a specially crafted request to retrieve arbitrary files from the
-  rails application server.
-
-cvss_v2: 4.3
-
-patched_versions:
-  - ~> 3.2.18
-  - ~> 4.0.5
-  - ">= 4.1.1"

data/data/ruby-advisory-db/gems/actionpack/CVE-2014-7818.yml

@@ -1,24 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2014-7818
-url: https://groups.google.com/forum/#!topic/rubyonrails-security/dCp7duBiQgo
-title: Arbitrary file existence disclosure in Action Pack
-date: 2014-10-30
-
-description: |
-  Specially crafted requests can be used to determine whether a file exists on
-  the filesystem that is outside the Rails application's root directory.  The
-  files will not be served, but attackers can determine whether or not the file
-  exists.
-
-cvss_v2: 4.3
-
-unaffected_versions:
-  - "< 3.0.0"
-
-patched_versions:
-  - ~> 3.2.20
-  - ~> 4.0.11
-  - ~> 4.1.7
-  - ">= 4.2.0.beta3"

data/data/ruby-advisory-db/gems/actionpack/CVE-2014-7829.yml

@@ -1,26 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2014-7829
-url: https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRCGk
-title: Arbitrary file existence disclosure in Action Pack
-date: 2014-11-17
-
-description: |
-  Specially crafted requests can be used to determine whether a file exists on
-  the filesystem that is outside the Rails application's root directory.  The
-  files will not be served, but attackers can determine whether or not the file
-  exists.  This vulnerability is very similar to CVE-2014-7818, but the
-  specially crafted string is slightly different.
-
-cvss_v2: 5.0
-
-unaffected_versions:
-  - "< 3.0.0"
-
-patched_versions:
-  - ~> 3.2.21
-  - ~> 4.0.11.1
-  - ~> 4.0.12
-  - ~> 4.1.7.1
-  - ">= 4.1.8"

data/data/ruby-advisory-db/gems/actionpack/CVE-2015-7576.yml

@@ -1,119 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2015-7576
-date: 2016-01-25
-url: "https://groups.google.com/forum/#!topic/rubyonrails-security/ANv0HDHEC3k"
-
-title: Timing attack vulnerability in basic authentication in Action Controller.
-
-description: |
-    There is a timing attack vulnerability in the basic authentication support
-    in Action Controller. This vulnerability has been assigned the CVE
-    identifier CVE-2015-7576.
-
-    Versions Affected:  All.
-    Not affected:       None.
-    Fixed Versions:     5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1
-
-    Impact
-    ------
-    Due to the way that Action Controller compares user names and passwords in
-    basic authentication authorization code, it is possible for an attacker to
-    analyze the time taken by a response and intuit the password.
-
-    For example, this string comparison:
-
-      "foo" == "bar"
-
-    is possibly faster than this comparison:
-
-      "foo" == "fo1"
-
-    Attackers can use this information to attempt to guess the username and
-    password used in the basic authentication system.
-
-    You can tell you application is vulnerable to this attack by looking for
-    `http_basic_authenticate_with` method calls in your application.
-
-    All users running an affected release should either upgrade or use one of
-    the workarounds immediately.
-
-    Releases
-    --------
-    The FIXED releases are available at the normal locations.
-
-    Workarounds
-    -----------
-    If you can't upgrade, please use the following monkey patch in an initializer
-    that is loaded before your application:
-
-    ```
-    $ cat config/initializers/basic_auth_fix.rb
-    module ActiveSupport
-      module SecurityUtils
-        def secure_compare(a, b)
-          return false unless a.bytesize == b.bytesize
-
-          l = a.unpack "C#{a.bytesize}"
-
-          res = 0
-          b.each_byte { |byte| res |= byte ^ l.shift }
-          res == 0
-        end
-        module_function :secure_compare
-
-        def variable_size_secure_compare(a, b)
-          secure_compare(::Digest::SHA256.hexdigest(a), ::Digest::SHA256.hexdigest(b))
-        end
-        module_function :variable_size_secure_compare
-      end
-    end
-
-    module ActionController
-      class Base
-        def self.http_basic_authenticate_with(options = {})
-          before_action(options.except(:name, :password, :realm)) do
-            authenticate_or_request_with_http_basic(options[:realm] || "Application") do |name, password|
-              # This comparison uses & so that it doesn't short circuit and
-              # uses `variable_size_secure_compare` so that length information
-              # isn't leaked.
-              ActiveSupport::SecurityUtils.variable_size_secure_compare(name, options[:name]) &
-                ActiveSupport::SecurityUtils.variable_size_secure_compare(password, options[:password])
-            end
-          end
-        end
-      end
-    end
-    ```
-
-
-    Patches
-    -------
-    To aid users who aren't able to upgrade immediately we have provided patches for
-    the two supported release series. They are in git-am format and consist of a
-    single changeset.
-
-    * 4-1-basic_auth.patch - Patch for 4.1 series
-    * 4-2-basic_auth.patch - Patch for 4.2 series
-    * 5-0-basic_auth.patch - Patch for 5.0 series
-
-    Please note that only the 4.1.x and 4.2.x series are supported at present. Users
-    of earlier unsupported releases are advised to upgrade as soon as possible as we
-    cannot guarantee the continued availability of security fixes for unsupported
-    releases.
-
-    Credits
-    -------
-
-    Thank you to Daniel Waterworth for reporting the problem and working with us to
-    fix it.
-
-cvss_v2: 4.3
-cvss_v3: 3.7
-
-patched_versions:
-  - ">= 5.0.0.beta1.1"
-  - "~> 4.2.5, >= 4.2.5.1"
-  - "~> 4.1.14, >= 4.1.14.1"
-  - "~> 3.2.22.1"