bundler-audit 0.7.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/rails-html-sanitizer/CVE-2015-7580.yml

@@ -0,0 +1,70 @@
+---
+gem: rails-html-sanitizer
+cve: 2015-7580
+date: 2016-01-25
+url: "https://groups.google.com/forum/#!topic/rubyonrails-security/uh--W4TDwmI"
+
+title: Possible XSS vulnerability in rails-html-sanitizer
+
+description: |
+  There is a possible XSS vulnerability in the white list sanitizer in the 
+  rails-html-sanitizer gem. This vulnerability has been assigned the CVE 
+  identifier CVE-2015-7580. 
+
+  Versions Affected:  All. 
+  Not affected:       None. 
+  Fixed Versions:     v1.0.3 
+
+  Impact 
+  ------ 
+  Carefully crafted strings can cause user input to bypass the sanitization in 
+  the white list sanitizer which will can lead to an XSS attack. 
+
+  Vulnerable code will look something like this: 
+
+    <%= sanitize user_input, tags: %w(em) %> 
+
+  All users running an affected release should either upgrade or use one of the 
+  workarounds immediately. 
+
+  Releases 
+  -------- 
+  The FIXED releases are available at the normal locations. 
+
+  Workarounds 
+  ----------- 
+  Putting the following monkey patch in an initializer can help to mitigate the 
+  issue: 
+
+  ``` 
+  class Rails::Html::PermitScrubber 
+    alias :old_scrub :scrub 
+    alias :old_skip_node? :skip_node? 
+
+    def scrub(node) 
+      if node.cdata? 
+        text = node.document.create_text_node node.text 
+        node.replace text 
+        return CONTINUE 
+      end 
+      old_scrub node 
+    end 
+
+    def skip_node?(node); node.text?; end 
+  end 
+  ``` 
+
+  Patches 
+  ------- 
+  To aid users who aren't able to upgrade immediately we have provided patches for 
+  the two supported release series. They are in git-am format and consist of a 
+  single changeset. 
+
+  * 1-0-whitelist_sanitizer_xss.patch - Patch for 1.0 series 
+
+  Credits 
+  ------- 
+  Thanks to Arnaud Germis, Nate Clark, and John Colvin for reporting this issue.
+
+patched_versions:
+  - ">= 1.0.3"

data/data/ruby-advisory-db/gems/rails-html-sanitizer/CVE-2018-3741.yml

@@ -0,0 +1,20 @@
+---
+gem: rails-html-sanitizer
+cve: 2018-3741
+date: 2018-03-22
+url: https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ
+title: XSS vulnerability in rails-html-sanitizer
+description: |
+  There is a possible XSS vulnerability in rails-html-sanitizer.  The gem allows
+  non-whitelisted attributes to be present in sanitized output when input with
+  specially-crafted HTML fragments, and these attributes can lead to an XSS attack
+  on target applications.
+
+  This issue is similar to CVE-2018-8048 in Loofah.
+patched_versions:
+  - ">= 1.0.4"
+related:
+  cve:
+    - 2018-8048
+  url:
+    - https://github.com/rails/rails-html-sanitizer/commit/f3ba1a839a35f2ba7f941c15e239a1cb379d56ae

data/data/ruby-advisory-db/gems/rails_admin/CVE-2016-10522.yml

@@ -0,0 +1,21 @@
+---
+gem: rails_admin
+cve: 2016-10522
+date: 2016-12-21
+url: https://www.sourceclear.com/blog/Rails_admin-Vulnerability-Disclosure/
+title: CSRF vulnerability in rails_admin
+description: |
+  The rails_admin gem is vulnerable to cross-site request forgery (CSRF) attacks.
+  Due to a bug, non-GET methods were not validating CSRF tokens and, as a result,
+  an attacker could hypothetically gain access to the application administrative
+  endpoints exposed by the gem.
+
+cvss_v2: 5.5
+unaffected_versions:
+- "< 1.0.0"
+patched_versions:
+- ">= 1.1.1"
+related:
+  url:
+    - https://www.sourceclear.com/registry/security/cross-site-request-forgery-csrf-/ruby/sid-3173
+    - https://github.com/sferik/rails_admin/commit/b13e879eb93b661204e9fb5e55f7afa4f397537a

data/data/ruby-advisory-db/gems/rails_admin/CVE-2017-12098.yml

@@ -0,0 +1,22 @@
+---
+gem: rails_admin
+cve: 2017-12098
+url: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0450
+date: 2018-01-10
+title: rails_admin ruby gem XSS vulnerability
+description: |
+  An exploitable cross site scripting (XSS) vulnerability exists in the
+  add filter functionality of the rails_admin rails gem version 1.2.0. A specially
+  crafted URL can cause an XSS flaw resulting in an attacker being able to execute
+  arbitrary javascript on the victim's browser. An attacker can phish an authenticated
+  user to trigger this vulnerability.
+
+cvss_v3: 6.1
+cvss_v2: 4.3
+
+patched_versions:
+  - ">= 1.3.0"
+
+related:
+  url:
+    - https://github.com/sferik/rails_admin/issues/2985

data/data/ruby-advisory-db/gems/railties/CVE-2019-5420.yml

@@ -0,0 +1,49 @@
+---
+gem: railties
+framework: rails
+cve: 2019-5420
+date: 2019-03-13
+url: https://groups.google.com/forum/#!topic/rubyonrails-security/IsQKvDqZdKw
+
+title: Possible Remote Code Execution Exploit in Rails Development Mode
+
+description: |
+  There is a possible a possible remote code executing exploit in Rails when in
+  development mode. This vulnerability has been assigned the CVE identifier
+  CVE-2019-5420.
+
+  Versions Affected:  6.0.0.X, 5.2.X.
+  Not affected:       < 5.2.0
+  Fixed Versions:     6.0.0.beta3, 5.2.2.1
+
+  Impact
+  ------
+  With some knowledge of a target application it is possible for an attacker to
+  guess the automatically generated development mode secret token.  This secret
+  token can be used in combination with other Rails internals to escalate to a
+  remote code execution exploit.
+
+  All users running an affected release should either upgrade or use one of the
+  workarounds immediately.
+
+  Releases
+  --------
+  The 6.0.0.beta3 and 5.2.2.1 releases are available at the normal locations.
+
+  Workarounds
+  -----------
+  This issue can be mitigated by specifying a secret key in development mode.
+  In "config/environments/development.rb" add this:
+
+    config.secret_key_base = SecureRandom.hex(64)
+
+  Credits
+  -------
+  Thanks to ooooooo_q
+
+unaffected_versions:
+  - "< 5.2.0"
+
+patched_versions:
+  - "~> 5.2.2, >= 5.2.2.1"
+  - ">= 6.0.0.beta3"

data/data/ruby-advisory-db/gems/rake/CVE-2020-8130.yml

@@ -0,0 +1,18 @@
+---
+gem: rake
+cve: 2020-8130
+ghsa: jppv-gw3r-w3q8
+date: 2019-08-29
+url: https://github.com/advisories/GHSA-jppv-gw3r-w3q8
+title: OS Command Injection in Rake
+
+description: |
+  There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in
+  Rake::FileList when supplying a filename that begins with the pipe character
+  `|`.
+
+cvss_v2: 9.3
+cvss_v3: 8.1
+
+patched_versions:
+  - ">= 12.3.3"

data/data/ruby-advisory-db/gems/rbovirt/CVE-2014-0036.yml

@@ -0,0 +1,20 @@
+---
+gem: rbovirt
+cve: 2014-0036
+osvdb: 104080
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-0036
+title: rbovirt Gem for Ruby contains a flaw
+date: 2014-03-05
+
+description: |
+  rbovirt Gem for Ruby contains a flaw related to certificate validation.
+  The issue is due to the program failing to validate SSL certificates. This may
+  allow an attacker with access to network traffic (e.g. MiTM, DNS cache
+  poisoning) to spoof the SSL server via an arbitrary certificate that appears
+  valid. Such an attack would allow for the interception of sensitive traffic,
+  and potentially allow for the injection of content into the SSL stream.
+
+cvss_v2: 6.8
+
+patched_versions:
+  - '>= 0.0.24'

data/data/ruby-advisory-db/gems/rdoc/CVE-2013-0256.yml

@@ -0,0 +1,27 @@
+---
+gem: rdoc
+cve: 2013-0256
+osvdb: 90004
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0256
+title: RDoc 2.3.0 through 3.12 XSS Exploit
+date: 2013-02-06
+
+description: |
+  Doc documentation generated by rdoc 2.3.0 through rdoc 3.12 and prereleases
+  up to rdoc 4.0.0.preview2.1 are vulnerable to an XSS exploit. This exploit
+  may lead to cookie disclosure to third parties.
+  
+  The exploit exists in darkfish.js which is copied from the RDoc install
+  location to the generated documentation.
+  
+  RDoc is a static documentation generation tool. Patching the library itself
+  is insufficient to correct this exploit.
+  
+  This exploit was discovered by Evgeny Ermakov <corwmh@gmail.com>.
+
+cvss_v2: 4.3
+
+patched_versions:
+  - ~> 3.9.5
+  - ~> 3.12.1
+  - ">= 4.0"

data/data/ruby-advisory-db/gems/recurly/CVE-2017-0905.yml

@@ -0,0 +1,35 @@
+---
+gem: recurly
+cve: 2017-0905
+url: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0905
+date: 2017-11-09
+title: SSRF vulnerability in Recurly gem's Resource#find.
+
+description: |
+  If you are using the #find method on any of the classes that are derived from
+  the Resource class and you are passing user input into that method, a
+  malicious user can force the http client to reach out to a server under their
+  control. This can lead to leakage of your private API key.
+
+  Because of the severity of impact, we are recommending that all users upgrade
+  to a patched version. We have provided a non-breaking patch for every 2.X
+  version of the client.
+
+patched_versions:
+  - ~> 2.0.13
+  - ~> 2.1.11
+  - ~> 2.2.5
+  - ~> 2.3.10
+  - ~> 2.4.11
+  - ~> 2.5.3
+  - ~> 2.6.3
+  - ~> 2.7.8
+  - ~> 2.8.2
+  - ~> 2.9.2
+  - ~> 2.10.4
+  - ~> 2.11.3
+  - ">= 2.12.0"
+
+related:
+  url:
+    - https://github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4be

data/data/ruby-advisory-db/gems/redcarpet/CVE-2015-5147.yml

@@ -0,0 +1,17 @@
+---
+gem: redcarpet
+cve: 2015-5147
+osvdb: 123859
+url: http://seclists.org/oss-sec/2015/q2/818
+title: redcarpet Gem for Ruby html.c header_anchor() Function Stack Overflow
+date: 2015-06-22
+description: |
+  redcarpet Gem for Ruby contains a flaw that allows a stack overflow.
+  This flaw exists because the header_anchor() function in html.c uses
+  variable length arrays (VLA) without any range checking. This may
+  allow a remote attacker to execute arbitrary code.
+cvss_v2: 7.5
+unaffected_versions:
+  - "< 3.3.0"
+patched_versions:
+  - ">= 3.3.2"

data/data/ruby-advisory-db/gems/redcarpet/OSVDB-120415.yml

@@ -0,0 +1,16 @@
+---
+gem: redcarpet
+osvdb: 120415
+url: http://danlec.com/blog/bug-in-sundown-and-redcarpet
+title: redcarpet Gem for Ruby markdown.c parse_inline() Function XSS
+date: 2015-04-07
+description: |
+  redcarpet Gem for Ruby contains a flaw that allows a cross-site scripting
+  (XSS) attack. This flaw exists because the parse_inline() function in
+  markdown.c does not validate input before returning it to users. This may
+  allow a remote attacker to create a specially crafted request that would
+  execute arbitrary script code in a user's browser session within the trust
+  relationship between their browser and the server.
+cvss_v2:
+patched_versions:
+  - ">= 3.2.3"

data/data/ruby-advisory-db/gems/redis-namespace/OSVDB-96425.yml

@@ -0,0 +1,15 @@
+--- 
+gem: redis-namespace
+osvdb: 96425
+url: http://blog.steveklabnik.com/posts/2013-08-03-redis-namespace-1-3-1--security-release
+title: redis-namespace Gem for Ruby contains a flaw in the method_missing implementation
+date: 2013-08-03
+description: |
+  redis-namespace Gem for Ruby contains a flaw in the method_missing implementation.
+  The issue is triggered when handling exec commands called via send(). This may allow a
+  remote attacker to execute arbitrary commands.
+patched_versions: 
+  - ">= 1.3.1"
+  - "~> 1.2.2"
+  - "~> 1.1.1"
+  - "~> 1.0.4"

data/data/ruby-advisory-db/gems/redis-store/CVE-2017-1000248.yml

@@ -0,0 +1,17 @@
+---
+gem: redis-store
+cve: 2017-1000248
+url: https://github.com/redis-store/redis-store/commit/ce13252c26fcc40ed4935c9abfeb0ee0761e5704
+date: 2017-11-16
+title: Unsafe objects can be loaded from Redis
+
+description: |
+  Redis-store <=v1.3.0 allows unsafe objects to be loaded from Redis via the
+  use of the Marshal serializer.
+
+patched_versions:
+  - ">= 1.4.0"
+
+related:
+  url:
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000248

data/data/ruby-advisory-db/gems/refile/OSVDB-120857.yml

@@ -0,0 +1,16 @@
+---
+gem: refile
+osvdb: 120857
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/VIfMO2LvzNs
+title: refile Gem for Ruby contains a remote code execution vulnerability
+date: 2015-04-15
+description: |
+  refile Gem for Ruby contains a flaw that is triggered when input is not
+  sanitized when handling the 'remote_image_url' field in a form, where
+  'image' is the name of the attachment. This may allow a remote attacker
+  to execute arbitrary shell commands.
+cvss_v2:
+unaffected_versions:
+  - "< 0.5.0"
+patched_versions:
+  - '>= 0.5.4'

data/data/ruby-advisory-db/gems/rest-client/CVE-2015-1820.yml

@@ -0,0 +1,23 @@
+---
+gem: rest-client
+cve: 2015-1820
+osvdb: 119878
+url: https://github.com/rest-client/rest-client/issues/369
+title: 'rubygem-rest-client: session fixation vulnerability via Set-Cookie headers in 30x redirection responses'
+date: 2015-03-24
+description: |
+  rest-client in abstract_response.rb improperly handles Set-Cookie headers on
+  HTTP 30x redirection responses. Any cookies will be forwarded to the
+  redirection target regardless of domain, path, or expiration.
+
+  If you control a redirection source, you can cause rest-client to perform a
+  request to any third-party domain with cookies of your choosing, which may be
+  useful in performing a session fixation attack.
+
+  If you control a redirection target, you can steal any cookies set by the
+  third-party redirection request.
+cvss_v2:
+unaffected_versions:
+  - "<= 1.6.0"
+patched_versions:
+  - ">= 1.8.0"

data/data/ruby-advisory-db/gems/rest-client/CVE-2015-3448.yml

@@ -0,0 +1,15 @@
+---
+gem: rest-client
+cve: 2015-3448
+url: https://github.com/rest-client/rest-client/issues/349
+date: 2015-04-29
+title: rest-client ruby gem logs sensitive information
+description: |
+  REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and
+  passwords, which allows local users to obtain sensitive information by reading the
+  log.
+
+cvss_v2: 2.1
+
+patched_versions:
+  - ">= 1.7.3"

data/data/ruby-advisory-db/gems/rest-client/CVE-2019-15224.yml

@@ -0,0 +1,13 @@
+---
+gem: rest-client
+cve: 2019-15224
+url: https://github.com/rest-client/rest-client/issues/713
+date: 2019-08-19
+title: Code execution backdoor in rest-client
+description: |
+  The rest-client gem 1.6.13 for Ruby, as distributed on RubyGems.org,
+  included a code-execution backdoor inserted by a third party.
+
+unaffected_versions:
+  - "<= 1.6.9"
+  - ">= 1.6.14"

data/data/ruby-advisory-db/gems/restforce/CVE-2018-3777.yml

@@ -0,0 +1,36 @@
+---
+gem: restforce
+cve: 2018-3777
+date: 2018-07-27
+url: https://github.com/restforce/restforce/pull/392
+title: Insufficient URI encoding in restforce
+description: |
+  A flaw in how restforce constructs URL's may allow an attacker to inject
+  additional parameters into Salesforce API requests.
+
+  Impact
+  ------
+  This flaw is only exploitable in applications that pass user input directly
+  to restforce's select, find, describe, update, upsert, and destroy methods.
+  Vulnerable code might look like:
+
+  ```ruby
+  client.select('SomeSalesForceObject', params[:some-id],
+     ...)
+  ```
+
+  In such an application, attackers could pass `0016000000MRatd/describe`
+  as a request parameter, causing the server to make a request to a different
+  endpoint than the server is designed to handle. Since the Salesforce REST
+  API supports overriding HTTP methods via a request parameter, an attacker
+  could also cause the client's `select()` method to modify data, by passing
+  `0016000000MRatd/?_HttpMethod=PATCH&other-query-params=...`.
+
+  Workarounds
+  ------
+  If possible, applications should track salesforce IDs internally, rather than
+  passing user-supplied IDs to salesforce. Such practice mitigates this
+  vulnerability, and in general is desirable for ensuring strong access control.
+
+patched_versions:
+- ">= 3.0.0"