bundler-audit 0.7.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/actionview/CVE-2019-5419.yml

@@ -0,0 +1,95 @@
+---
+gem: actionview
+framework: rails
+cve: 2019-5419
+date: 2019-03-13
+url: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI
+
+title: Denial of Service Vulnerability in Action View
+
+description: |
+  There is a potential denial of service vulnerability in actionview.
+  This vulnerability has been assigned the CVE identifier CVE-2019-5419.
+
+  Impact
+  ------
+  Specially crafted accept headers can cause the Action View template location
+  code to consume 100% CPU, causing the server unable to process requests.  This
+  impacts all Rails applications that render views.
+
+  All users running an affected release should either upgrade or use one of the
+  workarounds immediately.
+
+  Workarounds
+  -----------
+  This vulnerability can be mitigated by wrapping `render` calls with
+  `respond_to` blocks.  For example, the following example is vulnerable:
+
+  ```
+  class UserController < ApplicationController
+    def index
+      render "index"
+    end
+  end
+  ```
+
+  But the following code is not vulnerable:
+
+  ```
+  class UserController < ApplicationController
+    def index
+      respond_to |format|
+        format.html { render "index" }
+      end
+    end
+  end
+  ```
+
+  Implicit rendering is impacted, so this code is vulnerable:
+
+  ```
+  class UserController < ApplicationController
+    def index
+    end
+  end
+  ```
+
+  But can be changed this this:
+
+  ```
+  class UserController < ApplicationController
+    def index
+      respond_to |format|
+        format.html { render "index" }
+      end
+    end
+  end
+  ```
+
+  Alternatively to specifying the format, the following monkey patch can be
+  applied in an initializer:
+
+  ```
+  $ cat config/initializers/formats_filter.rb
+  # frozen_string_literal: true
+
+  ActionDispatch::Request.prepend(Module.new do
+    def formats
+      super().select do |format|
+        format.symbol || format.ref == "*/*"
+      end
+    end
+  end)
+  ```
+  
+  Credits 
+  ------- 
+  Thanks to John Hawthorn <john@hawthorn.email> of GitHub 
+
+
+patched_versions:
+  - ">= 6.0.0.beta3"
+  - "~> 5.2.2, >= 5.2.2.1"
+  - "~> 5.1.6, >= 5.1.6.2"
+  - "~> 5.0.7, >= 5.0.7.2"
+  - "~> 4.2.11, >= 4.2.11.1"

data/data/ruby-advisory-db/gems/actionview/CVE-2020-5267.yml

@@ -0,0 +1,69 @@
+---
+gem: actionview
+framework: rails
+cve: 2020-5267
+date: 2020-03-19
+url: https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8
+title: Possible XSS vulnerability in ActionView
+description: |
+  There is a possible XSS vulnerability in ActionView's JavaScript literal
+  escape helpers.  Views that use the `j` or `escape_javascript` methods
+  may be susceptible to XSS attacks.
+
+  Versions Affected:  All.
+  Not affected:       None.
+  Fixed Versions:     6.0.2.2, 5.2.4.2
+
+  Impact
+  ------
+  There is a possible XSS vulnerability in the `j` and `escape_javascript`
+  methods in ActionView.  These methods are used for escaping JavaScript string
+  literals.  Impacted code will look something like this:
+
+  ```erb
+  <script>let a = `<%= j unknown_input %>`</script>
+  ```
+
+  or
+
+  ```erb
+  <script>let a = `<%= escape_javascript unknown_input %>`</script>
+  ```
+
+  Releases
+  --------
+  The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.
+
+  Workarounds
+  -----------
+  For those that can't upgrade, the following monkey patch may be used:
+
+  ```ruby
+  ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
+    {
+      "`" => "\\`",
+      "$" => "\\$"
+    }
+  )
+
+  module ActionView::Helpers::JavaScriptHelper
+    alias :old_ej :escape_javascript
+    alias :old_j :j
+
+    def escape_javascript(javascript)
+      javascript = javascript.to_s
+      if javascript.empty?
+        result = ""
+      else
+        result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)
+      end
+      javascript.html_safe? ? result.html_safe : result
+    end
+
+    alias :j :escape_javascript
+  end
+  ```
+
+patched_versions:
+  - "~> 5.2.4, >= 5.2.4.2"
+  - ">= 6.0.2.2"

data/data/ruby-advisory-db/gems/actionview/CVE-2020-8163.yml

@@ -0,0 +1,29 @@
+---
+gem: actionview
+framework: rails
+cve: 2020-8163
+date: 2020-05-15
+url: https://groups.google.com/forum/#!topic/rubyonrails-security/hWuKcHyoKh0
+title: Potential remote code execution of user-provided local names in ActionView
+description: |
+  There was a vulnerability in versions of Rails prior to 5.0.1 that would
+  allow an attacker who controlled the `locals` argument of a `render` call.
+
+  Versions Affected:  rails < 5.0.1
+  Not affected:       Applications that do not allow users to control the names of locals.
+  Fixed Versions:     4.2.11.2
+
+  Impact
+  ------
+
+  In the scenario where an attacker might be able to control the name of a
+  local passed into `render`, they can acheive remote code execution.
+
+  Workarounds
+  -----------
+
+  Until such time as the patch can be applied, application developers should
+  ensure that all user-provided local names are alphanumeric.
+
+patched_versions:
+  - ">= 4.2.11.2"

data/data/ruby-advisory-db/gems/actionview/CVE-2020-8167.yml

@@ -0,0 +1,45 @@
+---
+gem: actionview
+framework: rails
+cve: 2020-8167
+date: 2020-05-18
+url: https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0
+title: CSRF Vulnerability in rails-ujs
+description: |
+  There is an vulnerability in rails-ujs that allows attackers to send
+  CSRF tokens to wrong domains.
+
+  Versions Affected:  rails <= 6.0.3
+  Not affected:       Applications which don't use rails-ujs.
+  Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1
+
+  Impact
+  ------
+
+  This is a regression of CVE-2015-1840.
+
+  In the scenario where an attacker might be able to control the href attribute of an anchor tag or
+  the action attribute of a form tag that will trigger a POST action, the attacker can set the
+  href or action to a cross-origin URL, and the CSRF token will be sent.
+
+  Workarounds
+  -----------
+
+  To work around this problem, change code that allows users to control the href attribute of an anchor
+  tag or the action attribute of a form tag to filter the user parameters.
+
+  For example, code like this:
+
+      link_to params
+
+  to code like this:
+
+      link_to filtered_params
+
+      def filtered_params
+        # Filter just the parameters that you trust
+      end
+
+patched_versions:
+  - "~> 5.2.4.3"
+  - ">= 6.0.3.1"

data/data/ruby-advisory-db/gems/active-support/CVE-2018-3779.yml

@@ -0,0 +1,17 @@
+---
+gem: active-support
+cve: 2018-3779
+url: https://hackerone.com/reports/392311
+title: Malicious ruby gem - active-support
+date: 2018-08-09
+
+description: |
+  The gem duplicates official `activesupport` (no hyphen) code, but adds a
+  compiled extension. The extension attempts to resolve a base64 encoded
+  domain, downloads a payload, and executes.
+
+  Replace this gem with the official `activesupport` gem.
+
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/pull/1762

data/data/ruby-advisory-db/gems/activejob/CVE-2018-16476.yml

@@ -0,0 +1,36 @@
+---
+gem: activejob
+cve: 2018-16476
+url: https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw
+title: Broken Access Control vulnerability in Active Job
+date: 2018-11-27
+
+description: |
+  There is a vulnerability in Active Job. This vulnerability has been
+  assigned the CVE identifier CVE-2018-16476.
+
+  Versions Affected: >= 4.2.0
+  Not affected: < 4.2.0
+  Fixed Versions: 4.2.11, 5.0.7.1, 5.1.6.1, 5.2.1.1
+
+  Impact
+  ------
+  Carefully crafted user input can cause Active Job to deserialize it using GlobalId
+  and allow an attacker to have access to information that they should not have.
+
+  Vulnerable code will look something like this:
+
+      MyJob.perform_later(user_input)
+
+  All users running an affected release should either upgrade or use one of the
+  workarounds immediately.
+
+unaffected_versions:
+  - "< 4.2.0"
+
+patched_versions:
+  - "~> 4.2.11"
+  - "~> 5.0.7.1"
+  - "~> 5.1.6.1"
+  - "~> 5.1.7"
+  - ">= 5.2.1.1"

data/data/ruby-advisory-db/gems/activemodel/CVE-2016-0753.yml

@@ -0,0 +1,95 @@
+---
+gem: activemodel
+framework: rails
+cve: 2016-0753
+date: 2016-01-25
+url: "https://groups.google.com/forum/#!topic/rubyonrails-security/6jQVC1geukQ"
+
+title: Possible Input Validation Circumvention in Active Model
+
+description: |
+  There is a possible input validation circumvention vulnerability in Active
+  Model. This vulnerability has been assigned the CVE identifier CVE-2016-0753.
+
+  Versions Affected:  4.1.0 and newer
+  Not affected:       4.0.13 and older
+  Fixed Versions:     5.0.0.beta1.1, 4.2.5.1, 4.1.14.1
+
+  Impact
+  ------
+  Code that uses Active Model based models (including Active Record models) and
+  does not validate user input before passing it to the model can be subject to
+  an attack where specially crafted input will cause the model to skip
+  validations.
+
+  Vulnerable code will look something like this:
+
+  ```ruby
+  SomeModel.new(unverified_user_input)
+  ```
+
+  Rails users using Strong Parameters are generally not impacted by this issue
+  as they are encouraged to whitelist parameters and must specifically opt-out
+  of input verification using the `permit!` method to allow mass assignment.
+
+  For example, a vulnerable Rails application will have code that looks like
+  this:
+
+  ```ruby
+  def create
+    params.permit! # allow all parameters
+    @user = User.new params[:users]
+  end
+  ```
+
+  Active Model and Active Record objects are not equipped to handle arbitrary
+  user input.  It is up to the application to verify input before passing it to
+  Active Model models.  Rails users already have Strong Parameters in place to
+  handle white listing, but applications using Active Model and Active Record
+  outside of a Rails environment may be impacted.
+
+  All users running an affected release should either upgrade or use one of the
+  workarounds immediately.
+
+  Releases
+  --------
+  The FIXED releases are available at the normal locations.
+
+  Workarounds
+  -----------
+  There are several workarounds depending on the application.  Inside a Rails
+  application, stop using `permit!`.  Outside a Rails application, either use
+  Hash#slice to select the parameters you need, or integrate Strong Parameters
+  with your application.
+
+  Patches
+  -------
+  To aid users who aren't able to upgrade immediately we have provided patches for
+  the two supported release series. They are in git-am format and consist of a
+  single changeset.
+
+  * 4-1-validation_skip.patch - Patch for 4.1 series
+  * 4-2-validation_skip.patch - Patch for 4.2 series
+  * 5-0-validation_skip.patch - Patch for 5.0 series
+
+  Please note that only the 4.1.x and 4.2.x series are supported at present. Users
+  of earlier unsupported releases are advised to upgrade as soon as possible as we
+  cannot guarantee the continued availability of security fixes for unsupported
+  releases.
+
+  Credits
+  -------
+  Thanks to:
+
+  [John Backus](https://github.com/backus) from BlockScore for reporting this!
+
+cvss_v2: 5.0
+cvss_v3: 5.3
+
+unaffected_versions:
+  - "<= 4.0.13"
+
+patched_versions:
+  - ">= 5.0.0.beta1.1"
+  - "~> 4.2.5, >= 4.2.5.1"
+  - "~> 4.1.14, >= 4.1.14.1"

data/data/ruby-advisory-db/gems/activerecord-jdbc-adapter/OSVDB-114854.yml

@@ -0,0 +1,20 @@
+---
+gem: activerecord-jdbc-adapter
+platform: jruby
+osvdb: 114854
+url: http://osvdb.org/show/osvdb/114854
+title: |
+  ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub()
+  Function SQL Injection
+date: 2013-02-25
+description: |
+  ActiveRecord-JDBC-Adapter (AR-JDBC) contains a flaw that may allow carrying
+  out an SQL injection attack. The issue is due to the sql.gsub() function in
+  lib/arjdbc/jdbc/adapter.rb not properly sanitizing user-supplied input before
+  using it in SQL queries. This may allow a remote attacker to inject or
+  manipulate SQL queries in the back-end database, allowing for the
+  manipulation or disclosure of arbitrary data.
+unaffected_versions:
+  - "< 1.2.6"
+patched_versions:
+  - ">= 1.2.8"

data/data/ruby-advisory-db/gems/activerecord-oracle_enhanced-adapter/OSVDB-95376.yml

@@ -0,0 +1,15 @@
+---
+gem: activerecord-oracle_enhanced-adapter
+osvdb: 95376
+url: http://osvdb.org/show/osvdb/95376
+title: Oracle "enhanced" ActiveRecord Gem for Ruby :limit / :offset SQL Injection
+date: 2008-10-10
+description: |
+  Oracle "enhanced" ActiveRecord Gem for Ruby contains a flaw that may allow an
+  attacker to carry out an SQL injection attack. The issue is due to the
+  program not properly sanitizing user-supplied input related to the :limit and
+  :offset functions. This may allow an attacker to inject or manipulate SQL
+  queries in the back-end database, allowing for the manipulation or disclosure
+  of arbitrary data.
+patched_versions:
+  - ">= 1.1.8"

data/data/ruby-advisory-db/gems/activerecord/CVE-2012-2660.yml

@@ -0,0 +1,24 @@
+--- 
+gem: activerecord
+framework: rails
+cve: 2012-2660
+osvdb: 82610
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-2660
+title:
+  Ruby on Rails ActiveRecord Class Rack Query Parameter Parsing SQL Query
+  Arbitrary IS NULL Clause Injection
+date: 2012-05-31
+
+description: |
+  Ruby on Rails contains a flaw related to the way ActiveRecord handles
+  parameters in conjunction with the way Rack parses query parameters.
+  This issue may allow an attacker to inject arbitrary 'IS NULL' clauses in
+  to application SQL queries. This may also allow an attacker to have the
+  SQL query check for NULL in arbitrary places.
+
+cvss_v2: 7.5
+
+patched_versions: 
+  - ~> 3.0.13
+  - ~> 3.1.5
+  - ">= 3.2.4"