bundler-audit 0.7.0 → 0.7.0.1

data/data/ruby-advisory-db/rubies/ruby/CVE-2019-15845.yml

@@ -0,0 +1,18 @@
+---
+engine: ruby
+cve: 2019-15845
+url: https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/
+title: A NUL injection vulnerability of File.fnmatch and File.fnmatch?
+date: 2019-10-01
+description: |
+  Built-in methods File.fnmatch and its alias File.fnmatch? accept the path
+  pattern as their first parameter. When the pattern contains NUL character
+  (\0), the methods recognize that the path pattern ends immediately before the
+  NUL byte. Therefore, a script that uses an external input as the pattern
+  argument, an attacker can make it wrongly match a pathname that is the second
+  parameter.
+patched_versions:
+  - "~> 2.4.8"
+  - "~> 2.5.7"
+  - "~> 2.6.5"
+  - "> 2.7.0-preview1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16201.yml

@@ -0,0 +1,15 @@
+---
+engine: ruby
+cve: 2019-16201
+url: https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/
+title: Regular Expression Denial of Service vulnerability of WEBrick's Digest access authentication
+date: 2019-10-01
+description: |
+  Regular expression denial of service vulnerability of WEBrick’s Digest
+  authentication module was found. An attacker can exploit this vulnerability
+  to cause an effective denial of service against a WEBrick service.
+patched_versions:
+  - "~> 2.4.8"
+  - "~> 2.5.7"
+  - "~> 2.6.5"
+  - "> 2.7.0-preview1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16254.yml

@@ -0,0 +1,19 @@
+---
+engine: ruby
+cve: 2019-16254
+url: https://www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/
+title: HTTP response splitting in WEBrick (Additional fix)
+date: 2019-10-01
+description: |
+  If a program using WEBrick inserts untrusted input into the response header,
+  an attacker can exploit it to insert a newline character to split a header,
+  and inject malicious content to deceive clients.
+
+  This is the same issue as CVE-2017-17742. The previous fix was incomplete,
+  which addressed the CRLF vector, but did not address an isolated CR or an
+  isolated LF.
+patched_versions:
+  - "~> 2.4.8"
+  - "~> 2.5.7"
+  - "~> 2.6.5"
+  - "> 2.7.0-preview1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16255.yml

@@ -0,0 +1,20 @@
+---
+engine: ruby
+cve: 2019-16255
+url: https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255/
+title: A code injection vulnerability of Shell#[] and Shell#test
+date: 2019-10-01
+description: |
+  Shell#[] and its alias Shell#test defined in lib/shell.rb allow code
+  injection if the first argument (aka the “command” argument) is untrusted
+  data. An attacker can exploit this to call an arbitrary Ruby method.
+
+  Note that passing untrusted data to methods of Shell is dangerous in general.
+  Users must never do it. However, we treat this particular case as a
+  vulnerability because the purpose of Shell#[] and Shell#[] is considered file
+  testing.
+patched_versions:
+  - "~> 2.4.8"
+  - "~> 2.5.7"
+  - "~> 2.6.5"
+  - "> 2.7.0-preview1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2020-10663.yml

@@ -0,0 +1,29 @@
+---
+engine: ruby
+cve: 2020-10663
+url: https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
+title: Unsafe Object Creation Vulnerability in JSON (Additional fix)
+date: 2020-03-19
+description: |
+  When parsing certain JSON documents, the json gem (including the one bundled
+  with Ruby) can be coerced into creating arbitrary objects in the target
+  system.
+
+  This is the same issue as CVE-2013-0269. The previous fix was incomplete, which
+  addressed `JSON.parse(user_input)`, but didn’t address some other styles of JSON
+  parsing including `JSON(user_input)` and `JSON.parse(user_input, nil)`.
+
+  See CVE-2013-0269 in detail. Note that the issue was exploitable to cause a
+  Denial of Service by creating many garbage-uncollectable Symbol objects, but
+  this kind of attack is no longer valid because Symbol objects are now
+  garbage-collectable. However, creating arbitrary objects may cause severe
+  security consequences depending upon the application code.
+
+  Please update the json gem to version 2.3.0 or later. You can use `gem update
+  json` to update it. If you are using bundler, please add `gem "json", ">= 2.3.0"`
+  to your Gemfile
+patched_versions:
+  - "~> 2.4.10"
+  - "~> 2.5.8"
+  - "~> 2.6.6"
+  - ">= 2.7.1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2020-10933.yml

@@ -0,0 +1,25 @@
+---
+engine: ruby
+cve: 2020-10933
+url: https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933/
+title: Heap exposure vulnerability in the socket library
+date: 2020-03-31
+description: |
+  A heap exposure vulnerability was discovered in the socket library. This
+  vulnerability has been assigned the CVE identifier CVE-2020-10933. We
+  strongly recommend upgrading Ruby.
+
+  When `BasicSocket#recv_nonblock` and `BasicSocket#read_nonblock` are invoked with
+  size and buffer arguments, they initially resize the buffer to the specified
+  size. In cases where the operation would block, they return without copying
+  any data. Thus, the buffer string will now include arbitrary data from the
+  heap. This may expose possibly sensitive data from the interpreter.
+
+  This issue is exploitable only on Linux. This issue had been since Ruby
+  2.5.0; 2.4 series is not vulnerable.
+patched_versions:
+  - "~> 2.5.8"
+  - "~> 2.6.6"
+  - ">= 2.7.1"
+unaffected_versions:
+  - "~> 2.4.0"

data/data/ruby-advisory-db/scripts/post-advisories.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+set -o errexit -o nounset
+
+REPO="https://${GH_TOKEN}@github.com/rubysec/rubysec.github.io.git"
+DIR="_site"
+
+git clone $REPO $DIR
+
+cd $DIR
+
+git config user.name "RubySec CI"
+git config user.email "ci@rubysec.com"
+
+bundle install --jobs=3 --retry=3
+bundle exec rake advisories
+
+git push -q

data/data/ruby-advisory-db/spec/advisories_spec.rb

@@ -0,0 +1,23 @@
+load File.join(File.dirname(__FILE__), 'spec_helper.rb')
+require 'gem_example'
+require 'library_example'
+require 'ruby_example'
+
+describe "gems" do
+  Dir.glob(File.join(File.dirname(__FILE__), '../gems/*/*')) do |path|
+    include_examples 'Gem Advisory', path
+  end
+end
+
+describe "libraries" do
+  Dir.glob(File.join(File.dirname(__FILE__), '../libraries/*/*')) do |path|
+    include_examples 'Libraries Advisory', path
+  end
+end
+
+describe "rubies" do
+  Dir.glob(File.join(File.dirname(__FILE__), '../rubies/*/*')) do |path|
+    include_examples 'Rubies Advisory', path
+  end
+end
+

data/data/ruby-advisory-db/spec/advisory_example.rb

@@ -0,0 +1,228 @@
+load File.join(File.dirname(__FILE__), 'spec_helper.rb')
+require 'yaml'
+
+shared_examples_for 'Advisory' do |path|
+  advisory = YAML.load_file(path)
+
+  describe path do
+    let(:filename) { File.basename(path) }
+
+    let(:filename_cve) do
+      if filename.start_with?('CVE-')
+        filename.gsub('CVE-','')
+      end
+    end
+
+    let(:filename_osvdb) do
+      if filename.start_with?('OSVDB-')
+        filename.gsub('OSVDB-','')
+      end
+    end
+    
+    let(:filename_ghsa) do
+      if filename.start_with?('GHSA-')
+        filename.gsub('GHSA-','')
+      end
+    end
+
+    it "should be correctly named CVE-XXX or OSVDB-XXX or GHSA-XXX" do
+      expect(filename).
+        to match(/^(CVE-\d{4}-(0\d{3}|[1-9]\d{3,})|OSVDB-\d+|GHSA(-[a-z0-9]{4}){3})\.yml$/)
+    end
+
+    it "should have CVE or OSVDB or GHSA" do
+      expect(advisory['cve'] || advisory['osvdb'] || advisory['ghsa']).not_to be_nil
+    end
+
+    describe "framework" do
+      subject { advisory['framework'] }
+
+      it "may be nil or a String" do
+        expect(subject).to be_kind_of(String).or(be_nil)
+      end
+    end
+
+    describe "platform" do
+      subject { advisory['platform'] }
+
+      it "may be nil or a String" do
+        expect(subject).to be_kind_of(String).or(be_nil)
+      end
+    end
+
+    describe "cve" do
+      subject { advisory['cve'] }
+
+      it "may be nil or a String" do
+        expect(subject).to be_kind_of(String).or(be_nil)
+      end
+      it "should be id in filename if filename is CVE-XXX" do
+        if filename_cve
+          is_expected.to eq(filename_cve.chomp('.yml'))
+        end
+      end
+    end
+
+    describe "osvdb" do
+      subject { advisory['osvdb'] }
+
+      it "may be nil or a Integer" do
+        expect(subject).to be_kind_of(Integer).or(be_nil)
+      end
+
+       it "should be id in filename if filename is OSVDB-XXX" do
+        if filename_osvdb
+          is_expected.to eq(filename_osvdb.to_i)
+        end
+      end
+    end
+    
+    describe "ghsa" do
+      subject { advisory['ghsa'] }
+
+      it "may be nil or a String" do
+        expect(subject).to be_kind_of(String).or(be_nil)
+      end
+      it "should be id in filename if filename is GHSA-XXX" do
+        if filename_ghsa
+          is_expected.to eq(filename_ghsa.chomp('.yml'))
+        end
+      end
+    end
+
+    describe "url" do
+      subject { advisory['url'] }
+
+      it { is_expected.to be_kind_of(String) }
+      it { is_expected.not_to be_empty }
+    end
+
+    describe "title" do
+      subject { advisory['title'] }
+
+      it { is_expected.to be_kind_of(String) }
+      it { is_expected.not_to be_empty }
+    end
+
+    describe "date" do
+      subject { advisory['date'] }
+
+      it { is_expected.to be_kind_of(Date) }
+    end
+
+    describe "description" do
+      subject { advisory['description'] }
+
+      it { is_expected.to be_kind_of(String) }
+      it { is_expected.not_to be_empty }
+    end
+
+    describe "cvss_v2" do
+      subject { advisory['cvss_v2'] }
+
+      it "may be nil or a Float" do
+        expect(subject).to be_kind_of(Float).or(be_nil)
+      end
+
+      case advisory['cvss_v2']
+      when Float
+        context "when a Float" do
+          it { expect((0.0)..(10.0)).to include(subject) }
+        end
+      end
+    end
+
+    describe "cvss_v3" do
+      subject { advisory['cvss_v3'] }
+
+      it "may be nil or a Float" do
+        expect(subject).to be_kind_of(Float).or(be_nil)
+      end
+
+      case advisory['cvss_v3']
+      when Float
+        context "when a Float" do
+          it { expect((0.0)..(10.0)).to include(subject) }
+        end
+      end
+
+      if advisory['cvss_v2']
+        it "should also provide a cvss_v2 score" do
+          expect(advisory['cvss_v2']).to_not be_nil
+        end
+      end
+    end
+
+    describe "patched_versions" do
+      subject { advisory['patched_versions'] }
+
+      it "may be nil or an Array" do
+        expect(subject).to be_kind_of(Array).or(be_nil)
+      end
+
+      describe "each patched version" do
+        if advisory['patched_versions']
+          advisory['patched_versions'].each do |version|
+            describe version do
+              subject { version.split(', ') }
+
+              it "should contain valid RubyGem version requirements" do
+                expect {
+                Gem::Requirement.new(*subject)
+                }.not_to raise_error
+              end
+            end
+          end
+        end
+      end
+    end
+
+    describe "unaffected_versions" do
+      subject { advisory['unaffected_versions'] }
+
+      it "may be nil or an Array" do
+        expect(subject).to be_kind_of(Array).or(be_nil)
+      end
+
+      case advisory['unaffected_versions']
+      when Array
+        advisory['unaffected_versions'].each do |version|
+          describe version do
+            subject { version.split(', ') }
+
+            it "should contain valid RubyGem version requirements" do
+              expect {
+                Gem::Requirement.new(*subject)
+              }.not_to raise_error
+            end
+          end
+        end
+      end
+    end
+
+    describe "related" do
+      subject { advisory['related'] }
+
+      it "may be nil or a Hash" do
+        expect(subject).to be_kind_of(Hash).or(be_nil)
+      end
+
+      case advisory["related"]
+      when Hash
+        advisory["related"].each_pair do |name, values|
+          describe name do
+            it "should be either a cve, an osvdb, a ghsa, or a url" do
+              expect(["cve", "osvdb", "ghsa", "url"]).to include(name)
+            end
+
+            it "should always contain an array" do
+              expect(values).to be_kind_of(Array)
+            end
+          end
+        end
+      end
+    end
+
+
+  end
+end

data/data/ruby-advisory-db/spec/gem_example.rb

@@ -0,0 +1,44 @@
+load File.join(File.dirname(__FILE__), 'spec_helper.rb')
+require 'advisory_example'
+
+shared_examples_for "Gem Advisory" do |path|
+  include_examples 'Advisory', path
+
+  advisory = YAML.load_file(path)
+
+  describe path do
+    let(:gem) { File.basename(File.dirname(path)) }
+
+    describe "gem" do
+      subject { advisory['gem'] }
+
+      it { is_expected.to be_kind_of(String) }
+      it "should be equal to filename (case-insensitive)" do
+        expect(subject.downcase).to eq(gem.downcase)
+      end
+    end
+
+    describe "versions" do
+      it "assumes that future versions will be patched" do
+        unaffected_versions = advisory['unaffected_versions'] || []
+        patched_versions    = advisory['patched_versions'] || []
+
+        versions = (unaffected_versions + patched_versions).sort_by do |v|
+          Gem::Version.new(v.match(/[0-9.]+\.\d+/)[0])
+        end
+
+        # If a gem is unpatched this test makes no sense
+        unless patched_versions.none?
+          expect(versions.last.match(/^>=|^>/)).to be_truthy
+        end
+      end
+    end
+
+    it "should have valid schema" do
+      schema = YAML.load_file(File.join(File.dirname(__FILE__), 'schemas/gem.yml'))
+      validator = Kwalify::Validator.new(schema)
+      errors = validator.validate(advisory)
+      expect(errors).to be_empty
+    end
+  end
+end