bundler-budit 0.6.2 → 0.6.3

data/data/ruby-advisory-db/rubies/ruby/CVE-2008-3905.yml

@@ -1,17 +0,0 @@
----
-engine: ruby
-cve: 2008-3905
-url: https://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/
-title: ruby -- DNS spoofing vulnerability in resolv.rb
-date: 2008-05-05
-description: |
-  resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before
-  1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and
-  constant source ports for DNS requests, which makes it easier for remote
-  attackers to spoof DNS responses, a different vulnerability than
-  CVE-2008-1447. 
-cvss_v2: 5.8
-patched_versions:
-  - ~> 1.8.6.287
-  - ~> 1.8.7.72
-  - ">= 1.9.0"

data/data/ruby-advisory-db/rubies/ruby/CVE-2009-0642.yml

@@ -1,17 +0,0 @@
----
-engine: ruby
-cve: 2009-0642
-url: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513528
-title: Ruby 'OCSP_basic_verify()' X.509 Certificate Verification Vulnerability
-date: 2009-01-29
-description: |
-  ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the
-  return value from the OCSP_basic_verify function, which might allow remote
-  attackers to successfully present an invalid X.509 certificate, possibly
-  involving a revoked certificate.
-cvss_v2: 6.8
-patched_versions:
-  - ~> 1.8.6.369
-  - ~> 1.8.7.173
-  - ~> 1.9.1.129
-  - ">= 1.9.2.preview.1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2009-5147.yml

@@ -1,13 +0,0 @@
----
-engine: ruby
-cve: 2009-5147
-url: https://www.ruby-lang.org/en/news/2009/05/12/ruby-1-9-1-p129-released/
-title: Ruby DL::dlopen could open a library with tainted library name even if $SAFE > 0
-date: 2009-05-12
-description: |
-  DL::dlopen could open a library with tainted library name even if $SAFE > 0
-unaffected_versions:
-  - "< 1.9.1"
-  - ">= 1.9.2"
-patched_versions:
-  - ~> 1.9.1.129

data/data/ruby-advisory-db/rubies/ruby/CVE-2011-0188.yml

@@ -1,17 +0,0 @@
----
-engine: ruby
-cve: 2011-0188
-url: https://github.com/ruby/ruby/commit/f83651ac30c7c776dee8a6a401c654757cb8d1c2
-title: Ruby memory corruption in BigDecimal on 64bit platforms
-date: 2011-03-01
-description: |
-  The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby
-  1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other
-  platforms, does not properly allocate memory, which allows context-dependent
-  attackers to execute arbitrary code or cause a denial of service (application
-  crash) via vectors involving creation of a large BigDecimal value within a
-  64-bit process, related to an "integer truncation issue."
-cvss_v2: 6.8
-patched_versions:
-  - ~> 1.8.7.370
-  - ">= 1.9.3.preview.1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2011-2686.yml

@@ -1,17 +0,0 @@
----
-engine: ruby
-cve: 2011-2686
-url: https://osdir.com/ml/lang-ruby-core/2011-01/msg00917.html
-title: Ruby Random Number Generation Local Denial Of Service Vulnerability
-date: 2011-07-02
-description: |
-  Ruby before 1.8.7-p352 does not reset the random seed upon forking, which
-  makes it easier for context-dependent attackers to predict the values of
-  random numbers by leveraging knowledge of the number sequence obtained in a
-  different child process, a related issue to CVE-2003-0900. NOTE: this issue
-  exists because of a regression during Ruby 1.8.6 development.
-cvss_v2: 5.0
-unaffected_versions:
-  - "< 1.8.6.399"
-patched_versions:
-  - ">= 1.8.7.352"

data/data/ruby-advisory-db/rubies/ruby/CVE-2011-2705.yml

@@ -1,16 +0,0 @@
----
-engine: ruby
-cve: 2011-2705
-url: https://redmine.ruby-lang.org/issues/4579
-title: Ruby Random Number Generation Local Denial Of Service Vulnerability
-date: 2011-07-02
-description: |
-  The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before
-  1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for
-  initialization, which makes it easier for context-dependent attackers to
-  predict the result string by leveraging knowledge of random strings obtained
-  in an earlier process with the same PID. 
-cvss_v2: 5.0
-patched_versions:
-  - ~> 1.8.7.352
-  - ">= 1.9.2.290"

data/data/ruby-advisory-db/rubies/ruby/CVE-2011-3009.yml

@@ -1,17 +0,0 @@
----
-engine: ruby
-cve: 2011-3009
-url: https://osdir.com/ml/lang-ruby-core/2011-01/msg00917.html
-title: |
-  Ruby Properly initialize the random number generator when forking new process
-date: 2011-07-02
-description: |
-  Ruby before 1.8.6-p114 does not reset the random seed upon forking, which
-  makes it easier for context-dependent attackers to predict the values of
-  random numbers by leveraging knowledge of the number sequence obtained in a
-  different child process, a related issue to CVE-2003-0900. 
-cvss_v2: 5.0
-unaffected_versions:
-  - ">= 1.9.2"
-patched_versions:
-  - ">= 1.8.6.114"

data/data/ruby-advisory-db/rubies/ruby/CVE-2011-3389.yml

@@ -1,18 +0,0 @@
----
-engine: ruby
-cve: 2011-3389
-osvdb: 74829
-url: http://www.osvdb.org/show/osvdb/74829
-title: SSL Chained Initialization Vector CBC Mode MiTM Weakness (BEAST)
-date: 2011-08-31
-description: |
-  The SSL protocol, as used in certain configurations
-  in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome,
-  Opera, and other products, encrypts data by using CBC mode with chained initialization
-  vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers
-  via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction
-  with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection
-  API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.
-cvss_v2: 10.0
-patched_versions:
-  - ">= 1.8.7.358"

data/data/ruby-advisory-db/rubies/ruby/CVE-2012-4464.yml

@@ -1,17 +0,0 @@
----
-engine: ruby
-cve: 2012-4464
-url: https://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/
-title: Ruby Exception#to_s / NameError#to_s Methods Safe Level Security Bypass
-date: 2012-10-12
-description: |
-  Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows
-  context-dependent attackers to bypass safe-level restrictions and modify
-  untainted strings via the (1) exc_to_s or (2) name_err_to_s API function,
-  which marks the string as tainted, a different vulnerability than
-  CVE-2012-4466. NOTE: this issue might exist because of a CVE-2011-1005
-  regression.
-cvss_v2: 5.0
-patched_versions:
-  - ~> 1.8.7.371
-  - ">= 1.9.3.286"

data/data/ruby-advisory-db/rubies/ruby/CVE-2012-4466.yml

@@ -1,16 +0,0 @@
----
-engine: ruby
-cve: 2012-4466
-url: https://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/
-title: Ruby name_err_mesg_to_str Method Safe Level Security Bypass
-date: 2012-10-12
-description: |
-  Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before
-  revision r37068 allows context-dependent attackers to bypass safe-level
-  restrictions and modify untainted strings via the name_err_mesg_to_str API
-  function, which marks the string as tainted, a different vulnerability than
-  CVE-2011-1005. 
-cvss_v2: 5.0
-patched_versions:
-  - ~> 1.8.7.371
-  - ">= 1.9.3.286"

data/data/ruby-advisory-db/rubies/ruby/CVE-2012-4481.yml

@@ -1,15 +0,0 @@
----
-engine: ruby
-cve: 2012-4481
-url: http://www.openwall.com/lists/oss-security/2012/10/05/2
-title: |
-  Ruby incomplete fix for CVE-2011-1005 for NameError#to_s method when used on
-  objects
-date: 2012-10-05
-description: |
-  The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to
-  modify strings via the NameError#to_s method when operating on Ruby objects.
-  NOTE: this issue is due to an incomplete fix for CVE-2011-1005. 
-cvss_v2: 4.3
-patched_versions:
-  - ">= 1.8.7.371"

data/data/ruby-advisory-db/rubies/ruby/CVE-2015-1855.yml

@@ -1,17 +0,0 @@
----
-engine: ruby
-cve: 2015-1855
-url: https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/
-title: Ruby OpenSSL Hostname Verification
-date: 2015-04-13
-description: |
-  After reviewing RFC 6125 and RFC 5280, we found multiple violations of matching
-  hostnames and particularly wildcard certificates.
-  Ruby’s OpenSSL extension will now provide a string-based matching algorithm which
-  follows more strict behavior, as recommended by these RFCs. In particular,
-  matching of more than one wildcard per subject/SAN is no-longer allowed. As well,
-  comparison of these values is now case-insensitive.
-patched_versions:
-  - ~> 2.0.0.645
-  - ~> 2.1.6
-  - ">= 2.2.2"

data/data/ruby-advisory-db/rubies/ruby/CVE-2015-7551.yml

@@ -1,19 +0,0 @@
----
-engine: ruby
-cve: 2015-7551
-url: https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/
-title: Unsafe tainted string usage in Fiddle and DL
-date: 2015-12-16
-description: |
-  There is an unsafe tainted string vulnerability in Fiddle and DL. This issue was
-  originally reported and fixed with CVE-2009-5147 in DL, but reappeared after DL
-  was reimplemented using Fiddle and libffi.
-  And, about DL, CVE-2009-5147 was fixed at Ruby 1.9.1, but not fixed at other
-  branches, then rubies which bundled DL except Ruby 1.9.1 are still vulnerable.
-patched_versions:
-  - ~> 2.0.0.648
-  - ~> 2.1.8
-  - ~> 2.2.4
-  - ">= 2.3.0"
-unaffected_versions:
-  - ~> 1.9.1.129

data/data/ruby-advisory-db/rubies/ruby/CVE-2015-9096.yml

@@ -1,20 +0,0 @@
----
-engine: ruby
-cve: 2015-9096
-url: https://hackerone.com/reports/137631
-title: SMTP command injection
-date: 2015-12-09
-description: |
-  Net::SMTP is vulnerable to SMTP command injection via CRLF sequences
-  in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences
-  immediately before and after a DATA substring.
-
-  Applications that validate email address format are not affected by this
-  vulnerability.
-
-  The injection attack is described in Terada, Takeshi. "SMTP Injection via
-  Recipient Email Addresses." 2015. The attacks described in the paper
-  (Terada, p. 4) can be applied to without any modification.
-patched_versions:
-  - ">= 2.4.0"
-  - "~> 2.3.5"

data/data/ruby-advisory-db/rubies/ruby/CVE-2017-0898.yml

@@ -1,19 +0,0 @@
----
-engine: ruby
-cve: 2017-0898
-url: https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/
-title: Buffer underrun vulnerability in Kernel.sprintf
-date: 2017-09-14
-description: |
-  There is a buffer underrun vulnerability in the sprintf method of Kernel module.
-
-  If a malicious format string which contains a precious specifier (*) is
-  passed and a huge minus value is also passed to the specifier, buffer
-  underrun may be caused. In such situation, the result may contains heap, or
-  the Ruby interpreter may crash.
-
-  All users running an affected release should upgrade immediately.
-patched_versions:
-  - "~> 2.2.8"
-  - "~> 2.3.5"
-  - ">= 2.4.2"

data/data/ruby-advisory-db/rubies/ruby/CVE-2017-10784.yml

@@ -1,25 +0,0 @@
----
-engine: ruby
-cve: 2017-10784
-url: https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/
-title: Escape sequence injection vulnerability in the Basic authentication of WEBrick
-date: 2017-09-14
-description: |
-  There is an escape sequence injection vulnerability in the Basic
-  authentication of WEBrick bundled by Ruby.
-
-
-  When using the Basic authentication of WEBrick, clients can pass an
-  arbitrary string as the user name. WEBrick outputs the passed user name
-  intact to its log, then an attacker can inject malicious escape sequences to
-  the log and dangerous control characters may be executed on a victim’s
-  terminal emulator.
-
-  This vulnerability is similar to a vulnerability already fixed, but it had
-  not been fixed in the Basic authentication.
-
-  All users running an affected release should upgrade immediately.
-patched_versions:
-  - "~> 2.2.8"
-  - "~> 2.3.5"
-  - ">= 2.4.2"

data/data/ruby-advisory-db/rubies/ruby/CVE-2017-14033.yml

@@ -1,22 +0,0 @@
----
-engine: ruby
-cve: 2017-14033
-url: https://www.ruby-lang.org/en/news/2017/09/14/openssl-asn1-buffer-underrun-cve-2017-14033/
-title: Buffer underrun vulnerability in OpenSSL ASN1 decode
-date: 2017-09-14
-description: |
-  There is a buffer underrun vulnerability in OpenSSL bundled by Ruby.
-
-  If a malicious string is passed to the decode method of OpenSSL::ASN1,
-  buffer underrun may be caused and the Ruby interpreter may crash.
-  All users running an affected release should either upgrade or use one of
-  the workarounds immediately.
-
-  The OpenSSL library is also distributed as a gem. If you can’t upgrade Ruby
-  itself, install OpenSSL gem newer than version 2.0.0. But this workaround is
-  only available with Ruby 2.4 series. When using Ruby 2.2 series or 2.3
-  series, the gem does not override the bundled version of OpenSSL.
-patched_versions:
-  - "~> 2.2.8"
-  - "~> 2.3.5"
-  - ">= 2.4.2"

data/data/ruby-advisory-db/rubies/ruby/CVE-2017-14064.yml

@@ -1,20 +0,0 @@
----
-engine: ruby
-cve: 2017-14064
-url: https://www.ruby-lang.org/en/news/2017/09/14/json-heap-exposure-cve-2017-14064/
-title: Heap exposure vulnerability in generating JSON
-date: 2017-09-14
-description: |
-  There is a heap exposure vulnerability in JSON bundled by Ruby.
-
-  The generate method of JSON module optionally accepts an instance of
-  JSON::Ext::Generator::State class. If a malicious instance is passed, the
-  result may include contents of heap.  All users running an affected release
-  should either upgrade or use one of the workarounds immediately.
-
-  The JSON library is also distributed as a gem. If you can’t upgrade Ruby
-  itself, install JSON gem newer than version 2.0.4.
-patched_versions:
-  - "~> 2.2.8"
-  - "~> 2.3.5"
-  - ">= 2.4.2"

data/data/ruby-advisory-db/rubies/ruby/CVE-2017-17405.yml

@@ -1,22 +0,0 @@
----
-engine: ruby
-cve: 2017-17405
-url: https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/
-title: Command injection vulnerability in Net::FTP
-date: 2017-12-14
-description: |
-  There is a command injection vulnerability in Net::FTP bundled with Ruby.
-
-  `Net::FTP#get`, `getbinaryfile`, `gettextfile`, `put`, `putbinaryfile`, and
-  `puttextfile` use `Kernel#open` to open a local file. If the `localfile`
-  argument starts with the pipe character `"|"`, the command following the
-  pipe character is executed. The default value of `localfile` is
-  `File.basename(remotefile)`, so malicious FTP servers could cause arbitrary
-  command execution.
-
-  All users running an affected release should upgrade immediately.
-patched_versions:
-  - "~> 2.2.9"
-  - "~> 2.3.6"
-  - "~> 2.4.3"
-  - "> 2.5.0.preview.1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2017-17742.yml

@@ -1,22 +0,0 @@
----
-engine: ruby
-cve: 2017-17742
-url: https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/
-title: HTTP response splitting in WEBrick
-date: 2018-03-28
-description: |
-  There is an HTTP response splitting vulnerability in WEBrick bundled with Ruby.
-
-  If a script accepts an external input and outputs it without modification as
-  a part of HTTP responses, an attacker can use newline characters to deceive
-  the clients that the HTTP response header is stopped at there, and can inject
-  fake HTTP responses after the newline characters to show malicious contents
-  to the clients.
-
-  All users running an affected release should upgrade immediately.
-patched_versions:
-  - "~> 2.2.10"
-  - "~> 2.3.7"
-  - "~> 2.4.4"
-  - "~> 2.5.1"
-  - "> 2.6.0-preview1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2018-16395.yml

@@ -1,36 +0,0 @@
----
-engine: ruby
-cve: 2018-16395
-url: https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/
-title: Incorrect equality check in OpenSSL::X509::Name
-date: 2018-10-17
-description: |
-  The equality check of `OpenSSL::X509::Name` is not correctly in openssl
-  extension library bundled with Ruby.
-
-  An instance of `OpenSSL::X509::Name` contains entities such as `CN`, `C`
-  and so on. Some two instances of `OpenSSL::X509::Name` are equal only when
-  all entities are exactly equal. However, there is a bug that the equality
-  check is not correct if the value of an entity of the argument (right-hand
-  side) starts with the value of the receiver (left-hand side). So, if a
-  malicious X.509 certificate is passed to compare with an existing
-  certificate, there is a possibility to be judged incorrectly that they are
-  equal.
-
-  It is strongly recommended for Ruby users to upgrade your Ruby installation
-  or take one of the following workarounds as soon as possible.
-
-  `openssl` gem 2.1.2 or later includes the fix for the vulnerability, so
-  upgrade `openssl` gem to the latest version if you are using Ruby 2.4 or
-  later series.
-
-  `gem install openssl -v ">= 2.1.2"`
-  
-  However, in Ruby 2.3 series, you cannot override bundled version of openssl
-  with `openssl` gem. Please upgrade your Ruby installation to the latest
-  version.
-patched_versions:
-  - "~> 2.3.8"
-  - "~> 2.4.5"
-  - "~> 2.5.2"
-  - "~> 2.6.0-preview3"

data/data/ruby-advisory-db/rubies/ruby/CVE-2018-16396.yml

@@ -1,26 +0,0 @@
----
-engine: ruby
-cve: 2018-16396
-url: https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/
-title: Tainted flags not always propogated in Array#pack and String#unpack
-date: 2018-10-17
-description: |
-  In `Array#pack` and `String#unpack` with some formats, the tainted flags of
-  the original data are not propagated to the returned string/array.
-
-  `Array#pack` method converts the receiver’s contents into a string with
-  specified format. If the receiver contains some tainted objects, the
-  returned string also should be tainted. `String#unpack` method which
-  converts the receiver into an array also should propagate its tainted flag
-  to the objects contained in the returned array. But, with `B`, `b`, `H` and
-  `h` directives, the tainted flags are not propagated. So, if a script
-  processes unreliable inputs by `Array#pack` and/or `String#unpack` with these
-  directives and checks the reliability with tainted flags, the check might be
-  wrong.
-
-  All users running an affected release should upgrade immediately.
-patched_versions:
-  - "~> 2.3.8"
-  - "~> 2.4.5"
-  - "~> 2.5.2"
-  - "~> 2.6.0-preview3"