bundler-audit 0.7.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/rack/CVE-2012-6109.yml

@@ -0,0 +1,21 @@
+---
+gem: rack
+cve: 2012-6109
+osvdb: 89317
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-6109
+title: |
+  Rack Regular Expressions Engine Content-Disposition Header Parsing Infinite Loop Remote DoS
+date: 2012-05-04
+
+description: |
+  Rack contains a flaw in the Regular Expressions Engine that may allow a remote
+  denial of service. The issue is triggered when parsing context-disposition
+  headers. With a specially crafted header, a remote attacker can cause an
+  infinite loop, which will result in a loss of availability for the webserver.
+
+cvss_v2: 4.3
+patched_versions:
+  - "~> 1.1.4"
+  - "~> 1.2.6"
+  - "~> 1.3.7"
+  - ">= 1.4.2"

data/data/ruby-advisory-db/gems/rack/CVE-2013-0183.yml

@@ -0,0 +1,19 @@
+---
+gem: rack
+cve: 2013-0183
+osvdb: 89320
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0183
+title: |
+  Rack Long String Parsing Memory Consumption Remote DoS
+date: 2013-01-07
+
+description: |
+  Rack contains a flaw that may allow a remote denial of service. The issue is
+  triggered when parsing an overly long string. With a specially crafted string,
+  a remote attacker can cause a consumption of memory. This will result in a
+  loss of availability for the webserver.
+
+cvss_v2: 5.0
+patched_versions:
+  - "~> 1.3.8"
+  - ">= 1.4.3"

data/data/ruby-advisory-db/gems/rack/CVE-2013-0184.yml

@@ -0,0 +1,20 @@
+---
+gem: rack
+cve: 2013-0184
+osvdb: 89327
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0184
+title: |
+  Rack Rack::Auth::AbstractRequest Class Unspecified Remote DoS
+date: 2013-01-13
+
+description: |
+  Rack contains a flaw in the Rack::Auth::AbstractRequest class that may allow
+  a remote denial of service. The issue is triggered when an unspecified error
+  occurs, which will result in a loss of availability for the webserver.
+
+cvss_v2: 4.3
+patched_versions:
+  - "~> 1.1.5"
+  - "~> 1.2.7"
+  - "~> 1.3.9"
+  - ">= 1.4.4"

data/data/ruby-advisory-db/gems/rack/CVE-2013-0262.yml

@@ -0,0 +1,18 @@
+---
+gem: rack
+cve: 2013-0262
+osvdb: 89938
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0262
+title: |
+  Rack Rack::File Function Symlink Traversal Arbitrary File Disclosure
+date: 2013-02-07
+
+description: |
+  Rack contains a flaw as the Rack::File function creates temporary files
+  insecurely. It is possible for a local attacker to use a symlink attack to
+  traverse to an arbitrary file and disclose its contents
+
+cvss_v2: 4.3
+patched_versions:
+- "~> 1.4.5"
+- ">= 1.5.2"

data/data/ruby-advisory-db/gems/rack/CVE-2013-0263.yml

@@ -0,0 +1,23 @@
+---
+gem: rack
+cve: 2013-0263
+osvdb: 89939
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0263
+title: |
+  Rack Rack::Session::Cookie Function Timing Attack Remote Code Execution
+date: 2013-02-07
+
+description: |
+  Rack contains a flaw that is due to an error in the Rack::Session::Cookie
+  function. Users of the Marshal session cookie encoding (the default), are
+  subject to a timing attack that may lead an attacker to execute arbitrary
+  code. This attack is more practical against 'cloud' users as intra-cloud
+  latencies are sufficiently low to make the attack viable.
+
+cvss_v2: 5.1
+patched_versions:
+  - ~> 1.1.6
+  - ~> 1.2.8
+  - ~> 1.3.10
+  - ~> 1.4.5
+  - ">= 1.5.2"

data/data/ruby-advisory-db/gems/rack/CVE-2015-3225.yml

@@ -0,0 +1,18 @@
+---
+gem: rack
+cve: 2015-3225
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/gcUbICUmKMc
+title: |
+  Potential Denial of Service Vulnerability in Rack
+date: 2015-06-16
+
+description: |
+  Carefully crafted requests can cause a `SystemStackError` and potentially 
+  cause a denial of service attack. 
+
+  All users running an affected release should upgrade. 
+
+patched_versions:
+  - ">= 1.6.2"
+  - "~> 1.5.4"
+  - "~> 1.4.6"

data/data/ruby-advisory-db/gems/rack/CVE-2018-16470.yml

@@ -0,0 +1,56 @@
+---
+gem: rack
+cve: 2018-16470
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/Dz4sRl-ktKk
+title: Possible DoS vulnerability in Rack
+date: 2018-11-05
+
+description: |
+  There is a possible DoS vulnerability in the multipart parser in Rack. This
+  vulnerability has been assigned the CVE identifier CVE-2018-16470.
+
+  Versions Affected:  2.0.4, 2.0.5
+  Not affected:       <= 2.0.3
+  Fixed Versions:     2.0.6
+
+  Impact
+  ------
+  There is a possible DoS vulnerability in the multipart parser in Rack.
+  Carefully crafted requests can cause the multipart parser to enter a
+  pathological state, causing the parser to use CPU resources disproportionate to
+  the request size.
+
+  Impacted code can look something like this:
+
+  ```
+  Rack::Request.new(env).params
+  ```
+
+  But any code that uses the multi-part parser may be vulnerable.
+
+  Rack users that have manually adjusted the buffer size in the multipart parser
+  may be vulnerable as well.
+
+  All users running an affected release should either upgrade or use one of the
+  workarounds immediately.
+
+  Releases
+  --------
+  The 2.0.6 release is available at the normal locations.
+
+  Workarounds
+  -----------
+  To work around this issue, the following code can be used:
+
+  ```
+  require "rack/multipart/parser"
+
+  Rack::Multipart::Parser.send :remove_const, :BUFSIZE
+  Rack::Multipart::Parser.const_set :BUFSIZE, 16384
+  ```
+
+unaffected_versions:
+  - "<= 2.0.3"
+
+patched_versions:
+  - ">= 2.0.6"

data/data/ruby-advisory-db/gems/rack/CVE-2018-16471.yml

@@ -0,0 +1,80 @@
+---
+gem: rack
+cve: 2018-16471
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/NAalCee8n6o
+title: Possible XSS vulnerability in Rack
+date: 2018-11-05
+
+description: |
+  There is a possible vulnerability in Rack. This vulnerability has been
+  assigned the CVE identifier CVE-2018-16471.
+
+  Versions Affected:  All.
+  Not affected:       None.
+  Fixed Versions:     2.0.6, 1.6.11
+
+  Impact
+  ------
+  There is a possible XSS vulnerability in Rack.  Carefully crafted requests can
+  impact the data returned by the `scheme` method on `Rack::Request`.
+  Applications that expect the scheme to be limited to "http" or "https" and do
+  not escape the return value could be vulnerable to an XSS attack.
+
+  Vulnerable code looks something like this:
+
+  ```
+  <%= request.scheme.html_safe %>
+  ```
+
+  Note that applications using the normal escaping mechanisms provided by Rails
+  may not impacted, but applications that bypass the escaping mechanisms, or do
+  not use them may be vulnerable.
+
+  All users running an affected release should either upgrade or use one of the
+  workarounds immediately.
+
+  Releases
+  --------
+  The 2.0.6 and 1.6.11 releases are available at the normal locations.
+
+  Workarounds
+  -----------
+  The following monkey patch can be applied to work around this issue:
+
+  ```
+  require "rack"
+  require "rack/request"
+
+  class Rack::Request
+  SCHEME_WHITELIST = %w(https http).freeze
+
+  def scheme
+    if get_header(Rack::HTTPS) == 'on'
+      'https'
+    elsif get_header(HTTP_X_FORWARDED_SSL) == 'on'
+      'https'
+    elsif forwarded_scheme
+      forwarded_scheme
+    else
+      get_header(Rack::RACK_URL_SCHEME)
+    end
+  end
+
+  def forwarded_scheme
+    scheme_headers = [
+      get_header(HTTP_X_FORWARDED_SCHEME),
+      get_header(HTTP_X_FORWARDED_PROTO).to_s.split(',')[0]
+    ]
+
+    scheme_headers.each do |header|
+      return header if SCHEME_WHITELIST.include?(header)
+    end
+
+    nil
+  end
+  end
+  ```
+
+patched_versions:
+  - "~> 1.6.11"
+  - ">= 2.0.6"

data/data/ruby-advisory-db/gems/rack/CVE-2019-16782.yml

@@ -0,0 +1,32 @@
+---
+gem: rack
+cve: 2019-16782
+ghsa: hrqr-hxpp-chr3
+url: https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3
+date: 2019-12-18
+title: Possible information leak / session hijack vulnerability
+description: |-
+  There's a possible information leak / session hijack vulnerability in Rack.
+
+  Attackers may be able to find and hijack sessions by using timing attacks
+  targeting the session id. Session ids are usually stored and indexed in a
+  database that uses some kind of scheme for speeding up lookups of that
+  session id. By carefully measuring the amount of time it takes to look up
+  a session, an attacker may be able to find a valid session id and hijack
+  the session.
+
+  The session id itself may be generated randomly, but the way the session is
+  indexed by the backing store does not use a secure comparison.
+
+  Impact:
+
+  The session id stored in a cookie is the same id that is used when querying
+  the backing session storage engine.  Most storage mechanisms (for example a
+  database) use some sort of indexing in order to speed up the lookup of that
+  id.  By carefully timing requests and session lookup failures, an attacker
+  may be able to perform a timing attack to determine an existing session id
+  and hijack that session.
+
+patched_versions:
+  - "~> 1.6.12"
+  - ">= 2.0.8"

data/data/ruby-advisory-db/gems/rack/CVE-2020-8161.yml

@@ -0,0 +1,32 @@
+---
+gem: rack
+cve: 2020-8161
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA
+date: 2020-05-12
+title: Directory traversal in Rack::Directory app bundled with Rack
+description: |
+  There was a possible directory traversal vulnerability in the Rack::Directory app
+  that is bundled with Rack.
+
+  Versions Affected:  rack < 2.2.0
+  Not affected:       Applications that do not use Rack::Directory.
+  Fixed Versions:     2.1.3, >= 2.2.0
+
+  Impact
+  ------
+
+  If certain directories exist in a director that is managed by
+  `Rack::Directory`, an attacker could, using this vulnerability, read the
+  contents of files on the server that were outside of the root specified in the
+  Rack::Directory initializer.
+
+  Workarounds
+  -----------
+
+  Until such time as the patch is applied or their Rack version is upgraded,
+  we recommend that developers do not use Rack::Directory in their
+  applications.
+
+patched_versions:
+  - "~> 2.1.3"
+  - ">= 2.2.0"

data/data/ruby-advisory-db/gems/radiant/CVE-2018-5216.yml

@@ -0,0 +1,12 @@
+---
+gem: radiant
+cve: 2018-5216
+url: https://github.com/imsebao/404team/blob/master/radiantcms.md
+date: 2018-01-04
+title: Radiant CMS 1.1.4 Markdown admin/pages/*/edit part_body_content cross site scripting
+description: |
+  Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content
+  parameter to an admin/pages/*/edit resource.
+
+cvss_v3: 5.4
+cvss_v2: 3.5

data/data/ruby-advisory-db/gems/radiant/CVE-2018-7261.yml

@@ -0,0 +1,13 @@
+---
+gem: radiant
+cve: 2018-7261
+url: https://github.com/radiant/radiant/issues/412
+date: 2018-02-19
+title: Multiple persistent XSS vulnerabilities in Radiant CMS
+description: |
+  There are multiple Persistent XSS vulnerabilities in Radiant CMS.
+  They affect Personal Preferences (Name and Username) and Configuration (Site Title,
+  Dev Site Domain, Page Parts, and Page Fields).
+
+cvss_v3: 5.4
+cvss_v2: 3.5

data/data/ruby-advisory-db/gems/rails-html-sanitizer/CVE-2015-7578.yml

@@ -0,0 +1,47 @@
+---
+gem: rails-html-sanitizer
+cve: 2015-7578
+date: 2016-01-25
+url: "https://groups.google.com/forum/#!topic/rubyonrails-security/uh--W4TDwmI"
+
+title: Possible XSS vulnerability in rails-html-sanitizer
+
+description: |
+  There is a possible XSS vulnerability in rails-html-sanitizer. This 
+  vulnerability has been assigned the CVE identifier CVE-2015-7578. 
+
+  Versions Affected:  All. 
+  Not affected:       None. 
+  Fixed Versions:     1.0.3 
+
+  Impact 
+  ------ 
+  There is a possible XSS vulnerability in rails-html-sanitizer.  Certain 
+  attributes are not removed from tags when they are sanitized, and these 
+  attributes can lead to an XSS attack on target applications. 
+
+  All users running an affected release should either upgrade or use one of the 
+  workarounds immediately. 
+
+  Releases 
+  -------- 
+  The FIXED releases are available at the normal locations. 
+
+  Workarounds 
+  ----------- 
+  There are no feasible workarounds for this issue. 
+
+  Patches 
+  ------- 
+  To aid users who aren't able to upgrade immediately we have provided patches for 
+  the two supported release series. They are in git-am format and consist of a 
+  single changeset. 
+
+  * 1-0-sanitize_data_attributes.patch - Patch for 1.0 series 
+
+  Credits 
+  ------- 
+  Thanks to Ben Murphy and Marien for reporting this.
+    
+patched_versions:
+  - ">= 1.0.3"

data/data/ruby-advisory-db/gems/rails-html-sanitizer/CVE-2015-7579.yml

@@ -0,0 +1,75 @@
+---
+gem: rails-html-sanitizer
+cve: 2015-7579
+date: 2016-01-25
+url: "https://groups.google.com/forum/#!topic/rubyonrails-security/OU9ugTZcbjc"
+
+title: XSS vulnerability in rails-html-sanitizer
+
+description: |
+  There is a XSS vulnerability in `Rails::Html::FullSanitizer` used by Action View's `strip_tags`. 
+  This vulnerability has been assigned the CVE identifier CVE-2015-7579. 
+
+  Versions Affected:  1.0.2 
+  Not affected:       1.0.0, 1.0.1 
+  Fixed Versions:     1.0.3 
+
+  Impact 
+  ------ 
+  Due to the way that `Rails::Html::FullSanitizer` is implemented, if an attacker 
+  passes an already escaped HTML entity to the input of Action View's `strip_tags` 
+  these entities will be unescaped what may cause a XSS attack if used in combination 
+  with `raw` or `html_safe`. 
+
+  For example: 
+
+      strip_tags("<script>alert('XSS')</script>") 
+
+  Would generate: 
+
+      <script>alert('XSS')</script> 
+
+  After the fix it will generate: 
+
+      &lt;script&gt;alert('XSS')&lt;/script&gt; 
+
+  All users running an affected release should either upgrade or use one of the 
+  workarounds immediately. 
+
+  Releases 
+  -------- 
+  The FIXED releases are available at the normal locations. 
+
+  Workarounds 
+  ----------- 
+  If you can't upgrade, please use the following monkey patch in an initializer 
+  that is loaded before your application: 
+
+  ``` 
+  $ cat config/initializers/strip_tags_fix.rb 
+  class ActionView::Base 
+    def strip_tags(html) 
+      self.class.full_sanitizer.sanitize(html) 
+    end 
+  end 
+  ``` 
+
+  Patches 
+  ------- 
+  To aid users who aren't able to upgrade immediately we have provided patches 
+  for the two supported release series. They are in git-am format and consist 
+  of a single changeset. 
+
+  * Do-not-unescape-already-escaped-HTML-entities.patch 
+
+  Credits 
+  ------- 
+  Thank you to Arthur Neves from GitHub and Spyros Livathinos from Zendesk for 
+  reporting the problem and working with us to fix it. 
+
+unaffected_versions:
+  - "~> 1.0.0"
+  - "~> 1.0.1"
+
+patched_versions:
+  - ">= 1.0.3"