bundler-audit 0.7.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/activerecord/CVE-2012-2661.yml

@@ -0,0 +1,25 @@
+--- 
+gem: activerecord
+framework: rails
+cve: 2012-2661
+osvdb: 82403
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-2661
+title: Ruby on Rails where Method ActiveRecord Class SQL Injection
+date: 2012-05-31
+
+description: |
+  Ruby on Rails (RoR) contains a flaw that may allow an attacker to carry out
+  an SQL injection attack. The issue is due to the ActiveRecord class not
+  properly sanitizing user-supplied input to the 'where' method. This may
+  allow an attacker to inject or manipulate SQL queries in an application
+  built on RoR, allowing for the manipulation or disclosure of arbitrary data.
+
+cvss_v2: 5.0
+
+unaffected_versions:
+  - ~> 2.3.14
+
+patched_versions: 
+  - ~> 3.0.13
+  - ~> 3.1.5
+  - ">= 3.2.4"

data/data/ruby-advisory-db/gems/activerecord/CVE-2013-0155.yml

@@ -0,0 +1,24 @@
+--- 
+gem: activerecord
+framework: rails
+cve: 2013-0155
+osvdb: 89025
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0155
+title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass 
+date: 2013-01-08
+
+description: |
+  Ruby on Rails contains a flaw in the Active Record. The issue is due to an
+  error with the way the Active Record handles parameters combined with an
+  error during the parsing of the JSON parameters. This may allow a remote
+  attacker to bypass restrictions abd issue unexpected database queries with
+  "IS NULL" or empty where clauses, and forcing the query to unexpectedly check
+  for NULL or eliminate a WHERE clause.
+
+cvss_v2: 10.0
+
+patched_versions: 
+  - ~> 2.3.16
+  - ~> 3.0.19
+  - ~> 3.1.10
+  - ">= 3.2.11"

data/data/ruby-advisory-db/gems/activerecord/CVE-2013-0276.yml

@@ -0,0 +1,21 @@
+--- 
+gem: activerecord
+framework: rails
+cve: 2013-0276
+osvdb: 90072
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0276
+title: Ruby on Rails Active Record attr_protected Method Bypass
+date: 2013-02-11
+
+description: |
+  Ruby on Rails contains a flaw in the attr_protected method of the
+  Active Record. The issue is triggered during the handling of a specially
+  crafted request, which may allow a remote attacker to bypass protection
+  mechanisms and alter values that would otherwise be protected.
+
+cvss_v2: 5.0
+
+patched_versions: 
+  - "~> 2.3.17"
+  - "~> 3.1.11"
+  - ">= 3.2.12"

data/data/ruby-advisory-db/gems/activerecord/CVE-2013-0277.yml

@@ -0,0 +1,23 @@
+--- 
+gem: activerecord
+framework: rails
+cve: 2013-0277
+osvdb: 90073
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0277
+title: |
+  Ruby on Rails Active Record +serialize+ Helper YAML Attribute Handling Remote
+  Code Execution 
+date: 2013-02-11
+
+description: |
+  Ruby on Rails contains a flaw in the +serialize+ helper in the Active Record.
+  The issue is triggered when the system is configured to allow users to
+  directly provide values to be serialized and deserialized using YAML.
+  With a specially crafted YAML attribute, a remote attacker can deserialize
+  arbitrary YAML and execute code associated with it.
+
+cvss_v2: 10.0
+
+patched_versions: 
+  - "~> 2.3.17"
+  - ">= 3.1.0"

data/data/ruby-advisory-db/gems/activerecord/CVE-2013-1854.yml

@@ -0,0 +1,26 @@
+--- 
+gem: activerecord
+framework: rails
+cve: 2013-1854
+osvdb: 91453
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1854
+title: Symbol DoS vulnerability in Active Record
+date: 2013-03-19
+
+description: | 
+  When a hash is provided as the find value for a query, the keys of
+  the hash may be converted to symbols. Carefully crafted requests can
+  coerce `params[:name]` to return a hash, and the keys to that hash
+  may be converted to symbols. Ruby symbols are not garbage collected,
+  so an attacker can initiate a denial of service attack by creating a
+  large number of symbols.
+
+cvss_v2: 7.8
+
+unaffected_versions:
+  - ~> 3.0.0
+
+patched_versions: 
+  - ~> 2.3.18
+  - ~> 3.1.12
+  - ">= 3.2.13"

data/data/ruby-advisory-db/gems/activerecord/CVE-2014-0080.yml

@@ -0,0 +1,23 @@
+---
+gem: activerecord
+framework: rails
+cve: 2014-0080
+osvdb: 103438
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-0080
+title: Data Injection Vulnerability in Active Record
+date: 2014-02-18
+
+description: |
+  Ruby on Rails contains a flaw in connection_adapters/postgresql/cast.rb
+  in Active Record. This issue may allow a remote attacker to inject data
+  into PostgreSQL array columns via a specially crafted string.
+
+cvss_v2: 
+
+unaffected_versions:
+  - "< 3.2.0"
+  - ~> 3.2.0
+
+patched_versions:
+  - ~> 4.0.3
+  - ">= 4.1.0.beta2"

data/data/ruby-advisory-db/gems/activerecord/CVE-2014-3482.yml

@@ -0,0 +1,23 @@
+---
+gem: activerecord
+framework: rails
+cve: 2014-3482
+osvdb: 108664
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-3482
+title: SQL Injection Vulnerability in Active Record
+date: 2014-07-02
+
+description: |
+  Ruby on Rails contains a flaw that may allow carrying out an SQL injection attack.
+  The issue is due to the PostgreSQL adapter for Active Record not properly
+  sanitizing user-supplied input when quoting bitstring. This may allow a remote
+  attacker to inject or manipulate SQL queries in the back-end database,
+  allowing for the manipulation or disclosure of arbitrary data.
+
+cvss_v2:
+
+unaffected_versions:
+  - ">= 4.0.0"
+
+patched_versions:
+  - ~> 3.2.19

data/data/ruby-advisory-db/gems/activerecord/CVE-2014-3483.yml

@@ -0,0 +1,24 @@
+---
+gem: activerecord
+framework: rails
+cve: 2014-3483
+osvdb: 108665
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-3483
+title: SQL Injection Vulnerability in Active Record
+date: 2014-07-02
+
+description: |
+  Ruby on Rails contains a flaw that may allow carrying out an SQL injection attack.
+  The issue is due to the PostgreSQL adapter for Active Record not properly
+  sanitizing user-supplied input when quoting ranges. This may allow a remote
+  attacker to inject or manipulate SQL queries in the back-end database,
+  allowing for the manipulation or disclosure of arbitrary data.
+
+cvss_v2:
+
+unaffected_versions:
+  - "< 4.0.0"
+
+patched_versions:
+  - ~> 4.0.7
+  - ">= 4.1.3"

data/data/ruby-advisory-db/gems/activerecord/CVE-2014-3514.yml

@@ -0,0 +1,23 @@
+---
+gem: activerecord
+framework: rails
+cve: 2014-3514
+url: https://groups.google.com/forum/#!msg/rubyonrails-security/M4chq5Sb540/CC1Fh0Y_NWwJ
+title: Data Injection Vulnerability in Active Record 
+date: 2014-08-18
+
+description: >-
+  The create_with functionality in Active Record was implemented
+  incorrectly and completely bypasses the strong parameters
+  protection. Applications which pass user-controlled values to
+  create_with could allow attackers to set arbitrary attributes on
+  models.
+  
+cvss_v2: 8.7
+
+unaffected_versions:
+  - "< 4.0.0"
+
+patched_versions:
+  - ~> 4.0.9 
+  - ">= 4.1.5"

data/data/ruby-advisory-db/gems/activerecord/CVE-2015-7577.yml

@@ -0,0 +1,110 @@
+---
+gem: activerecord
+framework: rails
+cve: 2015-7577
+date: 2016-01-25
+url: https://groups.google.com/forum/#!topic/rubyonrails-security/cawsWcQ6c8g
+
+title: Nested attributes rejection proc bypass in Active Record
+
+description: |
+  There is a vulnerability in how the nested attributes feature in Active Record
+  handles updates in combination with destroy flags when destroying records is
+  disabled. This vulnerability has been assigned the CVE identifier CVE-2015-7577.
+
+  Versions Affected:  3.1.0 and newer
+  Not affected:       3.0.x and older
+  Fixed Versions:     5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1
+
+  Impact
+  ------
+  When using the nested attributes feature in Active Record you can prevent the
+  destruction of associated records by passing the `allow_destroy: false` option
+  to the `accepts_nested_attributes_for` method. However due to a change in the
+  commit [a9b4b5d][1] the `_destroy` flag prevents the `:reject_if` proc from
+  being called because it assumes that the record will be destroyed anyway.
+
+  However this isn't true if `:allow_destroy` is false so this leads to changes
+  that would have been rejected being applied to the record. Attackers could use
+  this do things like set attributes to invalid values and to clear all of the
+  attributes amongst other things. The severity will be dependent on how the
+  application has used this feature.
+
+  All users running an affected release should either upgrade or use one of
+  the workarounds immediately.
+
+  Releases
+  --------
+  The FIXED releases are available at the normal locations.
+
+  Workarounds
+  -----------
+  If you can't upgrade, please use the following monkey patch in an initializer
+  that is loaded before your application:
+
+  ```
+  $ cat config/initializers/nested_attributes_bypass_fix.rb
+  module ActiveRecord
+    module NestedAttributes
+      private
+
+      def reject_new_record?(association_name, attributes)
+        will_be_destroyed?(association_name, attributes) || call_reject_if(association_name, attributes)
+      end
+
+      def call_reject_if(association_name, attributes)
+        return false if will_be_destroyed?(association_name, attributes)
+
+        case callback = self.nested_attributes_options[association_name][:reject_if]
+        when Symbol
+          method(callback).arity == 0 ? send(callback) : send(callback, attributes)
+        when Proc
+          callback.call(attributes)
+        end
+      end
+
+      def will_be_destroyed?(association_name, attributes)
+        allow_destroy?(association_name) && has_destroy_flag?(attributes)
+      end
+
+      def allow_destroy?(association_name)
+        self.nested_attributes_options[association_name][:allow_destroy]
+      end
+    end
+  end
+  ```
+
+  Patches
+  -------
+  To aid users who aren't able to upgrade immediately we have provided patches for
+  the two supported release series. They are in git-am format and consist of a
+  single changeset.
+
+  * 3-2-nested-attributes-reject-if-bypass.patch - Patch for 3.2 series
+  * 4-1-nested-attributes-reject-if-bypass.patch - Patch for 4.1 series
+  * 4-2-nested-attributes-reject-if-bypass.patch - Patch for 4.2 series
+  * 5-0-nested-attributes-reject-if-bypass.patch - Patch for 5.0 series
+
+  Please note that only the 4.1.x and 4.2.x series are supported at present. Users
+  of earlier unsupported releases are advised to upgrade as soon as possible as we
+  cannot guarantee the continued availability of security fixes for unsupported
+  releases.
+
+  Credits
+  -------
+  Thank you to Justin Coyne for reporting the problem and working with us to fix it.
+
+  [1]: https://github.com/rails/rails/commit/a9b4b5da7c216e4464eeb9dbd0a39ea258d64325
+
+cvss_v2: 5.0
+cvss_v3: 5.3
+
+unaffected_versions:
+  - "~> 3.0.0"
+  - "< 3.0.0"
+
+patched_versions:
+  - ">= 5.0.0.beta1.1"
+  - "~> 4.2.5, >= 4.2.5.1"
+  - "~> 4.1.14, >= 4.1.14.1"
+  - "~> 3.2.22.1"

data/data/ruby-advisory-db/gems/activerecord/CVE-2016-6317.yml

@@ -0,0 +1,73 @@
+---
+gem: activerecord
+framework: rails
+cve: 2016-6317
+date: 2016-08-11
+url: https://groups.google.com/forum/#!topic/rubyonrails-security/rgO20zYW33s
+
+title: Unsafe Query Generation Risk in Active Record
+
+description: |
+  There is a vulnerability when Active Record is used in conjunction with JSON
+  parameter parsing. This vulnerability is similar to CVE-2012-2660,
+  CVE-2012-2694 and CVE-2013-0155.
+
+  Impact
+  ------
+
+  Due to the way Active Record interprets parameters in combination with the way
+  that JSON parameters are parsed, it is possible for an attacker to issue
+  unexpected database queries with "IS NULL" or empty where clauses.  This issue
+  does *not* let an attacker insert arbitrary values into an SQL query, however
+  they can cause the query to check for NULL or eliminate a WHERE clause when
+  most users wouldn't expect it.
+
+  For example, a system has password reset with token functionality:
+
+  ```ruby
+      unless params[:token].nil?
+        user = User.find_by_token(params[:token])
+        user.reset_password!
+      end
+  ```
+
+  An attacker can craft a request such that `params[:token]` will return
+  `[nil]`.  The `[nil]` value will bypass the test for nil, but will still add
+  an "IN ('xyz', NULL)" clause to the SQL query.
+
+  Similarly, an attacker can craft a request such that `params[:token]` will
+  return an empty hash.  An empty hash will eliminate the WHERE clause of the
+  query, but can bypass the `nil?` check.
+
+  Note that this impacts not only dynamic finders (`find_by_*`) but also
+  relations (`User.where(:name => params[:name])`).
+
+  All users running an affected release should either upgrade or use one of the
+  work arounds immediately. All users running an affected release should upgrade
+  immediately. Please note, this vulnerability is a variant of CVE-2012-2660,
+  CVE-2012-2694, and CVE-2013-0155.  Even if you upgraded to address those
+  issues, you must take action again.
+
+  If this chance in behavior impacts your application, you can manually decode
+  the original values from the request like so:
+
+      `ActiveSupport::JSON.decode(request.body)`
+
+  Workarounds
+  -----------
+  This problem can be mitigated by casting the parameter to a string before
+  passing it to Active Record.  For example:
+
+    ```ruby
+      unless params[:token].nil? || params[:token].to_s.empty?
+        user = User.find_by_token(params[:token].to_s)
+        user.reset_password!
+      end
+    ```
+
+unaffected_versions:
+  - "< 4.2.0"
+  - ">= 5.0.0"
+
+patched_versions:
+  - ">= 4.2.7.1"

data/data/ruby-advisory-db/gems/activerecord/OSVDB-88661.yml

@@ -0,0 +1,20 @@
+---
+gem: activerecord
+framework: rails
+cve: 2012-6496
+osvdb: 88661
+url: https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM
+title: Ruby on Rails find_by_* Methods Authlogic SQL Injection Bypass
+date: 2012-12-22
+
+description: |
+  Due to the way dynamic finders in Active Record extract options from method
+  parameters, a method parameter can mistakenly be used as a scope.  Carefully
+  crafted requests can use the scope to inject arbitrary SQL.
+
+cvss_v2: 6.4
+
+patched_versions:
+  - ~> 3.0.18
+  - ~> 3.1.9
+  - ">= 3.2.10"

data/data/ruby-advisory-db/gems/activeresource/CVE-2020-8151.yml

@@ -0,0 +1,48 @@
+---
+gem: activeresource
+cve: 2020-8151
+url: https://groups.google.com/forum/#!topic/rubyonrails-security/pktoF4VmiM8
+title: activeresource Gem for Ruby lib/active_resource/base.rb element_path Lack of Encoding
+date: 2020-05-05
+description: |
+  activeresource contains a lack of encoding flaw in the element_path function of
+  lib/active_resource/base.rb.
+  
+  There is an issue with the way Active Resource encodes data before querying the back end server.  This encoding mechanism can allow specially crafted requests to possibly access data that may not be expected.
+
+  Impacted code will look something like this:
+
+  ```
+  require 'activeresource'
+
+  class Test < ActiveResource::Base
+    self.site = 'http://127.0.0.1:3000'
+  end
+
+  Test.exists?(untrusted_user_input)
+  ```
+
+  Where untrusted user input is passed to an Active Resource model.  Specially crafted untrusted input can cause Active Resource to access data in an unexpected way and possibly leak information.
+
+  Workarounds
+  -------------
+  
+  For those that can't upgrade, the following monkey patch can be applied:
+  
+  ```
+  module ActiveResource
+   class Base
+     class << self
+       def element_path(id, prefix_options = {}, query_options = nil)
+         check_prefix_options(prefix_options)
+
+         prefix_options, query_options = split_options(prefix_options) if query_options.nil?
+         "#{prefix(prefix_options)}#{collection_name}/#{URI.encode_www_form_component(id.to_s)}#{format_extension}#{query_string(query_options)}"
+       end
+     end
+   end
+  end
+  ```
+
+patched_versions:
+  - ">= 5.1.1"