bundler-budit 0.6.2 → 0.6.3

data/data/ruby-advisory-db/gems/nokogiri/CVE-2018-8048.yml

@@ -1,36 +0,0 @@
----
-gem: nokogiri
-cve: 2018-8048
-date: 2018-03-29
-url: https://github.com/sparklemotion/nokogiri/pull/1746
-title: Revert libxml2 behavior in Nokogiri gem that could cause XSS
-description: |
-  [MRI] Behavior in libxml2 has been reverted which caused
-  CVE-2018-8048 (loofah gem), CVE-2018-3740 (sanitize gem), and
-  CVE-2018-3741 (rails-html-sanitizer gem). The commit in question is
-  here:
-
-  https://github.com/GNOME/libxml2/commit/960f0e2
-
-  and more information is available about this commit and its impact
-  here:
-
-  https://github.com/flavorjones/loofah/issues/144
-
-  This release simply reverts the libxml2 commit in question to protect
-  users of Nokogiri's vendored libraries from similar vulnerabilities.
-
-  If you're offended by what happened here, I'd kindly ask that you
-  comment on the upstream bug report here:
-
-  https://bugzilla.gnome.org/show_bug.cgi?id=769760
-
-patched_versions:
-  - ">= 1.8.3"
-related:
-  cve:
-    - 2018-3740
-    - 2018-3741
-  url:
-    - https://github.com/GNOME/libxml2/commit/960f0e2
-    - https://bugzilla.gnome.org/show_bug.cgi?id=769760

data/data/ruby-advisory-db/gems/nokogiri/OSVDB-101179.yml

@@ -1,18 +0,0 @@
----
-gem: nokogiri
-platform: jruby
-cve: 2013-6460
-osvdb: 101179
-url: http://osvdb.org/show/osvdb/101179
-title: |
-  Nokogiri Gem for JRuby Crafted XML Document Handling Infinite Loop Remote DoS
-date: 2013-12-14
-description: |
-  Nokogiri Gem for JRuby contains a flaw that may allow a remote denial of
-  service. The issue is triggered when handling a specially crafted XML
-  document, which can result in an infinite loop. This may allow a
-  context-dependent attacker to crash the server.
-cvss_v2: 4.3
-patched_versions: 
-  - "~> 1.5.11"
-  - ">= 1.6.1"

data/data/ruby-advisory-db/gems/nokogiri/OSVDB-101458.yml

@@ -1,15 +0,0 @@
----
-gem: nokogiri
-cve: 2013-6461
-osvdb: 101458
-url: http://www.osvdb.org/show/osvdb/101458
-title: Nokogiri Gem for Ruby External Entity (XXE) Expansion Remote DoS 
-date: 2013-12-14
-description: Nokogiri gem for Ruby contains an flaw that is triggered during the parsing of XML data.
-  The issue is due to an incorrectly configured XML parser accepting XML external entities from
-  an untrusted source. By sending specially crafted XML data, a remote attacker can cause an infinite
-  loop and crash the program.
-cvss_v2:
-patched_versions: 
-  - ~> 1.5.11
-  - ">= 1.6.1"

data/data/ruby-advisory-db/gems/nokogiri/OSVDB-118481.yml

@@ -1,15 +0,0 @@
----
-gem: nokogiri
-platform: jruby
-osvdb: 118481
-url: https://github.com/sparklemotion/nokogiri/pull/1087
-title: |
-  Nokogiri Gem for JRuby XML Document Root Element Handling Memory Consumption
-  Remote DoS
-date: 2014-04-30
-description: |
-  Nokogiri Gem for JRuby contains a flaw that is triggered when handling a root
-  element in an XML document. This may allow a remote attacker to cause a
-  consumption of memory resources.
-patched_versions:
-  - ">= 1.6.3"

data/data/ruby-advisory-db/gems/nokogiri/OSVDB-90946.yml

@@ -1,15 +0,0 @@
----
-gem: nokogiri
-cve: 2012-6685
-osvdb: 90946
-url: http://www.osvdb.org/show/osvdb/90946
-title: Nokogiri Gem for Ruby External Entity (XXE) Expansion Internal Network Response Remote Disclosure
-date: 2012-06-08
-description: libxml2 contains a flaw that may lead to unauthorized disclosure of
- potentially sensitive information. The issue is triggered when handling the
- expansion of XML external entities (XXE), which can be used to trigger URL's
- on an internal network and allow a remote attacker to gain access to their
- responses.
-cvss_v2: 5.0
-patched_versions:
-  - ">= 1.5.4"

data/data/ruby-advisory-db/gems/nori/OSVDB-90196.yml

@@ -1,19 +0,0 @@
----
-gem: nori
-cve: 2013-0285
-osvdb: 90196
-url: http://osvdb.org/show/osvdb/90196
-title: Ruby Gem nori Parameter Parsing Remote Code Execution
-date: 2013-01-10
-
-description: |
-  The Ruby Gem nori has a parameter parsing error that may allow an attacker
-  to execute arbitrary code. This vulnerability has to do with type casting
-  during parsing, and is related to CVE-2013-0156.
-
-cvss_v2: 7.5
-
-patched_versions:
-  - ~> 1.0.3
-  - ~> 1.1.4
-  - ">= 2.0.2"

data/data/ruby-advisory-db/gems/omniauth-facebook/OSVDB-99693.yml

@@ -1,22 +0,0 @@
----
-gem: omniauth-facebook
-cve: 2013-4562
-osvdb: 99693
-url: http://www.osvdb.org/show/osvdb/99693
-title: omniauth-facebook Gem for Ruby Unspecified CSRF 
-date: 2013-11-12
-
-description: |
-  omniauth-facebook Gem for Ruby contains a flaw as HTTP requests do not
-  require multiple steps, explicit confirmation, or a unique token when
-  performing certain sensitive actions. By tricking a user into following
-  a specially crafted link, a context-dependent attacker can perform a
-  Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to
-  perform an unspecified action.
-
-cvss_v2: 6.8
-
-patched_versions:
-  - ">= 1.5.0"
-unaffected_versions:
-  - "<= 1.4.0"

data/data/ruby-advisory-db/gems/omniauth-facebook/OSVDB-99888.yml

@@ -1,17 +0,0 @@
----
-gem: omniauth-facebook
-cve: 2013-4593
-osvdb: 99888
-url: http://www.osvdb.org/show/osvdb/99888
-title: omniauth-facebook Gem for Ruby Insecure Access Token Handling Authentication Bypass 
-date: 2013-11-14
-
-description: |
-  omniauth-facebook Gem for Ruby contains a flaw that is due to the application
-  supporting passing the access token via the URL. This may allow a remote
-  attacker to bypass authentication and authenticate as another user.
-
-cvss_v2: 6.8
-
-patched_versions:
-  - ">= 1.5.1"

data/data/ruby-advisory-db/gems/omniauth-oauth2/OSVDB-90264.yml

@@ -1,16 +0,0 @@
----
-gem: omniauth-oauth2
-cve: 2012-6134
-osvdb: 90264
-url: http://www.osvdb.org/show/osvdb/90264
-title: Ruby on Rails omniauth-oauth2 Gem CSRF vulnerability
-date: 2012-09-08
-
-description: |
-  The omniauth-oauth2 Ruby Gem contains a flaw that allows an attacker to
-  inject values into a user's session through a CSRF attack.
-
-cvss_v2: 6.8
-
-patched_versions:
-  - ">= 1.1.1"

data/data/ruby-advisory-db/gems/omniauth/CVE-2017-18076.yml

@@ -1,18 +0,0 @@
----
-gem: omniauth
-cve: 2017-18076
-url: https://github.com/omniauth/omniauth/pull/867
-title: omniauth leaks authenticity token in callback params
-date: 2017-01-11
-
-description: |
-  In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.
-
-cvss_v2: 6.8
-
-patched_versions:
-  - ">= 1.3.2"
-
-related:
-  url:
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-18076

data/data/ruby-advisory-db/gems/open-uri-cached/OSVDB-121701.yml

@@ -1,13 +0,0 @@
----
-gem: open-uri-cached
-cve: 2015-3649
-osvdb: 121701
-url: http://seclists.org/oss-sec/2015/q2/373
-title: open-uri-cached Gem for Ruby Unsafe Temporary File Creation Local Privilege Escalation
-date: 2015-05-05
-description: |
-  open-uri-cached Gem for Ruby contains a flaw that is due to the
-  program creating temporary files in a predictable, unsafe manner when using
-  YAML. This may allow a local attacker to gain elevated privileges.
-cvss_v2:
-patched_versions:

data/data/ruby-advisory-db/gems/paperclip/CVE-2015-2963.yml

@@ -1,16 +0,0 @@
----
-gem: paperclip
-cve: 2015-2963
-url: https://robots.thoughtbot.com/paperclip-security-release
-title: |
-  Paperclip Gem for Ruby vulnerable to content type spoofing
-date: 2015-06-05
-description: |
-  There is an issue where if an HTML file is uploaded with a .html
-  extension, but the content type is listed as being `image/jpeg`, this
-  will bypass a validation checking for images. But it will also pass the
-  spoof check, because a file named .html and containing actual HTML
-  passes the spoof check.
-cvss_v2: 4.3
-patched_versions:
-  - ">= 4.2.2"

data/data/ruby-advisory-db/gems/paperclip/CVE-2017-0889.yml

@@ -1,23 +0,0 @@
----
-gem: paperclip
-cve: 2017-0889
-url: https://github.com/thoughtbot/paperclip/pull/2435
-date: 2018-01-23
-title: |
-  Paperclip ruby gem suffers from a Server-Side Request Forgery (SSRF) vulnerability
-  in the Paperclip::UriAdapter and Paperclip::HttpUrlProxyAdapter class.
-description: |
-  Paperclip gem provides multiple ways a file can be uploaded to a web server.
-  The vulnerability affects two of Paperclip’s IO adapters that accept URLs as
-  attachment data (UriAdapter and HttpUrlProxyAdapter). When these adapters are
-  used, Paperclip acts as a proxy and downloads the file from the website URI
-  that is passed in. The library does not perform any validation to protect
-  against Server Side Request Forgery (SSRF) exploits by default. This may allow
-  a remote attacker to access information about internal network resources.
-cvss_v2: 7.5
-patched_versions:
-  - ">= 5.2.0"
-related:
-  url:
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-0889
-    - https://github.com/thoughtbot/paperclip/commit/4ebedfbd11d20d03ed03a1274ed281eee62715d4

data/data/ruby-advisory-db/gems/paperclip/OSVDB-103151.yml

@@ -1,13 +0,0 @@
----
-gem: paperclip
-osvdb: 103151
-url: http://osvdb.org/show/osvdb/103151
-title: Paperclip Gem for Ruby contains a flaw
-date: 2014-01-31
-description: Paperclip Gem for Ruby contains a flaw that is due to the application failing to properly
-  validate the file extension, instead only validating the Content-Type header during file uploads.
-  This may allow a remote attacker to bypass restrictions on file types for uploaded files by
-  spoofing the content-type.
-cvss_v2:
-patched_versions:
-  - ">= 4.0.0"

data/data/ruby-advisory-db/gems/paratrooper-newrelic/OSVDB-101839.yml

@@ -1,13 +0,0 @@
----
-gem: paratrooper-newrelic
-cve: 2014-1234
-osvdb: 101839
-url: http://www.osvdb.org/show/osvdb/101839
-title: Paratrooper-newrelic Gem for Ruby Process Listing API Key Local Disclosure
-date: 2014-01-08
-description: |
-  Paratrooper-newrelic Gem for Ruby contains a flaw in
-  /lib/paratrooper-newrelic.rb. The issue is triggered when the script exposes
-  the API key, allowing a local attacker to gain access to it by monitoring the
-  process tree.
-cvss_v2: 2.1

data/data/ruby-advisory-db/gems/paratrooper-pingdom/OSVDB-101847.yml

@@ -1,13 +0,0 @@
----
-gem: paratrooper-pingdom
-cve: 2014-1233
-osvdb: 101847
-url: http://www.osvdb.org/show/osvdb/101847
-title: paratrooper-pingdom Gem for Ruby /lib/paratrooper-pingdom.rb API Login Credentials Local Disclosure
-date: 2013-12-26
-description: |
-  paratrooper-pingdom Gem for Ruby contains a flaw in
-  /lib/paratrooper-pingdom.rb. The issue is triggered when the script exposes
-  API login credentials, allowing a local attacker to gain access to the API
-  key, username, and password for the API login by monitoring the process tree.
-cvss_v2: 2.1

data/data/ruby-advisory-db/gems/passenger/CVE-2014-1831.yml

@@ -1,13 +0,0 @@
----
-gem: passenger
-cve: 2014-1831
-osvdb: 102613
-url: http://osvdb.org/show/osvdb/102613
-title: Phusion Passenger Server Instance Directory Creation Local Symlink File Overwrite
-date: 2014-01-28
-description: Phusion Passenger contains a flaw as the program creates the server instance
-  directory insecurely. It is possible for a local attacker to use a symlink attack against
-  the directory to cause the program to unexpectedly overwrite an arbitrary file.
-cvss_v2: 2.1
-patched_versions:
-  - ">= 4.0.37"

data/data/ruby-advisory-db/gems/passenger/CVE-2014-1832.yml

@@ -1,13 +0,0 @@
----
-gem: passenger
-cve: 2014-1832
-osvdb: 102613
-url: http://osvdb.org/show/osvdb/102613
-title: Phusion Passenger Server Instance Directory Creation Local Symlink File Overwrite
-date: 2014-01-29
-description: Phusion Passenger contains a flaw as the program creates the server instance
-  directory insecurely. It is possible for a local attacker to use a symlink attack against
-  the directory to cause the program to unexpectedly overwrite an arbitrary file.
-cvss_v2: 2.1
-patched_versions:
-  - ">= 4.0.38"

data/data/ruby-advisory-db/gems/passenger/CVE-2015-7519.yml

@@ -1,17 +0,0 @@
----
-gem: passenger
-cve: 2015-7519
-url: https://blog.phusion.nl/2015/12/07/cve-2015-7519/
-title: Phusion Passenger Server allows to overwrite headers in some cases
-date: 2015-11-23
-description: It is possible in some cases, for clients to overwrite headers
-  set by the server, resulting in a medium level security issue.
-  Passenger 5 uses an SCGI-inspired format to pass headers to Ruby/Python
-  applications, while Passenger 4 uses an SCGI-inspired format to pass
-  headers to all applications. This implies a conversion to
-  UPPER_CASE_WITH_UNDERSCORES whereby the difference between characters
-  like '-' and '_' is lost.
-
-patched_versions:
-  - "~> 4.0.60"
-  - ">= 5.0.22"

data/data/ruby-advisory-db/gems/passenger/CVE-2016-10345.yml

@@ -1,17 +0,0 @@
----
-gem: passenger
-cve: 2016-10345
-url: https://blog.phusion.nl/2017/01/10/passenger-5-1-1/
-title:  Predictable tmp File Path Vulnerability in Phusion Passenger
-date: 2016-11-09
-
-description: >-
-  In Phusion Passenger before 5.1.0, a known /tmp filename was used during
-  passenger-install-nginx-module execution, which could allow local attackers
-  to gain the privileges of the passenger user.
-
-cvss_v2: 4.6
-cvss_v3: 7.8
-
-patched_versions:
-  - ">= 5.1.0"

data/data/ruby-advisory-db/gems/passenger/OSVDB-90738.yml

@@ -1,16 +0,0 @@
----
-gem: passenger
-cve: 2012-6135
-osvdb: 90738
-url: http://old.blog.phusion.nl/2013/03/05/phusion-passenger-4-0-beta-1-and-2-arbitrary-file-deletion-vulnerability/
-title: Phusion Passenger Gem for Ruby Arbitrary File Deletion
-date: 2012-02-01
-description: Phusion Passenger Gem for Ruby contains a flaw that is triggered
-  during application startup. This issue may allow a local attacker to delete
-  arbitrary files via an application process. If the program has completed the
-  start up process this vulnerability is no longer exploitable.
-cvss_v2: 2.1
-patched_versions:
-  - ">= 4.0.0"
-unaffected_versions:
-  - "< 4.0.0"

data/data/ruby-advisory-db/gems/passenger/OSVDB-93752.yml

@@ -1,15 +0,0 @@
----
-gem: passenger
-cve: 2013-2119
-osvdb: 93752
-url: http://osvdb.org/show/osvdb/93752
-title: Phusion Passenger Gem for Ruby Predictable Temporary Filename Generation Symlink Local Privilege Escalation
-date: 2013-05-29
-description: Phusion Passenger Gem for Ruby contains a flaw as the program creates
-  temporary files insecurely. It is possible for a local attacker to use a symlink
-  attack against the Nginx config file to cause the program to unexpectedly overwrite
-  the file, allowing a local attacker to execute code with elevated privileges.
-cvss_v2: 4.6
-patched_versions:
-  - "~> 3.0.21"
-  - ">= 4.0.5"

data/data/ruby-advisory-db/gems/passenger/OSVDB-94074.yml

@@ -1,14 +0,0 @@
----
-gem: passenger
-cve: 2013-4136
-osvdb: 94074
-url: http://osvdb.org/show/osvdb/94074
-title: Phusion Passenger Gem for Ruby Utils.cpp Temporary Directory Creation Symlink Local Privilege Escalation
-date: 2013-06-10
-description: Phusion Passenger Gem for Ruby contains a flaw as the program creates
-  temporary directories insecurely. It is possible for a local attacker to use a
-  symlink attack against the Utils.cpp file to allow the attacker to gain elevated
-  privileges.
-cvss_v2: 4.6
-patched_versions:
-  - ">= 4.0.8"

data/data/ruby-advisory-db/gems/pdfkit/OSVDB-90867.yml

@@ -1,11 +0,0 @@
---- 
-gem: pdfkit
-cve: 2013-1607
-osvdb: 90867
-url: http://osvdb.org/show/osvdb/90867
-title: PDFKit Gem for Ruby PDF File Generation Parameter Handling Remote Code Execution
-date: 2013-02-21
-description: PDFKit Gem for Ruby contains a flaw that is due to the program failing to properly validate input during the handling of parameters when generating PDF files. This may allow a remote attacker to potentially execute arbitrary code via the pdfkit generation options.
-cvss_v2: 
-patched_versions: 
-  - ">= 0.5.3"

data/data/ruby-advisory-db/gems/point-cli/OSVDB-108577.yml

@@ -1,8 +0,0 @@
----
-gem: point-cli
-cve: 2014-4997
-osvdb: 108577
-url: http://osvdb.org/show/osvdb/108577
-title: point-cli Gem for Ruby /lib/commands/setup.rb Process Table Local Plaintext Credential Disclosure
-date: 2014-06-30
-description: point-cli Gem for Ruby contains a flaw in /lib/commands/setup.rb that is due to the application exposing credential information in plaintext in the process table. This may allow a local attacker to gain access to credential information.