bundler-budit 0.6.2 → 0.6.3

data/data/ruby-advisory-db/rubies/ruby/OSVDB-65556.yml

@@ -1,17 +0,0 @@
----
-engine: ruby
-cve: 2010-0541
-osvdb: 65556
-url: http://www.osvdb.org/show/osvdb/65556
-title: Apple Mac OS X Ruby WEBrick HTTP Server UTF-7 Error Page XSS
-date: 2010-06-15
-description: |
-  Cross-site scripting (XSS) vulnerability in the
-  WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows
-  remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers
-  a UTF-7 error page.
-cvss_v2: 4.3
-patched_versions:
-  - ~> 1.8.6.420
-  - ~> 1.8.7.302
-  - ">= 1.9.1.430"

data/data/ruby-advisory-db/rubies/ruby/OSVDB-66040.yml

@@ -1,17 +0,0 @@
----
-engine: ruby
-cve: 2010-2489
-osvdb: 66040
-url: http://www.osvdb.org/show/osvdb/66040
-title: Ruby on Windows ARGF.inplace_mode Variable Local Overflow
-date: 2010-07-02
-description: |
-  Buffer overflow in Ruby 1.9.x before 1.9.1-p429
-  on Windows might allow local users to gain privileges via a crafted ARGF.inplace_mode
-  value that is not properly handled when constructing the filenames of the backup
-  files.
-cvss_v2: 7.2
-patched_versions:
-  - ~> 1.8.7
-  - ~> 1.9.1.429
-  - ">= 1.9.2"

data/data/ruby-advisory-db/rubies/ruby/OSVDB-70957.yml

@@ -1,15 +0,0 @@
----
-engine: ruby
-cve: 2011-1005
-osvdb: 70957
-url: http://www.osvdb.org/show/osvdb/70957
-title: Ruby Exception#to_s Method Safe Level Security Bypass
-date: 2011-02-18
-description: |
-  Ruby contains a flaw related to the safe-level feature. The issue is
-  triggered when a context-dependent attacker exploits a flaw within the exception
-  '#to_s' handling. This may allow an attacker to bypass safe-level protection and
-  modify strings via the 'Exception#to_s' method.
-cvss_v2: 4.3
-patched_versions:
-  - ">= 1.8.7.334"

data/data/ruby-advisory-db/rubies/ruby/OSVDB-70958.yml

@@ -1,20 +0,0 @@
----
-engine: ruby
-cve: 2011-1004
-osvdb: 70958
-url: http://www.osvdb.org/show/osvdb/70958
-title: |
-  Ruby FileUtils.remove_entry_secure Method File Symlink Race Condition Arbitrary
-  File Deletion
-date: 2011-02-19
-description: |
-  Ruby contains a race condition flaw that may allow a malicious local user to
-  delete arbitrary files on the system. The issue is due to the
-  'FileUtils.remove_entry_secure' method creating temporary files insecurely.
-  It is possible for a local attacker to use a symlink attack to cause the
-  program to unexpectedly write to, or overwrite an attacker specified file.
-cvss_v2: 6.3
-patched_versions:
-  - ~> 1.8.7.334
-  - ~> 1.9.1.431
-  - ">= 1.9.2.180"

data/data/ruby-advisory-db/rubies/ruby/OSVDB-78118.yml

@@ -1,14 +0,0 @@
----
-engine: ruby
-cve: 2011-4815
-osvdb: 78118
-url: http://www.osvdb.org/show/osvdb/78118
-title: Ruby Hash Collision Form Parameter Parsing Remote DoS
-date: 2011-12-28
-description: |
-  Ruby contains a flaw that may allow a remote denial of service. The issue
-  is triggered when an attacker sends multiple crafted parameters which trigger hash
-  collisions, and will result in loss of availability for the program via CPU consumption.
-cvss_v2: 7.8
-patched_versions:
-  - ">= 1.8.7.357"

data/data/ruby-advisory-db/rubies/ruby/OSVDB-87280.yml

@@ -1,17 +0,0 @@
----
-engine: ruby
-cve: 2012-5371
-osvdb: 87280
-url: http://www.osvdb.org/show/osvdb/87280
-title: Ruby String Key Object Hashing Hash Collision Form Parameter Parsing Remote
-  DoS
-date: 2012-11-10
-description: |
-  Ruby contains a flaw that may allow a remote denial of service. The issue
-  is triggered when an error occurs during the parsing of the sequence to create a
-  hash object, by using string keys. This may result in a hash collision, causing
-  a denial of service in the program.
-cvss_v2: 5.0
-patched_versions:
-  - ~> 1.9.3.327
-  - ">= 2.0.0"

data/data/ruby-advisory-db/rubies/ruby/OSVDB-87863.yml

@@ -1,18 +0,0 @@
----
-engine: ruby
-cve: 2012-5371
-osvdb: 87863
-url: http://www.osvdb.org/show/osvdb/87863
-title: Ruby MurmurHash2 Implementation Hash Collision Remote DoS
-date: 2012-11-23
-description: |
-  Ruby contains a flaw related to the MurmurHash2 implementation that may allow
-  a remote denial of service. The issue is triggered when hash values are
-  computed without having the ability to cause hash collisions restricted. When
-  sending specially crafted input to an application maintaining a hash table, a
-  context-dependent attacker can cause a consumption of CPU resources. This
-  will result in a loss of availability for the program.
-cvss_v2: 5.0
-patched_versions:
-  - ~> 1.9.3.327
-  - ">= 2.0.0"

data/data/ruby-advisory-db/rubies/ruby/OSVDB-87917.yml

@@ -1,16 +0,0 @@
----
-engine: ruby
-cve: 2012-4522
-osvdb: 87917
-url: http://www.osvdb.org/show/osvdb/87917
-title: Ruby file.c rb_get_path_check Function NULL Byte File Path Request Arbitrary
-  File Creation
-date: 2012-10-12
-description: |
-  Ruby contains a flaw that is triggered by a NULL byte in the rb_get_path_check
-  function in file.c when handling a file path request. This may allow a context-dependent
-  attacker to create arbitrary files.
-cvss_v2: 5.0
-patched_versions:
-  - "~> 1.9.3.286"
-  - ">= 2.0.0"

data/data/ruby-advisory-db/rubies/ruby/OSVDB-90587.yml

@@ -1,16 +0,0 @@
----
-engine: ruby
-cve: 2013-1821
-osvdb: 90587
-url: http://www.osvdb.org/show/osvdb/90587
-title: Ruby REXML Library Crafted XML File Text Node Handling DoS
-date: 2013-02-22
-description: |
-  Ruby contains a flaw in the REXML library that may allow a denial of
-  service. The issue is triggered when handling a file text node in a specially crafted
-  XML file. This may allow a context-dependent attacker to cause a consumption of
-  memory resources and crash the program.
-cvss_v2: 5.0
-patched_versions:
-  - ~> 1.9.3.392
-  - ">= 2.0.0.0"

data/data/ruby-advisory-db/rubies/ruby/OSVDB-93414.yml

@@ -1,19 +0,0 @@
----
-engine: ruby
-cve: 2013-2065
-osvdb: 93414
-url: http://www.osvdb.org/show/osvdb/93414
-title: |
-  Ruby Multiple Module Object $SAFE Level Verification System Call Tainted
-  String Injection
-date: 2013-05-14
-description: |
-  Ruby contains a flaw that is triggered when the Fiddle and DL modules fail to
-  properly verify the $SAFE level when handling certain objects. This may allow
-  a remote attacker to inject tainted strings into a system call.
-cvss_v2: 6.4
-unaffected_versions:
-  - ~> 1.8.0
-patched_versions:
-  - ~> 1.9.3.426
-  - ">= 2.0.0.195"

data/data/ruby-advisory-db/rubies/ruby/OSVDB-94628.yml

@@ -1,21 +0,0 @@
----
-engine: ruby
-cve: 2013-4073
-osvdb: 94628
-url: http://www.osvdb.org/show/osvdb/94628
-title: Ruby SSL Client OpenSSL::SSL.verify_certificate_identity X.509 Certificate
-  subjectAltName Field NULL Byte Handling MitM Spoofing Weakness
-date: 2013-06-27
-description: |
-  Ruby SSL Client contains a flaw related to certificate validation in
-  OpenSSL::SSL.verify_certificate_identity. The issue is due to the program not properly
-  handling the subjectAltName field of the X.509 certificate when it contains NULL
-  bytes. This may allow an attacker with access to network traffic (e.g. MiTM, DNS
-  cache poisoning) to spoof the SSL server via an arbitrary certificate that appears
-  valid. Such an attack would allow for the interception of sensitive traffic, and
-  potentially allow for the injection of content into the SSL stream.
-cvss_v2: 6.8
-patched_versions:
-  - ~> 1.8.7.373
-  - ~> 1.9.3.447
-  - ">= 2.0.0.246"

data/data/ruby-advisory-db/scripts/post-advisories.sh

@@ -1,18 +0,0 @@
-#!/bin/bash
-
-set -o errexit -o nounset
-
-REPO="https://${GH_TOKEN}@github.com/rubysec/rubysec.github.io.git"
-DIR="_site"
-
-git clone $REPO $DIR
-
-cd $DIR
-
-git config user.name "RubySec CI"
-git config user.email "ci@rubysec.com"
-
-bundle install --jobs=3 --retry=3
-bundle exec rake advisories
-
-git push -q

data/data/ruby-advisory-db/spec/advisories_spec.rb

@@ -1,23 +0,0 @@
-load File.join(File.dirname(__FILE__), 'spec_helper.rb')
-require 'gem_example'
-require 'library_example'
-require 'ruby_example'
-
-describe "gems" do
-  Dir.glob(File.join(File.dirname(__FILE__), '../gems/*/*')) do |path|
-    include_examples 'Gem Advisory', path
-  end
-end
-
-describe "libraries" do
-  Dir.glob(File.join(File.dirname(__FILE__), '../libraries/*/*')) do |path|
-    include_examples 'Libraries Advisory', path
-  end
-end
-
-describe "rubies" do
-  Dir.glob(File.join(File.dirname(__FILE__), '../rubies/*/*')) do |path|
-    include_examples 'Rubies Advisory', path
-  end
-end
-

data/data/ruby-advisory-db/spec/advisory_example.rb

@@ -1,209 +0,0 @@
-load File.join(File.dirname(__FILE__), 'spec_helper.rb')
-require 'yaml'
-
-shared_examples_for 'Advisory' do |path|
-  advisory = YAML.load_file(path)
-
-  describe path do
-    let(:filename) { File.basename(path) }
-
-    let(:filename_cve) do
-      if filename.start_with?('CVE-')
-        filename.gsub('CVE-','')
-      end
-    end
-
-    let(:filename_osvdb) do
-      if filename.start_with?('OSVDB-')
-        filename.gsub('OSVDB-','')
-      end
-    end
-
-    it "should be correctly named CVE-XXX or OSVDB-XXX" do
-      expect(filename).
-        to match(/^(CVE-\d{4}-(0\d{3}|[1-9]\d{3,})|OSVDB-\d+)\.yml$/)
-    end
-
-    it "should have CVE or OSVDB" do
-      expect(advisory['cve'] || advisory['osvdb']).not_to be_nil
-    end
-
-    describe "framework" do
-      subject { advisory['framework'] }
-
-      it "may be nil or a String" do
-        expect(subject).to be_kind_of(String).or(be_nil)
-      end
-    end
-
-    describe "platform" do
-      subject { advisory['platform'] }
-
-      it "may be nil or a String" do
-        expect(subject).to be_kind_of(String).or(be_nil)
-      end
-    end
-
-    describe "cve" do
-      subject { advisory['cve'] }
-
-      it "may be nil or a String" do
-        expect(subject).to be_kind_of(String).or(be_nil)
-      end
-      it "should be id in filename if filename is CVE-XXX" do
-        if filename_cve
-          is_expected.to eq(filename_cve.chomp('.yml'))
-        end
-      end
-    end
-
-    describe "osvdb" do
-      subject { advisory['osvdb'] }
-
-      it "may be nil or a Integer" do
-        expect(subject).to be_kind_of(Integer).or(be_nil)
-      end
-
-       it "should be id in filename if filename is OSVDB-XXX" do
-        if filename_osvdb
-          is_expected.to eq(filename_osvdb.to_i)
-        end
-      end
-    end
-
-    describe "url" do
-      subject { advisory['url'] }
-
-      it { is_expected.to be_kind_of(String) }
-      it { is_expected.not_to be_empty }
-    end
-
-    describe "title" do
-      subject { advisory['title'] }
-
-      it { is_expected.to be_kind_of(String) }
-      it { is_expected.not_to be_empty }
-    end
-
-    describe "date" do
-      subject { advisory['date'] }
-
-      it { is_expected.to be_kind_of(Date) }
-    end
-
-    describe "description" do
-      subject { advisory['description'] }
-
-      it { is_expected.to be_kind_of(String) }
-      it { is_expected.not_to be_empty }
-    end
-
-    describe "cvss_v2" do
-      subject { advisory['cvss_v2'] }
-
-      it "may be nil or a Float" do
-        expect(subject).to be_kind_of(Float).or(be_nil)
-      end
-
-      case advisory['cvss_v2']
-      when Float
-        context "when a Float" do
-          it { expect((0.0)..(10.0)).to include(subject) }
-        end
-      end
-    end
-
-    describe "cvss_v3" do
-      subject { advisory['cvss_v3'] }
-
-      it "may be nil or a Float" do
-        expect(subject).to be_kind_of(Float).or(be_nil)
-      end
-
-      case advisory['cvss_v3']
-      when Float
-        context "when a Float" do
-          it { expect((0.0)..(10.0)).to include(subject) }
-        end
-      end
-
-      if advisory['cvss_v2']
-        it "should also provide a cvss_v2 score" do
-          expect(advisory['cvss_v2']).to_not be_nil
-        end
-      end
-    end
-
-    describe "patched_versions" do
-      subject { advisory['patched_versions'] }
-
-      it "may be nil or an Array" do
-        expect(subject).to be_kind_of(Array).or(be_nil)
-      end
-
-      describe "each patched version" do
-        if advisory['patched_versions']
-          advisory['patched_versions'].each do |version|
-            describe version do
-              subject { version.split(', ') }
-
-              it "should contain valid RubyGem version requirements" do
-                expect {
-                Gem::Requirement.new(*subject)
-                }.not_to raise_error
-              end
-            end
-          end
-        end
-      end
-    end
-
-    describe "unaffected_versions" do
-      subject { advisory['unaffected_versions'] }
-
-      it "may be nil or an Array" do
-        expect(subject).to be_kind_of(Array).or(be_nil)
-      end
-
-      case advisory['unaffected_versions']
-      when Array
-        advisory['unaffected_versions'].each do |version|
-          describe version do
-            subject { version.split(', ') }
-
-            it "should contain valid RubyGem version requirements" do
-              expect {
-                Gem::Requirement.new(*subject)
-              }.not_to raise_error
-            end
-          end
-        end
-      end
-    end
-
-    describe "related" do
-      subject { advisory['related'] }
-
-      it "may be nil or a Hash" do
-        expect(subject).to be_kind_of(Hash).or(be_nil)
-      end
-
-      case advisory["related"]
-      when Hash
-        advisory["related"].each_pair do |name, values|
-          describe name do
-            it "should be either a cve, an osvdb or a url" do
-              expect(["cve", "osvdb", "url"]).to include(name)
-            end
-
-            it "should always contain an array" do
-              expect(values).to be_kind_of(Array)
-            end
-          end
-        end
-      end
-    end
-
-
-  end
-end