bundler-audit 0.7.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/builder/OSVDB-95668.yml

@@ -0,0 +1,13 @@
+---
+gem: builder
+osvdb: 95668
+url: http://osvdb.org/show/osvdb/95668
+title: Builder Gem for Ruby Tag Name Handling Private Method Exposure
+date: 2007-06-15
+description: |
+  Builder Gem for Ruby contains a flaw in the handling of tag names. The issue
+  is triggered when the program reads tag names from XML data and then calls a
+  method with that name. With a specially crafted file, a context-dependent
+  attacker can call private methods and manipulate data.
+patched_versions:
+  - ">= 2.1.2"

data/data/ruby-advisory-db/gems/bundler/CVE-2013-0334.yml

@@ -0,0 +1,15 @@
+---
+gem: bundler
+cve: 2013-0334
+osvdb: 110004
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-0334
+title: Bundler Gem for Ruby Multiple Top-level Source Lines Gemfile Handling Gem Installation Spoofing
+date: 2014-08-13
+description: |
+  Bundler Gem for Ruby contains a flaw that is triggered when handling
+  a gemfile that contains multiple top-level source lines. This may allow a
+  context-dependent attacker to install specially crafted gems on a remote
+  system, leading to arbitrary code execution.
+cvss_v2: 5.0
+patched_versions:
+  - ">= 1.7.0"

data/data/ruby-advisory-db/gems/bundler/OSVDB-115090.yml

@@ -0,0 +1,13 @@
+---
+gem: bundler
+osvdb: 115090
+url: http://www.osvdb.org/show/osvdb/115090
+title: Bundler Gem for Ruby Missing SSL Certificate Validation MitM Spoofing 
+date: 2013-02-12
+description: |
+  Bundler Gem for Ruby contains a flaw as SSL certificates are not properly
+  validated. By spoofing the SSL server via a certificate that appears valid,
+  an attacker with the ability to intercept network traffic (e.g. MiTM, DNS
+  cache poisoning) can disclose and optionally manipulate transmitted data. 
+patched_versions:
+  - ">= 1.3.0.pre.8"

data/data/ruby-advisory-db/gems/bundler/OSVDB-115091.yml

@@ -0,0 +1,12 @@
+---
+gem: bundler
+osvdb: 115091
+url: http://www.osvdb.org/show/osvdb/115091
+title: Bundler Gem for Ruby Redirection Remote HTTP Basic Authentication Credential Disclosure
+date: 2013-02-12
+description: |
+   Bundler Gem for Ruby contains a flaw that is triggered during the
+   redirection to other hosts. This may allow a remote attacker to gain access
+   to HTTP basic authentication credential information.
+patched_versions:
+  - ">= 1.3.0.pre.8"

data/data/ruby-advisory-db/gems/bundler/OSVDB-115917.yml

@@ -0,0 +1,12 @@
+---
+gem: bundler
+osvdb: 115917
+url: http://www.osvdb.org/show/osvdb/115917
+title: Bundler Gem for Ruby install Command Process Listing Local Plaintext Credential Disclosure
+date: 2011-09-20
+description: |
+  Bundler Gem for Ruby contains a flaw that is due to the program listing
+  credential information in plaintext in the install command process listing.
+  This may allow a local attacker to gain access to credential information.
+patched_versions:
+  - ">= 1.1.rc"

data/data/ruby-advisory-db/gems/cairo/CVE-2017-7475.yml

@@ -0,0 +1,15 @@
+---
+gem: cairo
+cve: 2017-7475
+ghsa: 5v3f-73gv-x7x5
+url: https://bugs.freedesktop.org/show_bug.cgi?id=100763
+date: 2017-11-15
+title: cairo NULL pointer dereference
+description: |
+  Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related
+  to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.
+
+cvss_v3: 5.5
+
+patched_versions:
+- ">= 1.15.5"

data/data/ruby-advisory-db/gems/cap-strap/CVE-2014-4992.yml

@@ -0,0 +1,8 @@
+---
+gem: cap-strap
+cve: 2014-4992
+osvdb: 108574
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-4992
+title: cap-strap Gem for Ruby Process Table Local Plaintext Credential Disclosure
+date: 2014-06-30
+description: cap-strap Gem for Ruby contains a flaw that is due to the application exposing credential information in plaintext in the process table listing. This may allow a local attacker to gain access to credential information.

data/data/ruby-advisory-db/gems/cap-strap/OSVDB-108575.yml

@@ -0,0 +1,7 @@
+---
+gem: cap-strap
+osvdb: 108575
+url: http://osvdb.org/show/osvdb/108575
+title: cap-strap Gem for Ruby Hardcoded Password Crypt Hash Salt Weakness
+date: 2014-06-30
+description: cap-strap Gem for Ruby contains a flaw that is due to the application using a hardcoded default 'sa' salt for password encryption. This may allow a local attacker to more easily decrypt passwords.

data/data/ruby-advisory-db/gems/capistrano-colors/CVE-2019-15224.yml

@@ -0,0 +1,19 @@
+---
+gem: capistrano-colors
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in capistrano-colors
+description: |
+  The capistrano-colors 0.5.5 gem for Ruby, as distributed on RubyGems.org, included a
+  code-execution backdoor inserted by a third party.
+
+  Users of an affected version should consider downgrading to the last non-affected version of
+  0.5.4.
+unaffected_versions:
+  - "< 0.5.5"
+  - "> 0.5.5"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/chartkick/CVE-2019-12732.yml

@@ -0,0 +1,21 @@
+---
+gem: chartkick
+cve: 2019-12732
+url: https://github.com/ankane/chartkick/issues/488
+title: XSS Vulnerability in Chartkick Ruby Gem
+date: 2019-06-04
+description: |
+  Chartkick is vulnerable to a cross-site scripting (XSS) attack if
+  both the following conditions are met:
+
+  Condition 1:
+    It's used with `ActiveSupport.escape_html_entities_in_json = false`
+    (this is not the default for Rails)
+    OR used with a non-Rails framework like Sinatra.
+
+  Condition 2:
+    Untrusted data or options are passed to a chart.
+
+    <%= line_chart params[:data], min: params[:min] %>
+patched_versions:
+  - ">= 3.2.0"

data/data/ruby-advisory-db/gems/chartkick/CVE-2019-18841.yml

@@ -0,0 +1,13 @@
+---
+gem: chartkick
+cve: 2019-18841
+url: https://github.com/ankane/chartkick.js/issues/117
+title: Prototype Pollution in Chartkick.js 3.1.x
+date: 2019-11-09
+description: |
+  A specially crafted response in data loaded via URL
+  can cause prototype pollution in JavaScript.
+unaffected_versions:
+  - "< 3.1.0"
+patched_versions:
+  - ">= 3.3.0"

data/data/ruby-advisory-db/gems/chloride/CVE-2018-6517.yml

@@ -0,0 +1,17 @@
+---
+gem: chloride
+cve: 2018-6517
+url: https://puppet.com/security/cve/CVE-2018-6517
+date: 2019-03-08
+title: Improper handling of ssh known_hosts file with Chloride
+
+description: |
+  Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints
+  for previously unknown hosts getting added to the user's known_hosts file without
+  confirmation. In version 0.3.0 this is updated so that the user's known_hosts file
+  is not updated by chloride.
+
+cvss_v3: 5.0
+
+patched_versions:
+  - ">= 0.3.0"

data/data/ruby-advisory-db/gems/ciborg/CVE-2014-5003.yml

@@ -0,0 +1,8 @@
+---
+gem: ciborg
+cve: 2014-5003
+osvdb: 108586
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-5003
+title: ciborg Gem for Ruby default.rb /tmp/perlbrew-installer Local Symlink File Overwrite
+date: 2014-06-30
+description: ciborg Gem for Ruby contains a flaw as default.rb creates temporary files insecurely. It is possible for a local attacker to use a symlink attack against the /tmp/perlbrew-installer file to cause the program to unexpectedly overwrite an arbitrary file.

data/data/ruby-advisory-db/gems/cocaine/CVE-2013-4457.yml

@@ -0,0 +1,15 @@
+---
+gem: cocaine
+cve: 2013-4457
+osvdb: 98835
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-4457
+title: Cocaine Gem for Ruby contains a flaw
+date: 2013-10-22
+description: Cocaine Gem for Ruby contains a flaw that is due to the method
+  of variable interpolation used by the program. With a specially crafted
+  object, a context-dependent attacker can execute arbitrary commands.
+cvss_v2: 6.8
+unaffected_versions:
+  - < 0.4.0
+patched_versions: 
+  - '>= 0.5.3'

data/data/ruby-advisory-db/gems/codders-dataset/CVE-2014-4991.yml

@@ -0,0 +1,8 @@
+---
+gem: codders-dataset
+cve: 2014-4991
+osvdb: 108582
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-4991
+title: codders-dataset Gem for Ruby lib/dataset/database/mysql.rb and lib/dataset/database/postgresql.rb Process Table Local Plaintext Credential Disclosure
+date: 2014-06-30
+description: (1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.

data/data/ruby-advisory-db/gems/coin_base/CVE-2019-15224.yml

@@ -0,0 +1,18 @@
+---
+gem: coin_base
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in coin_base
+description: |
+  The coin_base gem 4.2.1 through 4.2.2 for Ruby, as distributed on RubyGems.org, included a
+  code-execution backdoor inserted by a third party.
+
+  No unaffected version is known to exist, as the gem appears to have been entirely removed.
+unaffected_versions:
+  - "< 4.2.1"
+  - "> 4.2.2"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/colorscore/CVE-2015-7541.yml

@@ -0,0 +1,21 @@
+---
+gem: colorscore
+cve: 2015-7541
+osvdb: 132516
+url: http://seclists.org/oss-sec/2016/q1/17
+title: colorscore Gem for Ruby lib/colorscore/histogram.rb Arbitrary Command Injection
+date: 2016-01-04
+description: |
+  The contents of the `image_path`, `colors`, and `depth` variables generated
+  from possibly user-supplied input are passed directly to the shell via
+  `convert ...`.
+
+  If a user supplies a value that includes shell metacharacters such as ';', an
+  attacker may be able to execute shell commands on the remote system as the
+  user id of the Ruby process.
+
+  To resolve this issue, the aforementioned variables (especially `image_path`)
+  must be sanitized for shell metacharacters.
+
+patched_versions: 
+  - '>= 0.0.5'

data/data/ruby-advisory-db/gems/coming-soon/CVE-2019-15224.yml

@@ -0,0 +1,18 @@
+---
+gem: coming-soon
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in coming-soon
+description: |
+  The coming-soon gem 0.2.8 for Ruby, as distributed on RubyGems.org, included a code-execution
+  backdoor inserted by a third party.
+
+  No unaffected version is known to exist, as the gem appears to have been entirely removed.
+unaffected_versions:
+  - "< 0.2.8"
+  - "> 0.2.8"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/command_wrap/CVE-2013-1875.yml

@@ -0,0 +1,9 @@
+--- 
+gem: command_wrap
+cve: 2013-1875
+osvdb: 91450
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1875
+title: command_wrap Gem for Ruby URI Handling Arbitrary Command Injection
+date: 2013-03-18
+description: command_wrap Gem for Ruby contains a flaw that is triggered during the handling of input passed via the URL that contains a semicolon character (;). This will allow a remote attacker to inject arbitrary commands and have them executed in the context of the user clicking it.
+cvss_v2: 7.5

data/data/ruby-advisory-db/gems/consul/CVE-2019-16377.yml

@@ -0,0 +1,15 @@
+---
+gem: consul
+cve: 2019-16377
+url: https://github.com/makandra/consul/issues/49
+title: |
+  Consul gem insufficient authentication check: Multiple powers in one controller are not always checked correctly
+date: 2019-09-23
+description: |
+  With the consul ruby gem before 1.0.3, if a controller checks multiple powers
+  using `:if` or `:except` conditions, these conditions are erroneously applied
+  to all power checks in that controller. This can lead to skipped power checks
+  and hence unauthenticated access to certain controller actions.
+
+patched_versions:
+  - ">= 1.0.3"

data/data/ruby-advisory-db/gems/crack/CVE-2013-1800.yml

@@ -0,0 +1,17 @@
+---
+gem: crack
+cve: 2013-1800
+osvdb: 90742
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1800
+title: crack Gem for Ruby Type Casting Parameter Parsing Remote Code Execution 
+description: |
+  crack Gem for Ruby contains a flaw that is triggered when a type casting
+  error occurs during the parsing of parameters. This may allow a
+  context-dependent attacker to potentially execute arbitrary code.
+date: 2013-01-09
+
+cvss_v2: 7.5
+
+patched_versions:
+  - ">= 0.3.2"
+

data/data/ruby-advisory-db/gems/cremefraiche/CVE-2013-2090.yml

@@ -0,0 +1,11 @@
+---
+gem: cremefraiche
+cve: 2013-2090
+osvdb: 93395
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-2090
+title: Creme Fraiche Gem for Ruby File Name Shell Metacharacter Injection Arbitrary Command Execution
+date: 2013-05-14
+description: Creme Fraiche Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input in file names. With a specially crafted file name that contains shell metacharacters, a context-dependent attacker can execute arbitrary commands
+cvss_v2: 9.3
+patched_versions:
+  - ">= 0.6.1"

data/data/ruby-advisory-db/gems/cron_parser/CVE-2019-15224.yml

@@ -0,0 +1,20 @@
+---
+gem: cron_parser
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in cron_parser
+description: |
+  The cron_parser gem 0.1.4, 1.0.12, and 1.0.13 as distributed on RubyGems.org, included a
+  code-execution backdoor inserted by a third party.
+
+  No unaffected version is known to exist, as the gem appears to have been entirely removed.
+unaffected_versions:
+  - "< 1.0.12"
+  - "> 1.0.13"
+  - "< 0.1.4"
+  - "> 0.1.4"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/curb/OSVDB-114600.yml

@@ -0,0 +1,12 @@
+---
+gem: curb
+osvdb: 114600
+url: http://osvdb.org/show/osvdb/114600
+title: curb Gem for Ruby Empty http_put Body Handling Remote DoS
+date: 2010-08-12
+description: |
+  curb Gem for Ruby contains a flaw that is triggered when handling an empty
+  http_put body. This may allow a remote attacker to crash an application
+  linked against the library.
+patched_versions:
+  - ">= 0.7.8"

data/data/ruby-advisory-db/gems/curl/CVE-2013-2617.yml

@@ -0,0 +1,13 @@
+---
+gem: curl
+cve: 2013-2617
+osvdb: 91230
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-2617
+title: Curl Gem for Ruby URI Handling Arbitrary Command Injection
+date: 2013-03-12
+description: Curl Gem for Ruby contains a flaw that is triggered during the
+  handling of specially crafted input passed via the URL.  This may allow
+  a context-dependent attacker to potentially execute arbitrary commands by
+  injecting them via a semi-colon (;).
+cvss_v2: 7.5
+patched_versions:

data/data/ruby-advisory-db/gems/datagrid/CVE-2019-14281.yml

@@ -0,0 +1,14 @@
+---
+gem: datagrid
+cve: 2019-14281
+ghsa: rqp5-pg7w-832p
+url: https://github.com/rubygems/rubygems.org/issues/2072
+date: 2019-07-31
+title: Code execution backdoor in datagrid
+description: |
+  The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included
+  a code-execution backdoor inserted by a third party.
+unaffected_versions:
+  - "< 1.0.6"
+  - "> 1.0.6"
+cvss_v3: 9.8

data/data/ruby-advisory-db/gems/delayed_job_web/CVE-2017-12097.yml

@@ -0,0 +1,17 @@
+---
+gem: delayed_job_web
+cve: 2017-12097
+url: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0449
+date: 2018-01-10
+title: delayed_job_web ruby gem XSS vulnerability via `queues` parameter
+description: |
+  An exploitable cross site scripting (XSS) vulnerability exists in the
+  filter functionality of the delayed_job_web ruby gem. A specially crafted
+  URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary
+  javascript on the victim's browser. An attacker can phish an authenticated user
+  to trigger this vulnerability.
+
+cvss_v3: 6.1
+
+patched_versions:
+  - ">= 1.4.2"

data/data/ruby-advisory-db/gems/devise-two-factor/CVE-2015-7225.yml

@@ -0,0 +1,22 @@
+---
+gem: devise-two-factor
+cve: 2015-7225
+url: http://www.openwall.com/lists/oss-security/2015/09/06/2
+title: |
+  devise-two-factor 1.1.0 and earlier vulnerable to replay attacks
+date: 2015-09-17
+description: |
+  A OTP replay vulnerability in devise-two-factor 1.1.0 and earlier allows local
+  attackers to shoulder-surf a user's TOTP verification code and use it to
+  login after the user has authenticated. 
+
+  By not "burning" a previously used TOTP, devise-two-factor allows a narrow
+  window of opportunity (aka the timestep period) where an attacker can re-use a
+  verification code. 
+  
+  Should an attacker possess a given user's authentication 
+  credentials, this flaw effectively defeats two-factor authentication for the 
+  duration of the timestep. 
+
+patched_versions:
+  - ">= 2.0.0"