bundler-audit 0.7.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/nokogiri/CVE-2020-7595.yml

@@ -0,0 +1,20 @@
+---
+gem: nokogiri
+cve: 2020-7595
+url: https://github.com/sparklemotion/nokogiri/issues/1992
+date: 2020-02-12
+title: libxml2 2.9.10 has an infinite loop in a certain end-of-file situation
+description: |-
+
+  Nokogiri has backported the patch for CVE-2020-7595 into its vendored version
+  of libxml2, and released this as v1.10.8
+
+  CVE-2020-7595 has not yet been addressed in an upstream libxml2 release, and
+  so Nokogiri versions <= v1.10.7 are vulnerable.
+
+patched_versions:
+  - ">= 1.10.8"
+
+cvss_v2: 5.0
+cvss_v3: 7.5
+

data/data/ruby-advisory-db/gems/nokogiri/OSVDB-118481.yml

@@ -0,0 +1,15 @@
+---
+gem: nokogiri
+platform: jruby
+osvdb: 118481
+url: https://github.com/sparklemotion/nokogiri/pull/1087
+title: |
+  Nokogiri Gem for JRuby XML Document Root Element Handling Memory Consumption
+  Remote DoS
+date: 2014-04-30
+description: |
+  Nokogiri Gem for JRuby contains a flaw that is triggered when handling a root
+  element in an XML document. This may allow a remote attacker to cause a
+  consumption of memory resources.
+patched_versions:
+  - ">= 1.6.3"

data/data/ruby-advisory-db/gems/nori/CVE-2013-0285.yml

@@ -0,0 +1,19 @@
+---
+gem: nori
+cve: 2013-0285
+osvdb: 90196
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0285
+title: Ruby Gem nori Parameter Parsing Remote Code Execution
+date: 2013-01-10
+
+description: |
+  The Ruby Gem nori has a parameter parsing error that may allow an attacker
+  to execute arbitrary code. This vulnerability has to do with type casting
+  during parsing, and is related to CVE-2013-0156.
+
+cvss_v2: 7.5
+
+patched_versions:
+  - ~> 1.0.3
+  - ~> 1.1.4
+  - ">= 2.0.2"

data/data/ruby-advisory-db/gems/omniauth-facebook/CVE-2013-4562.yml

@@ -0,0 +1,22 @@
+---
+gem: omniauth-facebook
+cve: 2013-4562
+osvdb: 99693
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-4562
+title: omniauth-facebook Gem for Ruby Unspecified CSRF 
+date: 2013-11-12
+
+description: |
+  omniauth-facebook Gem for Ruby contains a flaw as HTTP requests do not
+  require multiple steps, explicit confirmation, or a unique token when
+  performing certain sensitive actions. By tricking a user into following
+  a specially crafted link, a context-dependent attacker can perform a
+  Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to
+  perform an unspecified action.
+
+cvss_v2: 6.8
+
+patched_versions:
+  - ">= 1.5.0"
+unaffected_versions:
+  - "<= 1.4.0"

data/data/ruby-advisory-db/gems/omniauth-facebook/CVE-2013-4593.yml

@@ -0,0 +1,17 @@
+---
+gem: omniauth-facebook
+cve: 2013-4593
+osvdb: 99888
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-4593
+title: omniauth-facebook Gem for Ruby Insecure Access Token Handling Authentication Bypass 
+date: 2013-11-14
+
+description: |
+  omniauth-facebook Gem for Ruby contains a flaw that is due to the application
+  supporting passing the access token via the URL. This may allow a remote
+  attacker to bypass authentication and authenticate as another user.
+
+cvss_v2: 6.8
+
+patched_versions:
+  - ">= 1.5.1"

data/data/ruby-advisory-db/gems/omniauth-oauth2/CVE-2012-6134.yml

@@ -0,0 +1,16 @@
+---
+gem: omniauth-oauth2
+cve: 2012-6134
+osvdb: 90264
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-6134
+title: Ruby on Rails omniauth-oauth2 Gem CSRF vulnerability
+date: 2012-09-08
+
+description: |
+  The omniauth-oauth2 Ruby Gem contains a flaw that allows an attacker to
+  inject values into a user's session through a CSRF attack.
+
+cvss_v2: 6.8
+
+patched_versions:
+  - ">= 1.1.1"

data/data/ruby-advisory-db/gems/omniauth-saml/CVE-2017-11430.yml

@@ -0,0 +1,17 @@
+---
+gem: omniauth-saml
+cve: 2017-11430
+url: https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
+date: 2018-02-27
+title: omniauth-saml authentication bypass via incorrect XML canonicalization and DOM traversal 
+description: |
+  OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the
+  results of XML DOM traversal and canonicalization APIs in such a way that an attacker
+  may be able to manipulate the SAML data without invalidating the cryptographic signature,
+  allowing the attack to potentially bypass authentication to SAML service providers.
+
+cvss_v3: 9.8
+cvss_v2: 7.5
+
+patched_versions:
+  - ">= 1.10.0"

data/data/ruby-advisory-db/gems/omniauth/CVE-2015-9284.yml

@@ -0,0 +1,25 @@
+---
+gem: omniauth
+cve: 2015-9284
+url: https://github.com/omniauth/omniauth/pull/809
+title: CSRF vulnerability in OmniAuth's request phase
+date: 2015-05-25
+
+description: |
+  The request phase of the OmniAuth Ruby gem is vulnerable to Cross-Site
+  Request Forgery (CSRF) when used as part of the Ruby on Rails framework, allowing
+  accounts to be connected without user intent, user interaction, or feedback to
+  the user. This permits a secondary account to be able to sign into the web
+  application as the primary account.
+  
+  In order to mitigate this vulnerability, Rails users should consider using the
+  `omniauth-rails_csrf_protection` gem.
+  
+  More info is available here: https://github.com/omniauth/omniauth/pull/809#issuecomment-502079405
+
+cvss_v2: 6.8
+cvss_v3: 8.8
+
+related:
+  url:
+    - https://github.com/cookpad/omniauth-rails_csrf_protection

data/data/ruby-advisory-db/gems/omniauth/CVE-2017-18076.yml

@@ -0,0 +1,18 @@
+---
+gem: omniauth
+cve: 2017-18076
+url: https://github.com/omniauth/omniauth/pull/867
+title: omniauth leaks authenticity token in callback params
+date: 2017-01-11
+
+description: |
+  In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.
+
+cvss_v2: 6.8
+
+patched_versions:
+  - ">= 1.3.2"
+
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-18076

data/data/ruby-advisory-db/gems/omniauth_amazon/CVE-2019-15224.yml

@@ -0,0 +1,19 @@
+---
+gem: omniauth_amazon
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in omniauth_amazon
+description: |-
+  The omniauth_amazon gem 1.0.1 for Ruby, as distributed on RubyGems.org, included a
+  code-execution backdoor inserted by a third party.
+
+  Users of an affected version should consider downgrading to the last non-affected version of
+  1.0.1.
+unaffected_versions:
+  - "< 1.0.1"
+  - "> 1.0.1"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/open-uri-cached/OSVDB-121701.yml

@@ -0,0 +1,13 @@
+---
+gem: open-uri-cached
+cve: 2015-3649
+osvdb: 121701
+url: http://seclists.org/oss-sec/2015/q2/373
+title: open-uri-cached Gem for Ruby Unsafe Temporary File Creation Local Privilege Escalation
+date: 2015-05-05
+description: |
+  open-uri-cached Gem for Ruby contains a flaw that is due to the
+  program creating temporary files in a predictable, unsafe manner when using
+  YAML. This may allow a local attacker to gain elevated privileges.
+cvss_v2:
+patched_versions:

data/data/ruby-advisory-db/gems/openssl/CVE-2016-7798.yml

@@ -0,0 +1,16 @@
+---
+gem: openssl
+cve: 2016-7798
+url: https://github.com/ruby/openssl/issues/49
+date: 2017-10-24
+title: Incorrect handling of initialization vector in the GCM mode in OpenSSL
+description: |
+  The openssl gem for Ruby uses the same initialization vector (IV) in
+  GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for
+  context-dependent attackers to bypass the encryption protection mechanism.
+
+cvss_v3: 7.5
+cvss_v2: 5.0
+
+patched_versions:
+  - ">= 2.0.0"

data/data/ruby-advisory-db/gems/ox/CVE-2017-15928.yml

@@ -0,0 +1,16 @@
+---
+gem: ox
+cve: 2017-15928
+url: https://github.com/ohler55/ox/issues/194
+date: 2017-10-27
+title: ox ruby gem segmentation fault via parse_obj
+description: |
+  In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation
+  fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated
+  "Ox should handle the error more gracefully" but has not confirmed a security implication.
+
+cvss_v3: 7.5
+cvss_v2: 5.0
+
+patched_versions:
+  - ">= 2.8.1"

data/data/ruby-advisory-db/gems/ox/CVE-2017-16229.yml

@@ -0,0 +1,16 @@
+---
+gem: ox
+cve: 2017-16229
+url: https://github.com/ohler55/ox/issues/195
+date: 2017-10-29
+title: ox ruby gem stack overflow in sax_parse
+description: |
+  In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based
+  buffer over-read in the read_from_str function in sax_buf.c when a crafted input
+  is supplied to sax_parse.
+
+cvss_v3: 5.5
+cvss_v2: 4.3
+
+patched_versions:
+  - ">= 2.8.2"

data/data/ruby-advisory-db/gems/padrino-contrib/CVE-2019-16145.yml

@@ -0,0 +1,11 @@
+---
+gem: padrino-contrib
+cve: 2019-16145
+ghsa: rwpr-83g3-96g7
+url: https://github.com/padrino/padrino-contrib/pull/35
+date: 2019-09-23
+title: padrino-contrib XSS via caption parameter of breadcrumbs helper
+description: |
+  The breadcrumbs contributed module through 0.2.0 for Padrino Framework
+  allows XSS via a caption.
+cvss_v3: 6.1

data/data/ruby-advisory-db/gems/paperclip/CVE-2015-2963.yml

@@ -0,0 +1,16 @@
+---
+gem: paperclip
+cve: 2015-2963
+url: https://robots.thoughtbot.com/paperclip-security-release
+title: |
+  Paperclip Gem for Ruby vulnerable to content type spoofing
+date: 2015-06-05
+description: |
+  There is an issue where if an HTML file is uploaded with a .html
+  extension, but the content type is listed as being `image/jpeg`, this
+  will bypass a validation checking for images. But it will also pass the
+  spoof check, because a file named .html and containing actual HTML
+  passes the spoof check.
+cvss_v2: 4.3
+patched_versions:
+  - ">= 4.2.2"

data/data/ruby-advisory-db/gems/paperclip/CVE-2017-0889.yml

@@ -0,0 +1,23 @@
+---
+gem: paperclip
+cve: 2017-0889
+url: https://github.com/thoughtbot/paperclip/pull/2435
+date: 2018-01-23
+title: |
+  Paperclip ruby gem suffers from a Server-Side Request Forgery (SSRF) vulnerability
+  in the Paperclip::UriAdapter and Paperclip::HttpUrlProxyAdapter class.
+description: |
+  Paperclip gem provides multiple ways a file can be uploaded to a web server.
+  The vulnerability affects two of Paperclip’s IO adapters that accept URLs as
+  attachment data (UriAdapter and HttpUrlProxyAdapter). When these adapters are
+  used, Paperclip acts as a proxy and downloads the file from the website URI
+  that is passed in. The library does not perform any validation to protect
+  against Server Side Request Forgery (SSRF) exploits by default. This may allow
+  a remote attacker to access information about internal network resources.
+cvss_v2: 7.5
+patched_versions:
+  - ">= 5.2.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-0889
+    - https://github.com/thoughtbot/paperclip/commit/4ebedfbd11d20d03ed03a1274ed281eee62715d4

data/data/ruby-advisory-db/gems/paperclip/OSVDB-103151.yml

@@ -0,0 +1,13 @@
+---
+gem: paperclip
+osvdb: 103151
+url: http://osvdb.org/show/osvdb/103151
+title: Paperclip Gem for Ruby contains a flaw
+date: 2014-01-31
+description: Paperclip Gem for Ruby contains a flaw that is due to the application failing to properly
+  validate the file extension, instead only validating the Content-Type header during file uploads.
+  This may allow a remote attacker to bypass restrictions on file types for uploaded files by
+  spoofing the content-type.
+cvss_v2:
+patched_versions:
+  - ">= 4.0.0"

data/data/ruby-advisory-db/gems/paranoid2/CVE-2019-13589.yml

@@ -0,0 +1,16 @@
+---
+gem: paranoid2
+cve: 2019-13589
+ghsa: 4g4c-8gqh-m4vm
+url: https://github.com/rubygems/rubygems.org/issues/2051
+date: 2019-07-16
+title: Code backdoor in paranoid2
+description: |
+  The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included
+  a code-execution backdoor inserted by a third party.
+
+  The current version, without this backdoor, is 1.1.5.
+cvss_v3: 9.8
+unaffected_versions:
+  - "> 1.1.6"
+  - "< 1.1.6"

data/data/ruby-advisory-db/gems/paratrooper-newrelic/CVE-2014-1234.yml

@@ -0,0 +1,13 @@
+---
+gem: paratrooper-newrelic
+cve: 2014-1234
+osvdb: 101839
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-1234
+title: Paratrooper-newrelic Gem for Ruby Process Listing API Key Local Disclosure
+date: 2014-01-08
+description: |
+  Paratrooper-newrelic Gem for Ruby contains a flaw in
+  /lib/paratrooper-newrelic.rb. The issue is triggered when the script exposes
+  the API key, allowing a local attacker to gain access to it by monitoring the
+  process tree.
+cvss_v2: 2.1

data/data/ruby-advisory-db/gems/paratrooper-pingdom/CVE-2014-1233.yml

@@ -0,0 +1,13 @@
+---
+gem: paratrooper-pingdom
+cve: 2014-1233
+osvdb: 101847
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-1233
+title: paratrooper-pingdom Gem for Ruby /lib/paratrooper-pingdom.rb API Login Credentials Local Disclosure
+date: 2013-12-26
+description: |
+  paratrooper-pingdom Gem for Ruby contains a flaw in
+  /lib/paratrooper-pingdom.rb. The issue is triggered when the script exposes
+  API login credentials, allowing a local attacker to gain access to the API
+  key, username, and password for the API login by monitoring the process tree.
+cvss_v2: 2.1

data/data/ruby-advisory-db/gems/passenger/CVE-2013-2119.yml

@@ -0,0 +1,15 @@
+---
+gem: passenger
+cve: 2013-2119
+osvdb: 93752
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-2119
+title: Phusion Passenger Gem for Ruby Predictable Temporary Filename Generation Symlink Local Privilege Escalation
+date: 2013-05-29
+description: Phusion Passenger Gem for Ruby contains a flaw as the program creates
+  temporary files insecurely. It is possible for a local attacker to use a symlink
+  attack against the Nginx config file to cause the program to unexpectedly overwrite
+  the file, allowing a local attacker to execute code with elevated privileges.
+cvss_v2: 4.6
+patched_versions:
+  - "~> 3.0.21"
+  - ">= 4.0.5"

data/data/ruby-advisory-db/gems/passenger/CVE-2013-4136.yml

@@ -0,0 +1,14 @@
+---
+gem: passenger
+cve: 2013-4136
+osvdb: 94074
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-4136
+title: Phusion Passenger Gem for Ruby Utils.cpp Temporary Directory Creation Symlink Local Privilege Escalation
+date: 2013-06-10
+description: Phusion Passenger Gem for Ruby contains a flaw as the program creates
+  temporary directories insecurely. It is possible for a local attacker to use a
+  symlink attack against the Utils.cpp file to allow the attacker to gain elevated
+  privileges.
+cvss_v2: 4.6
+patched_versions:
+  - ">= 4.0.8"

data/data/ruby-advisory-db/gems/passenger/CVE-2014-1831.yml

@@ -0,0 +1,13 @@
+---
+gem: passenger
+cve: 2014-1831
+osvdb: 102613
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-1831
+title: Phusion Passenger Server Instance Directory Creation Local Symlink File Overwrite
+date: 2014-01-28
+description: Phusion Passenger contains a flaw as the program creates the server instance
+  directory insecurely. It is possible for a local attacker to use a symlink attack against
+  the directory to cause the program to unexpectedly overwrite an arbitrary file.
+cvss_v2: 2.1
+patched_versions:
+  - ">= 4.0.37"

data/data/ruby-advisory-db/gems/passenger/CVE-2014-1832.yml

@@ -0,0 +1,13 @@
+---
+gem: passenger
+cve: 2014-1832
+osvdb: 102613
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-1832
+title: Phusion Passenger Server Instance Directory Creation Local Symlink File Overwrite
+date: 2014-01-29
+description: Phusion Passenger contains a flaw as the program creates the server instance
+  directory insecurely. It is possible for a local attacker to use a symlink attack against
+  the directory to cause the program to unexpectedly overwrite an arbitrary file.
+cvss_v2: 2.1
+patched_versions:
+  - ">= 4.0.38"