bundler-audit 0.7.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/activeresource/OSVDB-95749.yml

@@ -0,0 +1,15 @@
+---
+gem: activeresource
+osvdb: 95749
+url: http://osvdb.org/show/osvdb/95749
+title: activeresource Gem for Ruby lib/active_resource/connection.rb request Function Multiple Variable Format String
+date: 2008-08-15
+description: |
+  activeresource contains a format string flaw in the request function of
+  lib/active_resource/connection.rb. The issue is triggered as format string
+  specifiers (e.g. %s and %x) are not properly sanitized in user-supplied input
+  when passed via the 'result.code' and 'result.message' variables. This may
+  allow a remote attacker to cause a denial of service or potentially execute
+  arbitrary code.
+patched_versions:
+  - ">= 2.2.0"

data/data/ruby-advisory-db/gems/activestorage/CVE-2018-16477.yml

@@ -0,0 +1,43 @@
+---
+gem: activestorage
+framework: rails
+cve: 2018-16477
+url: https://groups.google.com/forum/#!topic/rubyonrails-security/3KQRnXDIuLg
+title: Bypass vulnerability in Active Storage
+date: 2018-11-27
+
+description: |
+  There is a vulnerability in Active Storage. This vulnerability has been
+  assigned the CVE identifier CVE-2018-16477.
+
+  Versions Affected:  >= 5.2.0
+  Not affected:       < 5.2.0
+  Fixed Versions:     5.2.1.1
+
+  Impact
+  ------
+  Signed download URLs generated by `ActiveStorage` for Google Cloud Storage
+  service and Disk service include `content-disposition` and `content-type`
+  parameters that an attacker can modify. This can be used to upload specially
+  crafted HTML files and have them served and executed inline. Combined with
+  other techniques such as cookie bombing and specially crafted AppCache manifests,
+  an attacker can gain access to private signed URLs within a specific storage path.
+
+  Vulnerable apps are those using either GCS or the Disk service in production.
+  Other storage services such as S3 or Azure aren't affected.
+
+  All users running an affected release should either upgrade or use one of the
+  workarounds immediately. For those using GCS, it's also recommended to run the
+  following to update existing blobs:
+
+  ```
+  ActiveStorage::Blob.find_each do |blob|
+    blob.send :update_service_metadata
+  end
+  ```
+
+unaffected_versions:
+  - "< 5.2.0"
+
+patched_versions:
+  - ">= 5.2.1.1"

data/data/ruby-advisory-db/gems/activestorage/CVE-2020-8162.yml

@@ -0,0 +1,31 @@
+---
+gem: activestorage
+framework: rails
+cve: 2020-8162
+url: https://groups.google.com/forum/#!topic/rubyonrails-security/PjU3946mreQ
+title: Circumvention of file size limits in ActiveStorage
+date: 2020-05-18
+
+description: |
+  There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a
+  direct file upload to be modified by an end user.
+
+  Versions Affected:  rails < 5.2.4.2, rails < 6.0.3.1
+  Not affected:       Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter.
+  Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1
+
+  Impact
+  ------
+
+  Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a
+  new signature from the server. This could be used to bypass controls in place on the server to limit upload size.
+
+  Workarounds
+  -----------
+
+  This is a low-severity security issue. As such, no workaround is necessarily
+  until such time as the application can be upgraded.
+
+patched_versions:
+  - "~> 5.2.4.3"
+  - ">= 6.0.3.1"

data/data/ruby-advisory-db/gems/activesupport/CVE-2012-1098.yml

@@ -0,0 +1,26 @@
+--- 
+gem: activesupport
+framework: rails
+cve: 2012-1098
+osvdb: 79726
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-1098
+title: Ruby on Rails SafeBuffer Object [] Direct Manipulation XSS
+date: 2012-03-01
+
+description: |
+  Ruby on Rails contains a flaw that allows a remote cross-site scripting (XSS)
+  attack. This flaw exists because athe application does not validate direct
+  manipulations of SafeBuffer objects via '[]' and other methods. This may
+  allow a user to create a specially crafted request that would execute
+  arbitrary script code in a user's browser within the trust relationship
+  between their browser and the server.
+
+cvss_v2: 4.3
+
+unaffected_versions:
+  - "< 3.0.0"
+
+patched_versions: 
+  - ~> 3.0.12
+  - ~> 3.1.4
+  - ">= 3.2.2"

data/data/ruby-advisory-db/gems/activesupport/CVE-2012-3464.yml

@@ -0,0 +1,23 @@
+--- 
+gem: activesupport
+framework: rails
+cve: 2012-3464
+osvdb: 84516
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-3464
+title: Ruby on Rails HTML Escaping Code XSS
+date: 2012-08-09
+
+description: |
+  Ruby on Rails contains a flaw that allows a remote cross-site scripting (XSS)
+  attack. This flaw exists because the HTML escaping code functionality does
+  not properly escape a single quote character. This may allow a user to create
+  a specially crafted request that would execute arbitrary script code in a
+  user's browser within the trust relationship between their browser and the
+  server.
+
+cvss_v2: 4.3
+
+patched_versions: 
+  - ~> 3.0.17
+  - ~> 3.1.8
+  - ">= 3.2.8"

data/data/ruby-advisory-db/gems/activesupport/CVE-2013-0333.yml

@@ -0,0 +1,25 @@
+--- 
+gem: activesupport
+framework: rails
+cve: 2013-0333
+osvdb: 89594
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0333
+title:
+  Ruby on Rails JSON Parser Crafted Payload YAML Subset Decoding Remote Code
+  Execution 
+date: 2013-01-28
+
+description: |
+  Ruby on Rails contains a flaw in the JSON parser. Rails supports multiple
+  parsing backends, one of which involves transforming JSON into YAML via the
+  YAML parser. With a specially crafted payload, an attacker can subvert the
+  backend into decoding a subset of YAML. This may allow a remote attacker to
+  bypass restrictions, allowing them to bypass authentication systems, inject
+  arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on
+  a Rails application.
+
+cvss_v2: 9.3
+
+patched_versions: 
+  - ~> 2.3.16
+  - ">= 3.0.20"

data/data/ruby-advisory-db/gems/activesupport/CVE-2013-1856.yml

@@ -0,0 +1,28 @@
+--- 
+gem: activesupport
+framework: rails
+platform: jruby
+cve: 2013-1856
+osvdb: 91451
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1856
+title: XML Parsing Vulnerability affecting JRuby users
+date: 2013-03-19
+
+description: | 
+ The ActiveSupport XML parsing functionality supports multiple
+ pluggable backends. One backend supported for JRuby users is
+ ActiveSupport::XmlMini_JDOM which makes use of the
+ javax.xml.parsers.DocumentBuilder class. In some JVM configurations
+ the default settings of that class can allow an attacker to construct
+ XML which, when parsed, will contain the contents of arbitrary URLs
+ including files from the application server. They may also allow for
+ various denial of service attacks. Action Pack
+
+cvss_v2: 7.8
+
+unaffected_versions:
+  - ~> 2.3.0
+
+patched_versions:   
+  - ~> 3.1.12
+  - ">= 3.2.13"

data/data/ruby-advisory-db/gems/activesupport/CVE-2015-3226.yml

@@ -0,0 +1,55 @@
+---
+gem: activesupport
+framework: rails
+cve: 2015-3226
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/7VlB_pck3hU
+title: |
+  XSS Vulnerability in ActiveSupport::JSON.encode
+date: 2015-06-16
+
+description: |
+  When a `Hash` containing user-controlled data is encode as JSON (either through 
+  `Hash#to_json` or `ActiveSupport::JSON.encode`), Rails does not perform adequate 
+  escaping that matches the guarantee implied by the `escape_html_entities_in_json` 
+  option (which is enabled by default). If this resulting JSON string is subsequently 
+  inserted directly into an HTML page, the page will be vulnerable to XSS attacks. 
+
+  For example, the following code snippet is vulnerable to this attack: 
+
+      <%= javascript_tag "var data = #{user_supplied_data.to_json};" %> 
+
+  Similarly, the following is also vulnerable: 
+
+      <script> 
+        var data = <%= ActiveSupport::JSON.encode(user_supplied_data).html_safe %>; 
+      </script> 
+
+  All applications that renders JSON-encoded strings that contains user-controlled 
+  data in their views should either upgrade to one of the FIXED versions or use 
+  the suggested workaround immediately. 
+
+  Workarounds 
+  ----------- 
+  To work around this problem add an initializer with the following code: 
+
+    module ActiveSupport 
+      module JSON 
+        module Encoding 
+          private 
+          class EscapedString 
+            def to_s 
+              self 
+            end 
+          end 
+        end 
+      end 
+    end 
+
+unaffected_versions:
+  - "< 4.1.0"
+
+patched_versions:
+  - ">= 4.2.2"
+  - "~> 4.1.11"
+
+

data/data/ruby-advisory-db/gems/activesupport/CVE-2015-3227.yml

@@ -0,0 +1,33 @@
+---
+gem: activesupport
+framework: rails
+cve: 2015-3227
+url: https://groups.google.com/forum/#!topic/rubyonrails-security/bahr2JLnxvk
+title: |
+  Possible Denial of Service attack in Active Support
+
+date: 2015-06-16
+
+description: |
+  Specially crafted XML documents can cause applications to raise a 
+  `SystemStackError` and potentially cause a denial of service attack.  This 
+  only impacts applications using REXML or JDOM as their XML processor.  Other 
+  XML processors that Rails supports are not impacted. 
+
+  All users running an affected release should either upgrade or use one of the work arounds immediately.
+
+  Workarounds 
+  ----------- 
+  Use an XML parser that is not impacted by this problem, such as Nokogiri or 
+  LibXML.  You can change the processor like this: 
+
+    ActiveSupport::XmlMini.backend = 'Nokogiri' 
+
+  If you cannot change XML parsers, then adjust 
+  `RUBY_THREAD_MACHINE_STACK_SIZE`. 
+
+
+patched_versions:
+  - ">= 4.2.2"
+  - "~> 4.1.11"
+  - "~> 3.2.22"

data/data/ruby-advisory-db/gems/activesupport/CVE-2020-8165.yml

@@ -0,0 +1,41 @@
+---
+gem: activesupport
+framework: rails
+cve: 2020-8165
+date: 2020-05-18
+url: https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c
+title: Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
+description: |
+  There is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
+  untrusted user input is written to the cache store using the `raw: true` parameter, re-reading the result
+  from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:
+
+  ```
+  data = cache.fetch("demo", raw: true) { untrusted_string }
+  ```
+
+  Versions Affected:  rails < 5.2.5, rails < 6.0.4
+  Not affected:       Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the `raw` option when storing untrusted user input.
+  Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1
+
+  Impact
+  ------
+
+  Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
+  this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.
+
+  In addition to upgrading to the latest versions of Rails, developers should ensure that whenever
+  they are calling `Rails.cache.fetch` they are using consistent values of the `raw` parameter for both
+  reading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,
+  detect if data was serialized using the raw option upon deserialization.
+
+  Workarounds
+  -----------
+
+  It is recommended that application developers apply the suggested patch or upgrade to the latest release as
+  soon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using
+  the `raw` argument should be double-checked to ensure that they conform to the expected format.
+
+patched_versions:
+  - "~> 5.2.4.3"
+  - ">= 6.0.3.1"

data/data/ruby-advisory-db/gems/administrate/CVE-2016-3098.yml

@@ -0,0 +1,14 @@
+---
+gem: administrate
+cve: 2016-3098
+title: Cross-site request forgery (CSRF) vulnerability in administrate gem
+date: 2016-04-01
+url: http://seclists.org/oss-sec/2016/q2/0
+
+description: >-
+  `Administrate::ApplicationController` actions didn't have CSRF
+  protection. Remote attackers can hijack user's sessions and use any
+  functionality that administrate exposes on their behalf.
+
+patched_versions:
+  - ">= 0.1.5"

data/data/ruby-advisory-db/gems/administrate/CVE-2020-5257.yml

@@ -0,0 +1,24 @@
+---
+gem: administrate
+cve: 2020-5257
+ghsa: 2p5p-m353-833w
+title: Sort order SQL injection via `direction` parameter in administrate
+date: 2020-03-14
+url: https://github.com/advisories/GHSA-2p5p-m353-833w
+description: |
+  In Administrate (rubygem) before version 0.13.0, when sorting by attributes
+  on a dashboard, the direction parameter was not validated before being
+  interpolated into the SQL query.
+
+  This could present a SQL injection if the attacker were able to modify the
+  direction parameter and bypass ActiveRecord SQL protections.
+
+  Whilst this does have a high-impact, to exploit this you need access to the
+  Administrate dashboards, which should generally be behind authentication.
+
+patched_versions:
+  - ">= 0.13.0"
+
+related:
+  url:
+    - https://github.com/thoughtbot/administrate/commit/3ab838b83c5f565fba50e0c6f66fe4517f98eed3

data/data/ruby-advisory-db/gems/aescrypt/CVE-2013-7463.yml

@@ -0,0 +1,10 @@
+---
+gem: aescrypt
+cve: 2013-7463
+date: 2013-10-01
+url: https://github.com/Gurpartap/aescrypt/issues/4
+title: Vulnerability in aescrypt because IV is not randomized
+description: |
+  The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the
+  AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to
+  defeat cryptographic protection mechanisms via a chosen plaintext attack.

data/data/ruby-advisory-db/gems/airbrake-ruby/CVE-2019-16060.yml

@@ -0,0 +1,18 @@
+---
+gem: airbrake-ruby
+cve: 2019-16060
+date: 2019-04-10
+url: https://github.com/airbrake/airbrake-ruby/issues/468
+title: Blacklist keys are no longer being filtered in airbrake-ruby
+description: |
+  A flaw in airbrake-ruby v4.2.3 prevented user data from being filtered
+  prior to sending to Airbrake. Such data could be user passwords. Therefore, an app
+  could leak user passwords without knowing it.
+unaffected_versions:
+  - "< 4.2.3"
+  - "> 4.2.3"
+patched_versions:
+  - ">= 4.2.4"
+related:
+  url:
+    - https://github.com/airbrake/airbrake-ruby/pull/469

data/data/ruby-advisory-db/gems/archive-tar-minitar/CVE-2016-10173.yml

@@ -0,0 +1,16 @@
+---
+gem: archive-tar-minitar
+cve: 2016-10173
+url: https://github.com/atoulme/minitar/issues/5
+title: Archive-Tar-Minitar Directory Traversal Vulnerability
+date: 2016-08-22
+description: |
+  Minitar allows attackers to overwrite arbitrary files during archive
+  extraction via a .. (dot dot) in an extracted filename. Analogous
+  vulnerabilities for unzip and tar:
+  https://www.cvedetails.com/cve/CVE-2001-1268/ and
+  http://www.cvedetails.com/cve/CVE-2001-1267/
+
+  Credit: ecneladis
+patched_versions:
+  - ">= 0.6.0"

data/data/ruby-advisory-db/gems/as/OSVDB-112683.yml

@@ -0,0 +1,10 @@
+---
+gem: as
+osvdb: 112683
+url: http://osvdb.org/show/osvdb/112683
+title: as Gem for Ruby Process List Local Plaintext Credentials Disclosure
+date: 2014-09-25
+description: |
+  as Gem for Ruby contains a flaw that is due to the program displaying
+  credential information in plaintext in the process list. This may
+  allow a local attacker to gain access to credential information.

data/data/ruby-advisory-db/gems/authlogic/CVE-2012-6497.yml

@@ -0,0 +1,15 @@
+---
+gem: authlogic
+cve: 2012-6497
+osvdb: 89064
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-6497
+title: Ruby on Rails Authlogic Gem secret_token.rb Known secret_token Value Weakness
+date: 2012-12-21
+description: |
+  Ruby on Rails contains a flaw in the Authlogic gem. The issue is triggered
+  when the program makes an unsafe method call for find_by_id. With a specially
+  crafted parameter in an environment that knows the secret_token value in
+  secret_token.rb, a remote attacker to more easily conduct SQL injection
+  attacks.
+patched_versions:
+  - ">= 3.3.0"