bundler-audit 0.7.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/handlebars-source/OSVDB-131671.yml

@@ -0,0 +1,17 @@
+---
+gem: handlebars-source
+osvdb: 131671
+url: https://blog.srcclr.com/handlebars_vulnerability_research_findings/
+title: handlebars.js - quoteless attributes in templates can lead to XSS
+date: 2015-08-24
+description: |
+  The upstream 'handlebars' node.js module was found to not properly escape
+  equals (=) signs, leading to possible content injection via attributes
+  in templates.
+
+  Example:
+  * Template: <a href={{foo}}/>
+  * Input: { 'foo' : 'test.com onload=alert(1)'}
+  * Rendered result: <a href=test.com onload=alert(1)/>
+patched_versions:
+  - ">= 4.0.0"

data/data/ruby-advisory-db/gems/http/CVE-2015-1828.yml

@@ -0,0 +1,14 @@
+---
+gem: http
+cve: 2015-1828
+osvdb: 119927
+url: https://groups.google.com/forum/#!topic/httprb/jkb4oxwZjkU
+title: HTTPS MitM vulnerability in http.rb
+date: 2015-03-24
+description: |
+  http.rb failed to call the OpenSSL::SSL::SSLSocket#post_connection_check method to perform hostname verification.
+  Because of this, an attacker with a valid certificate but with a mismatched subject can perform a MitM attack.
+cvss_v2: 5.0
+patched_versions:
+  - ">= 0.7.3"
+  - "~> 0.6.4"

data/data/ruby-advisory-db/gems/httparty/CVE-2013-1801.yml

@@ -0,0 +1,14 @@
+---
+gem: httparty
+cve: 2013-1801
+osvdb: 90741
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1801
+title: httparty Gem for Ruby Type Casting Parameter Parsing Remote Code Execution
+date: 2013-01-14
+description: |
+  httparty Gem for Ruby contains a flaw that is triggered when a type casting
+  error occurs during the parsing of parameters. This may allow a
+  context-dependent attacker to potentially execute arbitrary code.
+cvss_v2: 7.5
+patched_versions:
+  - ">= 0.10.0"

data/data/ruby-advisory-db/gems/i18n/CVE-2014-10077.yml

@@ -0,0 +1,18 @@
+---
+gem: i18n
+cve: 2014-10077
+url: https://github.com/svenfuchs/i18n/pull/289
+title: i18n Gem for Ruby lib/i18n/core_ext/hash.rb Hash#slice() Function Hash Handling DoS
+date: 2014-09-27
+description: |
+  i18n Gem for Ruby contains a flaw in the Hash#slice() function in
+  lib/i18n/core_ext/hash.rb that is triggered when calling a hash when
+  :some_key is in keep_keys but not in the hash. This may allow an attacker
+  to cause the program to crash.
+
+patched_versions:
+  - ">= 0.8.0"
+
+related:
+  osvdb:
+    - 121500

data/data/ruby-advisory-db/gems/i18n/OSVDB-100528.yml

@@ -0,0 +1,17 @@
+---
+gem: i18n
+cve: 2013-4492
+osvdb: 100528
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/pLrh6DUw998
+title: i18n missing translation error message XSS
+date: 2013-12-03
+
+description: |
+  The HTML exception message raised by I18n::MissingTranslation fails
+  to escape the keys.
+
+cvss_v2: 4.3
+
+patched_versions:
+  - ~> 0.5.1
+  - '>= 0.6.6'

data/data/ruby-advisory-db/gems/iodine/GHSA-85rf-xh54-whp3.yml

@@ -0,0 +1,21 @@
+---
+gem: iodine
+ghsa: 85rf-xh54-whp3
+url: https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3
+date: 2019-10-07
+title: iodine path traversal via malicious URL drafting attack
+description: |
+  Malicious URL drafting attack against iodines static file server
+  may allow path traversal
+
+  Impact:
+  A path traversal vulnerability was detected in iodine's static file service.
+
+  This vulnerability effects any application running iodine's static file server
+  on an effected iodine version.
+
+  Malicious URL drafting may cause the static file server to attempt a response
+  containing data from files that shouldn't be normally accessible from the
+  public folder.
+patched_versions:
+- ">= 0.7.34"

data/data/ruby-advisory-db/gems/jekyll/CVE-2018-17567.yml

@@ -0,0 +1,14 @@
+---
+gem: jekyll
+cve: 2018-17567
+date: 2018-09-28
+url: https://jekyllrb.com/news/2018/09/19/security-fixes-for-3-6-3-7-3-8/
+title: Jekyll _config.yml privilege escalation
+description: Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows
+  attackers to access arbitrary files by specifying a symlink in the "include" key
+  in the "_config.yml" file.
+cvss_v3: 7.5
+patched_versions:
+- "~> 3.6.3"
+- "~> 3.7.4"
+- ">= 3.8.4"

data/data/ruby-advisory-db/gems/jquery-rails/CVE-2015-1840.yml

@@ -0,0 +1,36 @@
+---
+gem: jquery-rails
+cve: 2015-1840
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/XIZPbobuwaY
+title: CSRF Vulnerability in jquery-rails
+date: 2015-06-16
+description: |
+  In the scenario where an attacker might be able to control the href attribute
+  of an anchor tag or the action attribute of a form tag that will trigger a
+  POST action, the attacker can set the href or action to
+  " https://attacker.com" (note the leading space) that will be passed to
+  JQuery, who will see this as a same origin request, and send the user's CSRF
+  token to the attacker domain.
+
+  To work around this problem, change code that allows users to control the
+  href attribute of an anchor tag or the action attribute of a form tag to
+  filter the user parameters.
+
+  For example, code like this:
+
+    link_to params
+
+  to code like this:
+
+    link_to filtered_params
+
+    def filtered_params
+      \# Filter just the parameters that you trust
+    end
+
+  See also:
+  - http://blog.honeybadger.io/understanding-the-rails-jquery-csrf-vulnerability-cve-2015-1840/
+cvss_v2: 5.0
+patched_versions:
+  - ">= 4.0.4"
+  - "~> 3.1.3"

data/data/ruby-advisory-db/gems/jquery-rails/CVE-2019-11358.yml

@@ -0,0 +1,24 @@
+---
+gem: jquery-rails
+framework: rails
+cve: 2019-11358
+date: 2019-04-19
+url: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
+title: Prototype pollution attack through jQuery $.extend
+description: |
+  jQuery before 3.4.0 mishandles jQuery.extend(true, {}, ...) because of
+  bject.prototype pollution. If an unsanitized source object contained an
+  enumerable __proto__ property, it could extend the native Object.prototype.
+
+cvss_v2: 4.3
+cvss_v3: 6.1
+
+patched_versions:
+  - ">= 4.3.4"
+
+related:
+  url:
+    - https://hackerone.com/reports/454365
+    - https://github.com/jquery/jquery/pull/4333
+    - https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b
+    - https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#434

data/data/ruby-advisory-db/gems/jquery-ui-rails/CVE-2016-7103.yml

@@ -0,0 +1,23 @@
+---
+gem: jquery-ui-rails
+framework: rails
+cve: 2016-7103
+date: 2016-08-27
+url: https://github.com/jquery/api.jqueryui.com/issues/281
+title: XSS Vulnerability on closeText option of Dialog jQuery UI
+
+description: |
+  Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might
+  allow remote attackers to inject arbitrary web script or HTML via the
+  closeText parameter of the dialog function.
+
+cvss_v2: 4.3
+cvss_v3: 6.1
+
+patched_versions:
+  - ">= 6.0.0"
+
+related:
+  url:
+    - https://github.com/jquery/jquery-ui/pull/1635
+    - https://github.com/jquery-ui-rails/jquery-ui-rails/blob/master/History.md#600

data/data/ruby-advisory-db/gems/jquery-ujs/CVE-2015-1840.yml

@@ -0,0 +1,35 @@
+---
+gem: jquery-ujs
+cve: 2015-1840
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/XIZPbobuwaY
+title: CSRF Vulnerability in jquery-ujs
+date: 2015-06-16
+description: |
+  In the scenario where an attacker might be able to control the href attribute
+  of an anchor tag or the action attribute of a form tag that will trigger a
+  POST action, the attacker can set the href or action to
+  " https://attacker.com" (note the leading space) that will be passed to
+  JQuery, who will see this as a same origin request, and send the user's CSRF
+  token to the attacker domain.
+
+  To work around this problem, change code that allows users to control the
+  href attribute of an anchor tag or the action attribute of a form tag to
+  filter the user parameters.
+
+  For example, code like this:
+
+    link_to params
+
+  to code like this:
+
+    link_to filtered_params
+
+    def filtered_params
+      \# Filter just the parameters that you trust
+    end
+
+  See also:
+  - http://blog.honeybadger.io/understanding-the-rails-jquery-csrf-vulnerability-cve-2015-1840/
+cvss_v2: 5.0
+patched_versions:
+  - ">= 1.0.4"

data/data/ruby-advisory-db/gems/jruby-openssl/CVE-2009-4123.yml

@@ -0,0 +1,16 @@
+---
+gem: jruby-openssl
+platform: jruby
+cve: 2009-4123
+url: http://jruby.org/2009/12/07/vulnerability-in-jruby-openssl
+title: jruby-openssl Gem for JRuby fails to do proper certificate validation
+date: 2009-12-07
+description: |
+  A security problem involving peer certificate verification was found where
+  failed verification silently did nothing, making affected applications
+  vulnerable to attackers. Attackers could lead a client application to believe
+  that a secure connection to a rogue SSL server is legitimate. Attackers could
+  also penetrate client-validated SSL server applications with a dummy
+  certificate.
+patched_versions:
+  - ">= 0.6"

data/data/ruby-advisory-db/gems/jruby-sandbox/OSVDB-106279.yml

@@ -0,0 +1,12 @@
+---
+gem: jruby-sandbox
+platform: jruby
+osvdb: 106279
+url: http://www.phenoelit.org/stuff/jruby-sandbox.txt
+title: jruby-sandbox Java Class Importation Sandbox Bypass
+date: 2014-04-24
+description: |
+  jruby-sandbox contains a flaw that is triggered when importing Java Classes.
+  This may allow a remote attacker to bypass the sandbox for code execution.
+patched_versions:
+  - ">= 0.2.3"

data/data/ruby-advisory-db/gems/json-jwt/CVE-2018-1000539.yml

@@ -0,0 +1,21 @@
+---
+gem: json-jwt
+cve: 2018-1000539
+date: 2018-04-30
+url: https://github.com/nov/json-jwt/pull/62
+title: Auth tag forgery vulnerability with AES-GCM encrypted JWT
+description: |
+  Ruby's OpenSSL bindings do not check the length of the supplied
+  authentication tag when decrypting an authenticated encryption mode
+  such as AES-GCM, leaving this up to the authors of a gem/app to
+  implement for properly validating the message.
+
+  json-jwt was not checking for the authentication tag length, meaning
+  that with a one byte tag the JWT would be considered not tampered
+  with. This means that with an average of 128 (max 256) attempts an
+  attacker can forge a valid signature.
+
+unaffected_versions:
+  - "< 0.5.1"
+patched_versions:
+  - ">= 1.9.4"

data/data/ruby-advisory-db/gems/json-jwt/CVE-2019-18848.yml

@@ -0,0 +1,15 @@
+---
+gem: json-jwt
+cve: 2019-18848
+ghsa: cff7-6h4q-q5pj
+url: https://github.com/nov/json-jwt/commit/ada16e772906efdd035e3df49cb2ae372f0f948a
+date: 2019-11-14
+title: |
+  json-jwt improper input validation due to lack of element count when
+  splitting string
+description: |
+  The json-jwt gem before 1.11.0 for Ruby lacks an element count during
+  the splitting of a JWE string.
+cvss_v3: 7.5
+patched_versions:
+- ">= 1.11.0"

data/data/ruby-advisory-db/gems/json/CVE-2013-0269.yml

@@ -0,0 +1,20 @@
+--- 
+gem: json
+cve: 2013-0269
+osvdb: 101137
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0269
+title: json Gem for Ruby multiple Remote DoS vulnerabilities
+date: 2013-02-12
+description: |
+  The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby
+  allows remote attackers to cause a denial of service (resource consumption) or
+  bypass the mass assignment protection mechanism via a crafted JSON document
+  that triggers the creation of arbitrary Ruby symbols or certain internal
+  objects, as demonstrated by conducting a SQL injection attack against
+  Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
+
+cvss_v2: 9.0
+patched_versions: 
+  - ~> 1.5.5
+  - ~> 1.6.8
+  - ">= 1.7.7"

data/data/ruby-advisory-db/gems/json/CVE-2020-10663.yml

@@ -0,0 +1,35 @@
+---
+gem: json
+cve: 2020-10663
+url: https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
+title: json Gem for Ruby Unsafe Object Creation Vulnerability (additional fix)
+date: 2020-03-19
+description: |
+  There is an unsafe object creation vulnerability in the json gem bundled with
+  Ruby. This vulnerability has been assigned the CVE identifier CVE-2020-10663.
+  We strongly recommend upgrading the json gem.
+
+  Details
+  -------
+
+  When parsing certain JSON documents, the json gem (including the one bundled
+  with Ruby) can be coerced into creating arbitrary objects in the target system.
+
+  This is the same issue as CVE-2013-0269. The previous fix was incomplete, which
+  addressed JSON.parse(user_input), but didn’t address some other styles of JSON
+  parsing including JSON(user_input) and JSON.parse(user_input, nil).
+
+  See CVE-2013-0269 in detail. Note that the issue was exploitable to cause a
+  Denial of Service by creating many garbage-uncollectable Symbol objects, but
+  this kind of attack is no longer valid because Symbol objects are now
+  garbage-collectable. However, creating arbitrary objects may cause severe
+  security consequences depending upon the application code.
+
+patched_versions:
+  - ">= 2.3.0"
+
+related:
+  cve:
+    - 2013-0269
+  url:
+    - https://groups.google.com/forum/#!topic/ruby-security-ann/ermX1eQqqKA

data/data/ruby-advisory-db/gems/json/OSVDB-101157.yml

@@ -0,0 +1,14 @@
+--- 
+gem: json
+osvdb: 101157
+url: http://osvdb.org/show/osvdb/101157
+title: json Gem for Ruby Data Handling Stack Buffer Overflow
+date: 2007-05-21
+description: |
+  json Gem for Ruby contains an overflow condition that is triggered as
+  user-supplied input is not properly validated when handling specially crafted
+  data. This may allow a remote attacker to cause a stack-based buffer
+  overflow, resulting in a denial of service or potentially allowing the
+  execution of arbitrary code.
+patched_versions: 
+  - ">= 1.1.0"

data/data/ruby-advisory-db/gems/kafo/CVE-2014-0135.yml

@@ -0,0 +1,15 @@
+---
+gem: kafo
+cve: 2014-0135
+osvdb: 106826
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-0135
+title: Kafo default_values.yaml Insecure Permissions Local Information Disclosure
+date: 2014-03-13
+description: Kafo contains a flaw that is due to the program using insecure
+  world-readable permissions for the default_values.yaml file. This may allow a
+  local attacker to gain access to password and other unspecified sensitive
+  information located within the file.
+cvss_v2: 1.9
+patched_versions:
+  - "~> 0.3.17"
+  - ">= 0.5.2"

data/data/ruby-advisory-db/gems/kajam/CVE-2014-4999.yml

@@ -0,0 +1,12 @@
+---
+gem: kajam
+cve: 2014-4999
+osvdb: 108529
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-4999
+title: kajam Gem for Ruby /dataset/lib/dataset/database/postgresql.rb Process List Local Plaintext Password Disclosure
+date: 2014-06-30
+description: |
+  kajam Gem for Ruby contains a flaw in
+  /dataset/lib/dataset/database/postgresql.rb that is triggered as the program
+  exposes the MySQL or PostgreSQL password in the process list. This may allow
+  a local attacker to gain access to password information.

data/data/ruby-advisory-db/gems/kajam/OSVDB-108530.yml

@@ -0,0 +1,11 @@
+---
+gem: kajam
+osvdb: 108530
+url: http://osvdb.org/show/osvdb/108530
+title: kajam Gem for Ruby /dataset/lib/dataset/database/postgresql.rb Metacharacter Handling Remote Command Execution
+date: 2014-06-30
+description: |
+  kajam Gem for Ruby contains a flaw in
+  /dataset/lib/dataset/database/postgresql.rb that is triggered when handling
+  metacharacters. This may allow a remote attacker to execute arbitrary
+  commands.

data/data/ruby-advisory-db/gems/kaminari/CVE-2020-11082.yml

@@ -0,0 +1,34 @@
+---
+gem: kaminari
+cve: 2020-11082
+ghsa: r5jw-62xg-j433
+url: https://github.com/kaminari/kaminari/security/advisories/GHSA-r5jw-62xg-j433
+date: 2020-05-28
+title: Cross-Site Scripting in Kaminari via `original_script_name` parameter
+description: |-
+  ### Impact
+  There was a vulnerability in versions of Kaminari that would allow an attacker to inject arbitrary code into pages with pagination links.
+
+  For example, an attacker could craft pagination links that link to other domain or host:
+  https://example.com/posts?page=4&original_script_name=https://another-host.example.com
+
+  In addition, an attacker could also craft pagination links that include JavaScript code that runs when a user clicks the link:
+  https://example.com/posts?page=4&original_script_name=javascript:alert(42)%3b//
+
+  ### Releases
+  The 1.2.1 gem including the patch has already been released.
+  All past released versions are affected by this vulnerability.
+
+  ### Workarounds
+  Application developers who can't update the gem can workaround by overriding the `PARAM_KEY_EXCEPT_LIST` constant.
+
+  ```ruby
+  module Kaminari::Helpers
+    PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
+  end
+  ```
+
+cvss_v3: 6.4
+
+patched_versions:
+  - ">= 1.2.1"