bundler-audit 0.7.0.1 → 0.9.0

data/data/ruby-advisory-db/gems/activesupport/CVE-2020-8165.yml

@@ -1,41 +0,0 @@
----
-gem: activesupport
-framework: rails
-cve: 2020-8165
-date: 2020-05-18
-url: https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c
-title: Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
-description: |
-  There is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
-  untrusted user input is written to the cache store using the `raw: true` parameter, re-reading the result
-  from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:
-
-  ```
-  data = cache.fetch("demo", raw: true) { untrusted_string }
-  ```
-
-  Versions Affected:  rails < 5.2.5, rails < 6.0.4
-  Not affected:       Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the `raw` option when storing untrusted user input.
-  Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1
-
-  Impact
-  ------
-
-  Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
-  this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.
-
-  In addition to upgrading to the latest versions of Rails, developers should ensure that whenever
-  they are calling `Rails.cache.fetch` they are using consistent values of the `raw` parameter for both
-  reading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,
-  detect if data was serialized using the raw option upon deserialization.
-
-  Workarounds
-  -----------
-
-  It is recommended that application developers apply the suggested patch or upgrade to the latest release as
-  soon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using
-  the `raw` argument should be double-checked to ensure that they conform to the expected format.
-
-patched_versions:
-  - "~> 5.2.4.3"
-  - ">= 6.0.3.1"

data/data/ruby-advisory-db/gems/administrate/CVE-2016-3098.yml

@@ -1,14 +0,0 @@
----
-gem: administrate
-cve: 2016-3098
-title: Cross-site request forgery (CSRF) vulnerability in administrate gem
-date: 2016-04-01
-url: http://seclists.org/oss-sec/2016/q2/0
-
-description: >-
-  `Administrate::ApplicationController` actions didn't have CSRF
-  protection. Remote attackers can hijack user's sessions and use any
-  functionality that administrate exposes on their behalf.
-
-patched_versions:
-  - ">= 0.1.5"

data/data/ruby-advisory-db/gems/administrate/CVE-2020-5257.yml

@@ -1,24 +0,0 @@
----
-gem: administrate
-cve: 2020-5257
-ghsa: 2p5p-m353-833w
-title: Sort order SQL injection via `direction` parameter in administrate
-date: 2020-03-14
-url: https://github.com/advisories/GHSA-2p5p-m353-833w
-description: |
-  In Administrate (rubygem) before version 0.13.0, when sorting by attributes
-  on a dashboard, the direction parameter was not validated before being
-  interpolated into the SQL query.
-
-  This could present a SQL injection if the attacker were able to modify the
-  direction parameter and bypass ActiveRecord SQL protections.
-
-  Whilst this does have a high-impact, to exploit this you need access to the
-  Administrate dashboards, which should generally be behind authentication.
-
-patched_versions:
-  - ">= 0.13.0"
-
-related:
-  url:
-    - https://github.com/thoughtbot/administrate/commit/3ab838b83c5f565fba50e0c6f66fe4517f98eed3

data/data/ruby-advisory-db/gems/aescrypt/CVE-2013-7463.yml

@@ -1,10 +0,0 @@
----
-gem: aescrypt
-cve: 2013-7463
-date: 2013-10-01
-url: https://github.com/Gurpartap/aescrypt/issues/4
-title: Vulnerability in aescrypt because IV is not randomized
-description: |
-  The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the
-  AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to
-  defeat cryptographic protection mechanisms via a chosen plaintext attack.

data/data/ruby-advisory-db/gems/airbrake-ruby/CVE-2019-16060.yml

@@ -1,18 +0,0 @@
----
-gem: airbrake-ruby
-cve: 2019-16060
-date: 2019-04-10
-url: https://github.com/airbrake/airbrake-ruby/issues/468
-title: Blacklist keys are no longer being filtered in airbrake-ruby
-description: |
-  A flaw in airbrake-ruby v4.2.3 prevented user data from being filtered
-  prior to sending to Airbrake. Such data could be user passwords. Therefore, an app
-  could leak user passwords without knowing it.
-unaffected_versions:
-  - "< 4.2.3"
-  - "> 4.2.3"
-patched_versions:
-  - ">= 4.2.4"
-related:
-  url:
-    - https://github.com/airbrake/airbrake-ruby/pull/469

data/data/ruby-advisory-db/gems/archive-tar-minitar/CVE-2016-10173.yml

@@ -1,16 +0,0 @@
----
-gem: archive-tar-minitar
-cve: 2016-10173
-url: https://github.com/atoulme/minitar/issues/5
-title: Archive-Tar-Minitar Directory Traversal Vulnerability
-date: 2016-08-22
-description: |
-  Minitar allows attackers to overwrite arbitrary files during archive
-  extraction via a .. (dot dot) in an extracted filename. Analogous
-  vulnerabilities for unzip and tar:
-  https://www.cvedetails.com/cve/CVE-2001-1268/ and
-  http://www.cvedetails.com/cve/CVE-2001-1267/
-
-  Credit: ecneladis
-patched_versions:
-  - ">= 0.6.0"

data/data/ruby-advisory-db/gems/as/OSVDB-112683.yml

@@ -1,10 +0,0 @@
----
-gem: as
-osvdb: 112683
-url: http://osvdb.org/show/osvdb/112683
-title: as Gem for Ruby Process List Local Plaintext Credentials Disclosure
-date: 2014-09-25
-description: |
-  as Gem for Ruby contains a flaw that is due to the program displaying
-  credential information in plaintext in the process list. This may
-  allow a local attacker to gain access to credential information.

data/data/ruby-advisory-db/gems/authlogic/CVE-2012-6497.yml

@@ -1,15 +0,0 @@
----
-gem: authlogic
-cve: 2012-6497
-osvdb: 89064
-url: https://nvd.nist.gov/vuln/detail/CVE-2012-6497
-title: Ruby on Rails Authlogic Gem secret_token.rb Known secret_token Value Weakness
-date: 2012-12-21
-description: |
-  Ruby on Rails contains a flaw in the Authlogic gem. The issue is triggered
-  when the program makes an unsafe method call for find_by_id. With a specially
-  crafted parameter in an environment that knows the secret_token value in
-  secret_token.rb, a remote attacker to more easily conduct SQL injection
-  attacks.
-patched_versions:
-  - ">= 3.3.0"

data/data/ruby-advisory-db/gems/auto_awesomplete/OSVDB-132800.yml

@@ -1,11 +0,0 @@
----
-gem: auto_awesomplete
-osvdb: 132800
-url: https://github.com/Tab10id/auto_awesomplete/issues/2
-title: |
-  auto_awesomplete Gem for Ruby allows arbitrary search execution
-date: 2016-01-08
-description: |
-  auto_awesomplete Gem for Ruby contains a flaw that is triggered when handling the
-  'params[:default_class_name]' option. This allows users to search any object
-  of all given ActiveRecord classes.

data/data/ruby-advisory-db/gems/auto_select2/OSVDB-132800.yml

@@ -1,13 +0,0 @@
----
-gem: auto_select2
-osvdb: 132800
-url: https://github.com/Loriowar/auto_select2/issues/4
-title: |
-  auto_select2 Gem for Ruby allows arbitrary search execution
-date: 2016-01-08
-description: |
-  auto_select2 Gem for Ruby contains a flaw that is triggered when handling the
-  'params[:default_class_name]' option. This allows users to search any object
-  of all given ActiveRecord classes.
-patched_versions:
-  - ">= 0.5.0"

data/data/ruby-advisory-db/gems/awesome-bot/CVE-2019-15224.yml

@@ -1,19 +0,0 @@
----
-gem: awesome-bot
-cve: 2019-15224
-ghsa: 333g-rpr4-7hxq
-url: https://github.com/rubygems/rubygems.org/issues/2097
-date: 2019-08-20
-title: Code execution backdoor in awesome-bot
-description: |
-  The awesome-bot gem 1.18.0 for Ruby, as distributed on RubyGems.org, included a code-execution
-  backdoor inserted by a third party.
-
-  Users of an affected version should consider downgrading to the last non-affected version of
-  1.17.2 or upgrading to 1.19.x.
-unaffected_versions:
-  - "< 1.18.0"
-  - "> 1.18.0"
-related:
-  url:
-    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/awesome_spawn/CVE-2014-0156.yml

@@ -1,19 +0,0 @@
----
-gem: awesome_spawn
-cve: 2014-0156
-url: https://github.com/ManageIQ/awesome_spawn/commit/e524f85f1c6e292ef7d117d7818521307ac269ff
-title: OS command injection flaw in awesome_spawn
-date: 2014-03-28
-
-description: >-
-  Awesome spawn contains OS command injection vulnerability, which allows
-  execution of additional commands passed to Awesome spawn as arguments, e.g.
-  AwesomeSpawn.run('ls',:params => {'-l' => ";touch haxored"}). If untrusted
-  input was included in command arguments, attacker could use this flaw to
-  execute arbitrary command.
-  
-cvss_v2:  6.8
-
-patched_versions:
-  - "~> 1.2.0"
-  - ">= 1.3.0"

data/data/ruby-advisory-db/gems/backup-agoddard/CVE-2014-4993.yml

@@ -1,8 +0,0 @@
----
-gem: backup-agoddard
-cve: 2014-4993
-osvdb: 108578
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-4993
-title: backup-agoddard Gem for Ruby /lib/backup/cli/utility.rb Process Table Local Plaintext Password Disclosure
-date: 2014-06-30
-description: backup-agoddard Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb that is due to the application exposing password information in plaintext in the process table. This may allow a local attacker to gain access to password information.

data/data/ruby-advisory-db/gems/backup_checksum/CVE-2014-4993.yml

@@ -1,12 +0,0 @@
----
-gem: backup_checksum
-cve: 2014-4993
-osvdb: 108569
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-4993
-title: backup_checksum Gem for Ruby /lib/backup/cli/utility.rb Process List Local Plaintext Password Disclosure
-date: 2014-06-30
-description: |
-  backup_checksum Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb
-  that is triggered as the program displays password information in plaintext
-  in the process list. This may allow a local attacker to gain access to
-  password information.

data/data/ruby-advisory-db/gems/backup_checksum/OSVDB-108570.yml

@@ -1,10 +0,0 @@
----
-gem: backup_checksum
-osvdb: 108570
-url: http://osvdb.org/show/osvdb/108570
-title: backup_checksum Gem for Ruby /lib/backup/cli/utility.rb Metacharacter Handling Remote Command Execution
-date: 2014-06-30
-description: |
-  backup_checksum Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb
-  that is triggered when handling metacharacters. This may allow a remote
-  attacker to execute arbitrary commands.

data/data/ruby-advisory-db/gems/bcrypt/OSVDB-62067.yml

@@ -1,17 +0,0 @@
----
-gem: bcrypt
-platform: jruby
-osvdb: 62067
-url: http://www.mindrot.org/files/jBCrypt/internat.adv
-title: bcrypt-ruby Gem for Ruby incorrect encoding of non US-ASCII characters (JRuby only)
-date: 2010-02-01
-description: |
-  bcrypt-ruby Gem for Ruby suffered from a bug related to character
-  encoding that substantially reduced the entropy of hashed passwords
-  containing non US-ASCII characters. An incorrect encoding step
-  transparently replaced such characters by '?' prior to hashing. In the
-  worst case of a password consisting solely of non-US-ASCII characters,
-  this would cause its hash to be equivalent to all other such passwords
-  of the same length. This issue only affects the JRuby implementation.
-patched_versions:
-  - ">= 2.1.4"

data/data/ruby-advisory-db/gems/bcrypt-ruby/OSVDB-62067.yml

@@ -1,19 +0,0 @@
----
-gem: bcrypt-ruby
-platform: jruby
-osvdb: 62067
-url: http://www.mindrot.org/files/jBCrypt/internat.adv
-title: bcrypt-ruby Gem for Ruby incorrect encoding of non US-ASCII characters (JRuby only)
-date: 2010-02-01
-description: |
-  bcrypt-ruby Gem for Ruby suffered from a bug related to character
-  encoding that substantially reduced the entropy of hashed passwords
-  containing non US-ASCII characters. An incorrect encoding step
-  transparently replaced such characters by '?' prior to hashing. In the
-  worst case of a password consisting solely of non-US-ASCII characters,
-  this would cause its hash to be equivalent to all other such passwords
-  of the same length. This issue only affects the JRuby implementation.
-
-  This gem has been renamed. Please use "bcrypt" from now on.
-patched_versions:
-  - ">= 2.1.4"

data/data/ruby-advisory-db/gems/bibtex-ruby/CVE-2019-10780.yml

@@ -1,16 +0,0 @@
----
-gem: bibtex-ruby
-cve: 2019-10780
-ghsa: c5r5-7pfh-6qg6
-url: https://github.com/advisories/GHSA-c5r5-7pfh-6qg6
-date: 2020-02-14
-title: OS command injection in BibTeX-Ruby
-description: |
-  BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized
-  user input being passed directly to the built-in Ruby Kernel.open method through
-  BibTeX.open.
-
-cvss_v3: 9.8
-
-patched_versions:
-  - ">= 5.1.0"

data/data/ruby-advisory-db/gems/bio-basespace-sdk/CVE-2013-7111.yml

@@ -1,8 +0,0 @@
----
-gem: bio-basespace-sdk
-cve: 2013-7111
-osvdb: 101031
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-7111
-title: Bio Basespace SDK Gem for Ruby Command Line API Key Disclosure
-date: 2013-12-14
-description: Bio Basespace SDK Gem for Ruby contains a flaw that is due to the API client code passing the API_KEY to a curl command. This may allow a local attacker to gain access to API key information by monitoring the process table.

data/data/ruby-advisory-db/gems/bitcoin_vanity/CVE-2019-15224.yml

@@ -1,18 +0,0 @@
----
-gem: bitcoin_vanity
-cve: 2019-15224
-ghsa: 333g-rpr4-7hxq
-url: https://github.com/rubygems/rubygems.org/issues/2097
-date: 2019-08-20
-title: Code execution backdoor in bitcoin_vanity
-description: |
-  The bitcoin_vanity gem 4.3.3 for Ruby, as distributed on RubyGems.org, included a code-execution
-  backdoor inserted by a third party.
-
-  No unaffected version is known to exist, as the gem appears to have been entirely removed.
-unaffected_versions:
-  - "< 4.3.3"
-  - "> 4.3.3"
-related:
-  url:
-    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/blockchain_wallet/CVE-2019-15224.yml

@@ -1,19 +0,0 @@
----
-gem: blockchain_wallet
-cve: 2019-15224
-ghsa: 333g-rpr4-7hxq
-url: https://github.com/rubygems.org/issues/2097
-date: 2019-08-20
-title: Code execution backdoor in blockchain_wallet
-description: |
-  The blockchain_wallet gem 0.0.6 through 0.0.7 for Ruby, as distributed on RubyGems.org, included
-  a code-execution backdoor inserted by a third party.
-
-  Users of an affected version should consider downgrading to the last non-affected version of
-  0.0.5.
-unaffected_versions:
-  - "< 0.0.6"
-  - "> 0.0.7"
-related:
-  url:
-    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/bootstrap/CVE-2016-10735.yml

@@ -1,20 +0,0 @@
----
-gem: bootstrap
-cve: 2016-10735
-url: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/
-title: XSS vulnerability via data-target in bootstrap
-date: 2016-07-27
-
-description: |
-  In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2,
-  XSS is possible in the data-target attribute.
-
-cvss_v2: 4.3
-cvss_v3: 6.1
-
-patched_versions:
-  - '>= 4.0.0-beta.2'
-
-related:
-  url:
-    - https://github.com/twbs/bootstrap/issues/20184

data/data/ruby-advisory-db/gems/bootstrap/CVE-2018-14040.yml

@@ -1,24 +0,0 @@
----
-gem: bootstrap
-cve: 2018-14040
-url: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/
-title: XSS vulnerabilities via data-parent, data-target, data-container in bootstrap
-date: 2018-07-03
-
-description: |
-  In Bootstrap before 4.1.2, XSS is possible in collapse data-parent
-  attribute (CVE-2018-14040), data-target property of scrollspy
-  (CVE-2018-14041), data-container property of tooltip (CVE-2018-14042)
-
-cvss_v2: 4.3
-cvss_v3: 6.1
-
-patched_versions:
-  - '>= 4.1.2'
-
-related:
-  cve:
-    - 2018-14041
-    - 2018-14042
-  url:
-    - https://github.com/twbs/bootstrap/issues/26423

data/data/ruby-advisory-db/gems/bootstrap/CVE-2019-8331.yml

@@ -1,20 +0,0 @@
----
-gem: bootstrap
-cve: 2019-8331
-url: https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/
-title: XSS vulnerability in bootstrap
-date: 2019-02-15
-
-description: |
-  In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible
-  in the tooltip or popover data-template attribute.
-
-cvss_v2: 4.3
-cvss_v3: 6.1
-
-patched_versions:
-  - '>= 4.3.1'
-
-related:
-  url:
-    - https://github.com/twbs/bootstrap-rubygem/releases/tag/v4.3.1