bundler-audit 0.7.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/devise/CVE-2013-0233.yml

@@ -0,0 +1,20 @@
+---
+gem: devise
+cve: 2013-0233
+osvdb: 89642
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0233
+title: Devise Database Type Conversion Crafted Request Parsing Security Bypass
+date: 2013-01-28
+
+description: |
+  Devise contains a flaw that is triggered during when a type conversion error
+  occurs during the parsing of a malformed request. With a specially crafted
+  request, a remote attacker can bypass security restrictions.
+
+cvss_v2: 6.8
+
+patched_versions:
+  - ~> 1.5.4
+  - ~> 2.0.5
+  - ~> 2.1.3
+  - ">= 2.2.3"

data/data/ruby-advisory-db/gems/devise/CVE-2015-8314.yml

@@ -0,0 +1,14 @@
+---
+gem: devise
+cve: 2015-8314
+url: http://blog.plataformatec.com.br/2016/01/improve-remember-me-cookie-expiration-in-devise/
+title: Devise Gem for Ruby Unauthorized Access Using Remember Me Cookie
+date: 2016-01-18
+description: |
+  Devise version before 3.5.4 uses cookies to implement a "Remember me"
+  functionality. However, it generates the same cookie for all devices. If an
+  attacker manages to steal a remember me cookie and the user does not change
+  the password frequently, the cookie can be used to gain access to the
+  application indefinitely.
+patched_versions:
+  - ">= 3.5.4"

data/data/ruby-advisory-db/gems/devise/CVE-2019-16109.yml

@@ -0,0 +1,13 @@
+---
+gem: devise
+cve: 2019-16109
+url: https://github.com/plataformatec/devise/issues/5071
+title: Devise Gem for Ruby confirmation token validation with a blank string
+date: 2019-09-08
+description: |
+  Devise before 4.7.1 confirms accounts upon receiving a request with a blank
+  confirmation_token, if a database record has a blank value in the confirmation_token column.
+  However, there is no scenario within Devise itself in which such database records would exist.
+
+patched_versions:
+  - ">= 4.7.1"

data/data/ruby-advisory-db/gems/devise/CVE-2019-5421.yml

@@ -0,0 +1,16 @@
+---
+gem: devise
+cve: 2019-5421
+url: https://github.com/plataformatec/devise/issues/4981
+title: Devise Gem for Ruby Time-of-check Time-of-use race condition with lockable module
+date: 2019-02-07
+description: |
+  Devise ruby gem before 4.6.0 when the `lockable` module is used is vulnerable to a
+  time-of-check time-of-use (TOCTOU) race condition due to `increment_failed_attempts`
+  within the `Devise::Models::Lockable` class not being concurrency safe.
+
+patched_versions:
+  - ">= 4.6.0"
+
+cvss_v2: 7.5
+cvss_v3: 9.8

data/data/ruby-advisory-db/gems/devise/OSVDB-114435.yml

@@ -0,0 +1,17 @@
+---
+gem: devise
+osvdb: 114435
+url: http://blog.plataformatec.com.br/2013/08/csrf-token-fixation-attacks-in-devise/
+title: CSRF token fixation attacks in Devise
+date: 2013-08-02
+
+description: |
+  Devise contains a flaw that allows a remote, user-assisted attacker to
+  conduct a CSRF token fixation attack. This issue is triggered as previous
+  CSRF tokens are not properly invalidated when a new token is created.
+  If an attacker has knowledge of said token, a specially crafted request can
+  be made to it, allowing the attacker to conduct CSRF attacks.
+
+patched_versions:
+  - ~> 2.2.5
+  - ">= 3.0.1"

data/data/ruby-advisory-db/gems/doge-coin/CVE-2019-15224.yml

@@ -0,0 +1,19 @@
+---
+gem: doge-coin
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in doge-coin
+description: |
+  The doge-coin gem 1.0.2 for Ruby, as distributed on RubyGems.org, included a code-execution
+  backdoor inserted by a third party.
+
+  Users of an affected version should consider downgrading to the last non-affected version of
+  1.0.1.
+unaffected_versions:
+  - "< 1.0.2"
+  - "> 1.0.2"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/doorkeeper-openid_connect/CVE-2019-9837.yml

@@ -0,0 +1,16 @@
+---
+gem: doorkeeper-openid_connect
+cve: 2019-9837
+date: 2019-03-25
+url: https://github.com/doorkeeper-gem/doorkeeper-openid_connect/blob/master/CHANGELOG.md#v154-2019-02-15
+title: Doorkeeper::OpenidConnect Open Redirect
+description: Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper)
+  1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in
+  an OAuth authorization request (that results in an error response) with the 'openid'
+  scope and a prompt=none value. This allows phishing attacks against the authorization
+  flow.
+cvss_v3: 6.1
+patched_versions:
+  - ">= 1.5.4"
+unaffected_versions:
+  - "< 1.4.0"

data/data/ruby-advisory-db/gems/doorkeeper/CVE-2014-8144.yml

@@ -0,0 +1,26 @@
+---
+gem: doorkeeper
+cve: 2014-8144
+osvdb: 116010
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/5_VqJtNc8jw
+title: |
+  Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0
+  and earlier.
+date: 2014-12-18
+
+description: |
+  Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0
+  and earlier allows remote attackers to hijack the user's OAuth
+  autorization code. This vulnerability has been assigned the CVE
+  identifier CVE-2014-8144.
+
+  Doorkeeper's endpoints didn't have CSRF protection. Any HTML document
+  on the Internet can then read a user's authorization code with
+  arbitrary scope from any Doorkeeper-compatible Rails app you are
+  logged in.
+
+cvss_v2: 6.8
+
+patched_versions:
+  - ~> 1.4.1
+  - ">= 2.0.0"

data/data/ruby-advisory-db/gems/doorkeeper/CVE-2016-6582.yml

@@ -0,0 +1,43 @@
+---
+gem: doorkeeper
+cve: 2016-6582
+date: 2016-08-18
+url: "http://www.openwall.com/lists/oss-security/2016/08/19/2"
+
+title: Doorkeeper gem does not revoke tokens & uses wrong auth/auth method
+
+description: |
+  Doorkeeper failed to implement OAuth 2.0 Token Revocation (RFC 7009) in the
+  following ways:
+
+  1. Public clients making valid, unauthenticated calls to revoke a token
+     would not have their token revoked
+  2. Requests were not properly authenticating the *client credentials* but
+     were, instead, looking at the access token in a second location
+  3. Because of 2, the requests were also not authorizing confidential
+     clients' ability to revoke a given token. It should only revoke tokens
+     that belong to it.
+
+  The security implication is: OAuth 2.0 clients who "log out" a user expect
+  to have the corresponding access & refresh tokens revoked, preventing an
+  attacker who may have already hijacked the session from continuing to
+  impersonate the victim. Because of the bug described above, this is not the
+  case. As far as OWASP is concerned, this counts as broken authentication
+  design.
+
+  MITRE has assigned CVE-2016-6582 due to the security issues raised. An
+  attacker, thanks to 1, can replay a hijacked session after a victim logs
+  out/revokes their token. Additionally, thanks to 2 & 3, an attacker via a
+  compromised confidential client could "grief" other clients by revoking
+  their tokens (albeit this is an exceptionally narrow attack with little
+  value).
+
+unaffected_versions:
+  - "< 1.2.0"
+
+patched_versions:
+  - ">= 4.2.0"
+
+related:
+  url:
+    - https://github.com/doorkeeper-gem/doorkeeper/commit/fb938051777a3c9cb071e96fc66458f8f615bd53

data/data/ruby-advisory-db/gems/doorkeeper/CVE-2018-1000088.yml

@@ -0,0 +1,39 @@
+---
+gem: doorkeeper
+cve: 2018-1000088
+date: 2018-02-21
+url: "https://blog.justinbull.ca/cve-2018-1000088-stored-xss-in-doorkeeper/"
+
+title: Doorkeeper gem has stored XSS on authorization consent view
+
+description: |
+  Stored XSS on the OAuth Client's name will cause users being prompted for
+  consent via the "implicit" grant type to execute the XSS payload.
+
+  The XSS attack could gain access to the user's active session, resulting in
+  account compromise.
+
+  Any user is susceptible if they click the authorization link for the
+  malicious OAuth client. Because of how the links work, a user cannot tell if
+  a link is malicious or not without first visiting the page with the XSS
+  payload.
+
+  If 3rd parties are allowed to create OAuth clients in the app using
+  Doorkeeper, upgrade to the patched versions immediately.
+
+  Additionally there is stored XSS in the native_redirect_uri form element.
+
+  DWF has assigned CVE-2018-1000088.
+
+cvss_v3: 7.6
+
+unaffected_versions:
+  - "< 2.1.0"
+
+patched_versions:
+  - ">= 4.2.6"
+
+related:
+  url:
+    - https://github.com/doorkeeper-gem/doorkeeper/issues/969
+    - https://github.com/doorkeeper-gem/doorkeeper/issues/970

data/data/ruby-advisory-db/gems/doorkeeper/CVE-2018-1000211.yml

@@ -0,0 +1,39 @@
+---
+gem: doorkeeper
+cve: 2018-1000211
+date: 2018-07-11
+url: "https://blog.justinbull.ca/cve-2018-1000211-public-apps-cant-revoke-tokens-in-doorkeeper/"
+
+title: Doorkeeper gem does not revoke token for public clients
+
+description: |
+  Any OAuth application that uses public/non-confidential authentication when
+  interacting with Doorkeeper is unable to revoke its tokens when calling the
+  revocation endpoint.
+
+  A bug in the token revocation API would cause it to attempt to authenticate
+  the public OAuth client as if it was a confidential app. Because of this, the
+  token is never revoked.
+
+  The impact of this is the access or refresh token is not revoked, leaking
+  access to protected resources for the remainder of that token's lifetime.
+
+  If Doorkeeper is used to facilitate public OAuth apps and leverage token
+  revocation functionality, upgrade to the patched versions immediately.
+
+  Credit to Roberto Ostinelli for discovery, Justin Bull for the fixes.
+
+  DWF has assigned CVE-2018-1000211.
+
+unaffected_versions:
+  - "< 4.2.0"
+
+patched_versions:
+  - ">= 4.4.0"
+  - ">= 5.0.0.rc2"
+
+related:
+  url:
+    - https://github.com/doorkeeper-gem/doorkeeper/issues/891
+    - https://github.com/doorkeeper-gem/doorkeeper/pull/1119
+    - https://github.com/doorkeeper-gem/doorkeeper/pull/1120

data/data/ruby-advisory-db/gems/doorkeeper/CVE-2020-10187.yml

@@ -0,0 +1,34 @@
+---
+gem: doorkeeper
+ghsa: j7vx-8mqj-cqp9
+cve: 2020-10187
+date: 2020-05-02
+url: https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-j7vx-8mqj-cqp9
+title: Doorkeeper application secret information disclosure vulnerability
+
+description: |
+  Information disclosure vulnerability. Allows an attacker to see all
+  Doorkeeper::Application model attribute values (including secrets) after
+  authorizing an application to their user.
+
+  An application is vulnerable if the authorized applications controller is
+  enabled (GET /oauth/authorized_applications.json).
+
+  Recommended additional hardening for >= 5.1 is to enable application secrets
+  hashing. This would render the exposed secret useless.
+
+unaffected_versions:
+  - "< 5.0.0"
+
+patched_versions:
+  - "~> 5.0.3"
+  - "~> 5.1.1"
+  - "~> 5.2.5"
+  - ">= 5.3.2"
+
+cvss_v2: 5.5
+cvss_v3: 5.4
+
+related:
+  url:
+    - https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6

data/data/ruby-advisory-db/gems/doorkeeper/OSVDB-118830.yml

@@ -0,0 +1,17 @@
+---
+gem: doorkeeper
+osvdb: 118830
+url: http://www.osvdb.org/show/osvdb/118830
+title: |
+  Doorkeeper Gem for Ruby stores sensitive information
+  in production logs
+date: 2015-02-10
+description: |
+  Doorkeeper Gem for Ruby contains a flaw in lib/doorkeeper/engine.rb.
+  The issue is due to the program storing sensitive information in
+  production logs. This may allow a local attacker to gain access to
+  sensitive information.
+cvss_v2:
+patched_versions:
+  - "~> 1.4.2"
+  - ">= 2.1.2"

data/data/ruby-advisory-db/gems/dragonfly/CVE-2013-1756.yml

@@ -0,0 +1,16 @@
+---
+gem: dragonfly
+cve: 2013-1756
+osvdb: 90647
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1756
+title: Dragonfly Gem for Ruby Crafted Request Parsing Remote Code Execution
+date: 2013-02-19
+description: |
+  Dragonfly Gem for Ruby contains a flaw that is triggered during the parsing
+  of a specially crafted request. This may allow a remote attacker to execute
+  arbitrary code.
+cvss_v2: 7.5
+patched_versions:
+  - ">= 0.9.13"
+unaffected_versions:
+  - "< 0.7.0"

data/data/ruby-advisory-db/gems/dragonfly/CVE-2013-5671.yml

@@ -0,0 +1,14 @@
+---
+gem: dragonfly
+cve: 2013-5671
+osvdb: 96798
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-5671
+title: fog-dragonfly Gem for Ruby imagemagickutils.rb Remote Command Execution
+date: 2013-09-03
+description: |
+  fog-dragonfly Gem for Ruby contains a flaw that is due to the program
+  failing to properly sanitize input passed via the imagemagickutils.rb script.
+  This may allow a remote attacker to execute arbitrary commands.
+cvss_v2: 7.5
+patched_versions:
+  - ">= 0.8.4"

data/data/ruby-advisory-db/gems/dragonfly/OSVDB-110439.yml

@@ -0,0 +1,13 @@
+---
+gem: dragonfly
+osvdb: 110439
+url: http://osvdb.org/show/osvdb/110439
+title: Dragonfly Gem for Ruby Image Uploading & Processing Remote Command Execution
+date: 2014-08-25
+description: |
+  Dragonfly Gem for Ruby contains a flaw in Uploading & Processing that is due
+  to the gem failing to restrict arbitrary commands to imagemagicks convert.
+  This may allow a remote attacker to gain read/write access to the filesystem
+  and execute arbitrary commands.
+patched_versions:
+  - ">= 1.0.7"

data/data/ruby-advisory-db/gems/dragonfly/OSVDB-97854.yml

@@ -0,0 +1,12 @@
+---
+gem: dragonfly
+osvdb: 97854
+url: http://osvdb.org/show/osvdb/97854
+title: Dragonfly Gem for Ruby on Windows Shell Escaping Weakness
+date: 2011-09-01
+description: |
+  Dragonfly Gem for Ruby contains a flaw that is due to the program failing to
+  properly escape a shell that contains injected characters. This may allow a
+  context-dependent attacker to potentially execute arbitrary commands.
+patched_versions:
+  - ">= 0.9.6"

data/data/ruby-advisory-db/gems/easymon/CVE-2018-1000855.yml

@@ -0,0 +1,16 @@
+---
+gem: easymon
+date: 2018-11-09
+url: https://github.com/basecamp/easymon/issues/26
+cve: 2018-1000855
+title: Reflected XSS in Firefox in check endpoint
+description: |
+  When passing an invalid check name as parameter to the endpoint where
+  the easymon routes are mounted, a 406 response with a body that contains the invalid
+  check name unescaped is returned. Malicious JavaScript can be injected into that
+  invalid name and have it executed in Firefox
+patched_versions:
+  - ">= 1.4.1"
+related:
+  url:
+    - https://github.com/basecamp/easymon/pull/25

data/data/ruby-advisory-db/gems/echor/CVE-2014-1834.yml

@@ -0,0 +1,12 @@
+---
+gem: echor
+cve: 2014-1834
+osvdb: 102129
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-1834
+title: echor Gem for Ruby backplane.rb perform_request Function Arbitrary Command Execution
+date: 2014-01-14
+description: |
+  Echor Gem for Ruby contains a flaw in backplane.rb in the perform_request
+  function that is triggered when a semi-colon (;) is injected into a username
+  or password. This may allow a context-dependent attacker to inject arbitrary
+  commands if the gem is used in a rails application.

data/data/ruby-advisory-db/gems/echor/CVE-2014-1835.yml

@@ -0,0 +1,11 @@
+---
+gem: echor
+cve: 2014-1835
+osvdb: 102130
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-1835
+title: echor Gem for Ruby Process Listing Local Plaintext Credential Disclosure
+date: 2014-01-14
+description: |
+  echor Gem for Ruby contains a flaw that is due to the program exposing
+  credential information in the system process listing. This may allow a local
+  attacker to gain access to plaintext credential information.

data/data/ruby-advisory-db/gems/ember-source/CVE-2013-4170.yml

@@ -0,0 +1,25 @@
+---
+gem: ember-source
+cve: 2013-4170
+url: https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM
+title: |
+  Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data
+date: 2013-07-25
+description: |
+  In general, Ember.js escapes or strips any user-supplied content
+  before inserting it in strings that will be sent to innerHTML.
+  However, the `tagName` property of an `Ember.View` was inserted into
+  such a string without being sanitized. This means that if an
+  application assigns a view's `tagName` to user-supplied data, a
+  specially-crafted payload could execute arbitrary JavaScript in the
+  context of the current domain ("XSS").
+
+  This vulnerability only affects applications that assign or bind
+  user-provided content to `tagName`.
+patched_versions:
+  - ~> 1.0.0.rc1.1
+  - ~> 1.0.0.rc2.1
+  - ~> 1.0.0.rc3.1
+  - ~> 1.0.0.rc4.1
+  - ~> 1.0.0.rc5.1
+  - ">= 1.0.0.rc6.1"