bundler-audit 0.7.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/minitar/CVE-2016-10173.yml

@@ -0,0 +1,20 @@
+---
+gem: minitar
+cve: 2016-10173
+url: https://github.com/halostatue/minitar/issues/16
+title: Minitar Directory Traversal Vulnerability
+date: 2016-08-22
+description: |
+  Minitar allows attackers to overwrite arbitrary files during archive
+  extraction via a .. (dot dot) in an extracted filename. Analogous
+  vulnerabilities for unzip and tar:
+  https://www.cvedetails.com/cve/CVE-2001-1268/ and
+  http://www.cvedetails.com/cve/CVE-2001-1267/
+
+  Credit: ecneladis
+patched_versions:
+  - ">= 0.6.0"
+related:
+  url:
+    - https://github.com/halostatue/minitar/issues/16
+    - https://github.com/halostatue/minitar/commit/e25205ecbb6277ae8a3df1e6a306d7ed4458b6e4

data/data/ruby-advisory-db/gems/moped/CVE-2015-4410.yml

@@ -0,0 +1,17 @@
+---
+gem: moped 
+cve: 2015-4410
+url: http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html
+title: Data Injection Vulnerability in moped Rubygem
+date: 2015-06-04
+
+description: >-
+  A flaw in the ObjectId validation regular expression can enable attackers to inject arbitrary information into a given BSON object.
+
+vendor_patch: 
+  - https://github.com/mongoid/moped/compare/e5fc928bcb5b7b89d171e31e31483be4185971b9...32cba17ad7d3da326778b4d8cd4b52e75bca9d40
+  - https://github.com/mongoid/moped/commit/276fbfd23c5ffb65e6bd18d564c8b6878c2498ac
+
+patched_versions:
+  - "~> 1.5.3"
+  - ">= 2.0.5"

data/data/ruby-advisory-db/gems/multi_xml/CVE-2013-0175.yml

@@ -0,0 +1,16 @@
+---
+gem: multi_xml
+cve: 2013-0175
+osvdb: 89148
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0175
+title: multi_xml Gem for Ruby XML Parameter Parsing Remote Command Execution 
+date: 2013-01-11
+
+description: |
+  The multi_xml Gem for Ruby contains a flaw that is triggered when an error
+  occurs during the parsing of the 'XML' parameter. With a crafted request
+  containing arbitrary symbol and yaml types, a remote attacker can execute
+  arbitrary commands.
+
+patched_versions:
+  - ">= 0.5.2"

data/data/ruby-advisory-db/gems/mustache-js-rails/OSVDB-131671.yml

@@ -0,0 +1,17 @@
+---
+gem: mustache-js-rails
+osvdb: 131671
+url: https://blog.srcclr.com/handlebars_vulnerability_research_findings/
+title: mustache.js - quoteless attributes in templates can lead to XSS
+date: 2015-11-17
+description: |
+  The upstream 'mustache.js' node.js module was found to not properly escape
+  backtick (`) and equals (=) characters, leading to possible content injection
+  via attributes in templates.
+
+  Example:
+  * Template: <a href={{foo}}/>
+  * Input: { 'foo' : 'test.com onload=alert(1)'}
+  * Rendered result: <a href=test.com onload=alert(1)/>
+patched_versions:
+  - ">= 2.0.3"

data/data/ruby-advisory-db/gems/mysql-binuuid-rails/CVE-2018-18476.yml

@@ -0,0 +1,21 @@
+---
+gem: mysql-binuuid-rails
+cve: 2018-18476
+url: https://gist.github.com/viraptor/881276ea61e8d56bac6e28454c79f1e6
+title: mysql-binuuid-rails allows SQL Injection by removing default string escaping
+date: 2018-10-19
+
+description: |
+  mysql-binuuid-rails 1.1.0 and earlier allows SQL Injection because it removes
+  default string escaping for affected database columns. ActiveRecord does not
+  explicitly escape the Binary data type (Type::Binary::Data) for mysql.
+  mysql-binuuid-rails uses a data type that is derived from the base Binary
+  type, except, it doesn’t convert the value to hex. Instead, it assumes the
+  string value provided is a valid hex string and doesn’t do any checks on it.
+
+patched_versions:
+  - ">= 1.1.1"
+
+related:
+  url:
+    - https://github.com/nedap/mysql-binuuid-rails/pull/18

data/data/ruby-advisory-db/gems/net-ldap/CVE-2014-0083.yml

@@ -0,0 +1,14 @@
+---
+gem: net-ldap
+cve: 2014-0083
+osvdb: 106108
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-0083
+title:  Net::LDAP for Ruby lib/net/ldap/password.rb SSHA Password Generation Weak Salt
+date: 2014-02-13
+description: Net::LDAP for Ruby contains a flaw in lib/net/ldap/password.rb. The
+  issue is due to the program generating SSHA passwords with a weak salt value
+  that is between 0 and 999. This may allow a local attacker to more easily gain
+  access to password information.
+cvss_v2: 1.9
+patched_versions:
+  - ">= 0.6.0"

data/data/ruby-advisory-db/gems/net-ldap/CVE-2017-17718.yml

@@ -0,0 +1,17 @@
+---
+gem: net-ldap
+cve: 2017-17718
+date: 2017-12-17
+url: https://github.com/ruby-ldap/ruby-net-ldap/issues/258
+title: No validation of hostname certificate in net-ldap
+description: |
+  The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL
+  Certificate Validation. The LDAP server's certificate was not verified
+  to match the host it was supposed to be connecting to.
+
+patched_versions:
+  - ">= 0.16.0"
+related:
+  url:
+    - https://github.com/ruby-ldap/ruby-net-ldap/pull/279
+    - https://github.com/ruby-ldap/ruby-net-ldap/commit/e4c46a223a19feda78393a793711353aa1febdcd

data/data/ruby-advisory-db/gems/netaddr/CVE-2019-17383.yml

@@ -0,0 +1,13 @@
+---
+gem: netaddr
+cve: 2019-17383
+ghsa: 49pj-69vf-c689
+url: https://github.com/dspinhirne/netaddr-rb/pull/20
+date: 2019-10-14
+title: netaddr world-writeable file permissions
+description: |
+  The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions,
+  such that a gem install may result in 0777 permissions in the target filesystem.
+cvss_v3: 9.8
+patched_versions:
+- ">= 2.0.4"

data/data/ruby-advisory-db/gems/newrelic_rpm/CVE-2013-0284.yml

@@ -0,0 +1,17 @@
+---
+gem: newrelic_rpm
+cve: 2013-0284
+osvdb: 90189
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0284
+title: Ruby on Rails newrelic_rpm Gem Discloses Sensitive Information
+date: 2012-12-06
+
+description: |
+  A bug in the Ruby agent causes database connection information and raw SQL
+  statements to be transmitted to New Relic servers. The database connection
+  information includes the database IP address, username, and password
+
+cvss_v2: 5.0
+
+patched_versions: 
+  - ">= 3.5.3.25"

data/data/ruby-advisory-db/gems/nokogiri/CVE-2012-6685.yml

@@ -0,0 +1,15 @@
+---
+gem: nokogiri
+cve: 2012-6685
+osvdb: 90946
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-6685
+title: Nokogiri Gem for Ruby External Entity (XXE) Expansion Internal Network Response Remote Disclosure
+date: 2012-06-08
+description: libxml2 contains a flaw that may lead to unauthorized disclosure of
+ potentially sensitive information. The issue is triggered when handling the
+ expansion of XML external entities (XXE), which can be used to trigger URL's
+ on an internal network and allow a remote attacker to gain access to their
+ responses.
+cvss_v2: 5.0
+patched_versions:
+  - ">= 1.5.4"

data/data/ruby-advisory-db/gems/nokogiri/CVE-2013-6460.yml

@@ -0,0 +1,18 @@
+---
+gem: nokogiri
+platform: jruby
+cve: 2013-6460
+osvdb: 101179
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-6460
+title: |
+  Nokogiri Gem for JRuby Crafted XML Document Handling Infinite Loop Remote DoS
+date: 2013-12-14
+description: |
+  Nokogiri Gem for JRuby contains a flaw that may allow a remote denial of
+  service. The issue is triggered when handling a specially crafted XML
+  document, which can result in an infinite loop. This may allow a
+  context-dependent attacker to crash the server.
+cvss_v2: 4.3
+patched_versions: 
+  - "~> 1.5.11"
+  - ">= 1.6.1"

data/data/ruby-advisory-db/gems/nokogiri/CVE-2013-6461.yml

@@ -0,0 +1,15 @@
+---
+gem: nokogiri
+cve: 2013-6461
+osvdb: 101458
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-6461
+title: Nokogiri Gem for Ruby External Entity (XXE) Expansion Remote DoS 
+date: 2013-12-14
+description: Nokogiri gem for Ruby contains an flaw that is triggered during the parsing of XML data.
+  The issue is due to an incorrectly configured XML parser accepting XML external entities from
+  an untrusted source. By sending specially crafted XML data, a remote attacker can cause an infinite
+  loop and crash the program.
+cvss_v2:
+patched_versions: 
+  - ~> 1.5.11
+  - ">= 1.6.1"

data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-1819.yml

@@ -0,0 +1,52 @@
+---
+gem: nokogiri
+cve: 2015-1819
+url: https://github.com/sparklemotion/nokogiri/issues/1374
+title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt
+date: 2015-04-14
+description: |
+  Several vulnerabilities were discovered in the libxml2 and libxslt libraries
+  that the Nokogiri gem depends on.
+
+  CVE-2015-1819
+  A denial of service flaw was found in the way libxml2 parsed XML
+  documents. This flaw could cause an application that uses libxml2 to use an
+  excessive amount of memory.
+
+  CVE-2015-7941
+  libxml2 does not properly stop parsing invalid input, which allows
+  context-dependent attackers to cause a denial of service (out-of-bounds read
+  and libxml2 crash) via crafted specially XML data.
+
+  CVE-2015-7942
+  The xmlParseConditionalSections function in parser.c in libxml2
+  does not properly skip intermediary entities when it stops parsing invalid
+  input, which allows context-dependent attackers to cause a denial of service
+  (out-of-bounds read and crash) via crafted XML data.
+
+  CVE-2015-7995
+  The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not
+  check whether the parent node is an element, which allows attackers to cause
+  a denial of service using a specially crafted XML document.
+
+  CVE-2015-8035
+  The xz_decomp function in xzlib.c in libxml2 2.9.1 does not
+  properly detect compression errors, which allows context-dependent attackers
+  to cause a denial of service (process hang) via crafted XML data.
+
+  Another vulnerability was discoverd in libxml2 that could cause parsing
+  of unclosed comments to result in "conditional jump or move depends on
+  uninitialized value(s)" and unsafe memory access. This issue does not have a
+  CVE assigned yet. See related URLs for details. Patched in v1.6.7.rc4.
+patched_versions:
+  - "~> 1.6.6.4"
+  - ">= 1.6.7.rc4"
+related:
+  cve:
+    - 2015-7941
+    - 2015-7942
+    - 2015-7995
+    - 2015-8035
+  url:
+    - https://github.com/sparklemotion/nokogiri/pull/1376
+    - https://github.com/sparklemotion/nokogiri/commit/8f3de6d88d0da11fb62a45daa61b85ce71b4af59

data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-5312.yml

@@ -0,0 +1,92 @@
+---
+gem: nokogiri
+cve: 2015-5312
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s
+title: Nokogiri gem contains several vulnerabilities in libxml2
+date: 2015-12-15
+
+description: |
+  Nokogiri version 1.6.7.1 has been released, pulling in several upstream
+  patches to the vendored libxml2 to address the following CVEs:
+
+  CVE-2015-5312
+  CVSS v2 Base Score: 7.1 (HIGH)
+  The xmlStringLenDecodeEntities function in parser.c in libxml2
+  before 2.9.3 does not properly prevent entity expansion, which
+  allows context-dependent attackers to cause a denial of
+  service (CPU consumption) via crafted XML data, a different
+  vulnerability than CVE-2014-3660.
+
+  CVE-2015-7497
+  CVSS v2 Base Score: 5.0 (MEDIUM)
+  Heap-based buffer overflow in the xmlDictComputeFastQKey
+  function in dict.c in libxml2 before 2.9.3 allows
+  context-dependent attackers to cause a denial of service via
+  unspecified vectors.
+
+  CVE-2015-7498
+  CVSS v2 Base Score: 5.0 (MEDIUM)
+  Heap-based buffer overflow in the xmlParseXmlDecl function in
+  parser.c in libxml2 before 2.9.3 allows context-dependent
+  attackers to cause a denial of service via unspecified vectors
+  related to extracting errors after an encoding conversion
+  failure.
+
+  CVE-2015-7499
+  CVSS v2 Base Score: 5.0 (MEDIUM)
+  Heap-based buffer overflow in the xmlGROW function in parser.c
+  in libxml2 before 2.9.3 allows context-dependent attackers to
+  obtain sensitive process memory information via unspecified
+  vectors.
+
+  CVE-2015-7500
+  CVSS v2 Base Score: 5.0 (MEDIUM)
+  The xmlParseMisc function in parser.c in libxml2 before 2.9.3
+  allows context-dependent attackers to cause a denial of
+  service (out-of-bounds heap read) via unspecified vectors
+  related to incorrect entities boundaries and start tags.
+
+  CVE-2015-8241
+  CVSS v2 Base Score: 6.4 (MEDIUM)
+  The xmlNextChar function in libxml2 2.9.2 does not properly
+  check the state, which allows context-dependent attackers to
+  cause a denial of service (heap-based buffer over-read and
+  application crash) or obtain sensitive information via crafted
+  XML data.
+
+  CVE-2015-8242
+  CVSS v2 Base Score: 5.8 (MEDIUM)
+  The xmlSAX2TextNode function in SAX2.c in the push interface in
+  the HTML parser in libxml2 before 2.9.3 allows
+  context-dependent attackers to cause a denial of
+  service (stack-based buffer over-read and application crash) or
+  obtain sensitive information via crafted XML data.
+
+  CVE-2015-8317
+  CVSS v2 Base Score: 5.0 (MEDIUM)
+  The xmlParseXMLDecl function in parser.c in libxml2 before
+  2.9.3 allows context-dependent attackers to obtain sensitive
+  information via an (1) unterminated encoding value or (2)
+  incomplete XML declaration in XML data, which triggers an
+  out-of-bounds heap read.
+
+cvss_v2: 7.1
+
+unaffected_versions:
+  - "< 1.6.0"
+
+patched_versions:
+  - ">= 1.6.7.1"
+
+related:
+  cve:
+    - 2015-7497
+    - 2015-7498
+    - 2015-7499
+    - 2015-7500
+    - 2015-8241
+    - 2015-8242
+    - 2015-8317
+  url:
+    - https://github.com/sparklemotion/nokogiri/pull/1378
+    - https://github.com/sparklemotion/nokogiri/commit/4205af1a2a546f79d1b48df2ad8b27299c0099c5

data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-7499.yml

@@ -0,0 +1,37 @@
+---
+gem: nokogiri
+cve: 2015-7499
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM
+title: |
+  Nokogiri gem contains a heap-based buffer overflow vulnerability in libxml2
+date: 2016-01-19
+
+description: |
+  Nokogiri version 1.6.7.2 has been released, pulling in several upstream
+  patches to the vendored libxml2 to address the following CVE:
+
+  CVE-2015-7499
+  CVSS v2 Base Score: 5.0 (MEDIUM)
+
+  Heap-based buffer overflow in the xmlGROW function in parser.c
+  in libxml2 before 2.9.3 allows context-dependent attackers to
+  obtain sensitive process memory information via unspecified
+  vectors.
+
+  libxml2 could be made to crash if it opened a specially crafted
+  file. It was discovered that libxml2 incorrectly handled certain
+  malformed documents. If a user or automated system were tricked
+  into opening a specially crafted document, an attacker could
+  possibly cause libxml2 to crash, resulting in a denial of service.
+
+cvss_v2: 5.0
+
+unaffected_versions:
+  - "< 1.6.0"
+
+patched_versions:
+  - ">= 1.6.7.2"
+
+related:
+  url:
+    - https://github.com/sparklemotion/nokogiri/commit/9eb540e7c905924a42757bf0a34c2c00707d536c

data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-8806.yml

@@ -0,0 +1,42 @@
+---
+gem: nokogiri
+cve: 2015-8806
+url: https://github.com/sparklemotion/nokogiri/issues/1473
+title: Denial of service or RCE from libxml2 and libxslt
+date: 2016-06-07
+description: |
+  Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt,
+  which are libraries Nokogiri depends on. It was discovered that libxml2 and
+  libxslt incorrectly handled certain malformed documents, which can allow
+  malicious users to cause issues ranging from denial of service to remote code
+  execution attacks.
+
+  For more information, the Ubuntu Security Notice is a good start: 
+  http://www.ubuntu.com/usn/usn-2994-1/
+
+patched_versions:
+  - ">= 1.6.8"
+unaffected_versions:
+  - "< 1.6.0"
+related:
+  cve:
+    - 2016-1762
+    - 2016-1833
+    - 2016-1834
+    - 2016-1835
+    - 2016-1836
+    - 2016-1837
+    - 2016-1838
+    - 2016-1839
+    - 2016-1840
+    - 2016-2073
+    - 2016-3627
+    - 2016-3705
+    - 2016-4447
+    - 2016-4449
+    - 2016-4483
+  url:
+    - https://github.com/sparklemotion/nokogiri/issues/1473
+    - https://github.com/sparklemotion/nokogiri/commit/03d402212707bd5dfa0a21b7de5e91a7f9d90028
+    - https://mail.gnome.org/archives/xml/2016-May/msg00023.html
+    - http://www.ubuntu.com/usn/usn-2994-1/