bundler-budit 0.6.2 → 0.6.3

data/data/ruby-advisory-db/gems/bcrypt/OSVDB-62067.yml

@@ -1,17 +0,0 @@
----
-gem: bcrypt
-platform: jruby
-osvdb: 62067
-url: http://www.mindrot.org/files/jBCrypt/internat.adv
-title: bcrypt-ruby Gem for Ruby incorrect encoding of non US-ASCII characters (JRuby only)
-date: 2010-02-01
-description: |
-  bcrypt-ruby Gem for Ruby suffered from a bug related to character
-  encoding that substantially reduced the entropy of hashed passwords
-  containing non US-ASCII characters. An incorrect encoding step
-  transparently replaced such characters by '?' prior to hashing. In the
-  worst case of a password consisting solely of non-US-ASCII characters,
-  this would cause its hash to be equivalent to all other such passwords
-  of the same length. This issue only affects the JRuby implementation.
-patched_versions:
-  - ">= 2.1.4"

data/data/ruby-advisory-db/gems/bio-basespace-sdk/OSVDB-101031.yml

@@ -1,8 +0,0 @@
----
-gem: bio-basespace-sdk
-cve: 2013-7111
-osvdb: 101031
-url: http://osvdb.org/show/osvdb/101031
-title: Bio Basespace SDK Gem for Ruby Command Line API Key Disclosure
-date: 2013-12-14
-description: Bio Basespace SDK Gem for Ruby contains a flaw that is due to the API client code passing the API_KEY to a curl command. This may allow a local attacker to gain access to API key information by monitoring the process table.

data/data/ruby-advisory-db/gems/brbackup/OSVDB-108899.yml

@@ -1,12 +0,0 @@
----
-gem: brbackup
-osvdb: 108899
-url: http://osvdb.org/show/osvdb/108899
-title: brbackup Gem for Ruby /lib/brbackup.rb name Parameter SQL Injection
-date: 2014-07-09
-description: |
-  brbackup Gem for Ruby contains a flaw that may allow carrying out an SQL
-  injection attack. The issue is due to the /lib/brbackup.rb script not
-  properly sanitizing user-supplied input to the 'name' parameter. This may
-  allow a remote attacker to inject or manipulate SQL queries in the back-end
-  database, allowing for the manipulation or disclosure of arbitrary data.

data/data/ruby-advisory-db/gems/brbackup/OSVDB-108900.yml

@@ -1,11 +0,0 @@
----
-gem: brbackup
-osvdb: 108900
-url: http://osvdb.org/show/osvdb/108900
-title: brbackup Gem for Ruby dbuser Variable Shell Metacharacter Injection Remote Command Execution
-date: 2014-07-09
-description: |
-  brbackup Gem for Ruby contains a flaw that is triggered as input passed
-  via the 'dbuser' variable is not properly sanitized. This may allow a
-  remote attacker to inject shell metacharacters and execute arbitrary
-  commands.

data/data/ruby-advisory-db/gems/brbackup/OSVDB-108901.yml

@@ -1,11 +0,0 @@
----
-gem: brbackup
-cve: 2014-5004
-osvdb: 108901
-url: http://osvdb.org/show/osvdb/108901
-title: brbackup Gem for Ruby Process List Local Plaintext Password Disclosure
-date: 2014-07-09
-description: |
-  brbackup Gem for Ruby contains a flaw that is due to the program exposing
-  password information in plaintext in the process list. This may allow a
-  local attacker to gain access to password information.

data/data/ruby-advisory-db/gems/bson/CVE-2015-4412.yml

@@ -1,18 +0,0 @@
----
-gem: bson
-cve: 2015-4412
-url: http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html
-title: Data Injection Vulnerability in bson Rubygem
-date: 2015-06-04
-
-description: >-
-  A flaw in the ObjectId validation regular expression can enable attackers to inject arbitrary information into a given BSON object.
-
-patched_versions:
-  - "~> 1.12.3"
-  - ">= 3.0.4"
-
-related:
-  url:
-    - https://github.com/mongodb/mongo-ruby-driver/compare/6ae981167759d5819ba3d41e374e5b2af5b79077~1...9859a3ab9773a8a883eb8438b665a921cc991c71
-    - https://github.com/mongodb/bson-ruby/compare/7446d7c6764dfda8dc4480ce16d5c023e74be5ca...28f34978a85b689a4480b4d343389bf4886522e7

data/data/ruby-advisory-db/gems/builder/OSVDB-95668.yml

@@ -1,13 +0,0 @@
----
-gem: builder
-osvdb: 95668
-url: http://osvdb.org/show/osvdb/95668
-title: Builder Gem for Ruby Tag Name Handling Private Method Exposure
-date: 2007-06-15
-description: |
-  Builder Gem for Ruby contains a flaw in the handling of tag names. The issue
-  is triggered when the program reads tag names from XML data and then calls a
-  method with that name. With a specially crafted file, a context-dependent
-  attacker can call private methods and manipulate data.
-patched_versions:
-  - ">= 2.1.2"

data/data/ruby-advisory-db/gems/bundler/OSVDB-110004.yml

@@ -1,15 +0,0 @@
----
-gem: bundler
-cve: 2013-0334
-osvdb: 110004
-url: http://www.osvdb.org/show/osvdb/110004
-title: Bundler Gem for Ruby Multiple Top-level Source Lines Gemfile Handling Gem Installation Spoofing
-date: 2014-08-13
-description: |
-  Bundler Gem for Ruby contains a flaw that is triggered when handling
-  a gemfile that contains multiple top-level source lines. This may allow a
-  context-dependent attacker to install specially crafted gems on a remote
-  system, leading to arbitrary code execution.
-cvss_v2: 5.0
-patched_versions:
-  - ">= 1.7.0"

data/data/ruby-advisory-db/gems/bundler/OSVDB-115090.yml

@@ -1,13 +0,0 @@
----
-gem: bundler
-osvdb: 115090
-url: http://www.osvdb.org/show/osvdb/115090
-title: Bundler Gem for Ruby Missing SSL Certificate Validation MitM Spoofing 
-date: 2013-02-12
-description: |
-  Bundler Gem for Ruby contains a flaw as SSL certificates are not properly
-  validated. By spoofing the SSL server via a certificate that appears valid,
-  an attacker with the ability to intercept network traffic (e.g. MiTM, DNS
-  cache poisoning) can disclose and optionally manipulate transmitted data. 
-patched_versions:
-  - ">= 1.3.0.pre.8"

data/data/ruby-advisory-db/gems/bundler/OSVDB-115091.yml

@@ -1,12 +0,0 @@
----
-gem: bundler
-osvdb: 115091
-url: http://www.osvdb.org/show/osvdb/115091
-title: Bundler Gem for Ruby Redirection Remote HTTP Basic Authentication Credential Disclosure
-date: 2013-02-12
-description: |
-   Bundler Gem for Ruby contains a flaw that is triggered during the
-   redirection to other hosts. This may allow a remote attacker to gain access
-   to HTTP basic authentication credential information.
-patched_versions:
-  - ">= 1.3.0.pre.8"

data/data/ruby-advisory-db/gems/bundler/OSVDB-115917.yml

@@ -1,12 +0,0 @@
----
-gem: bundler
-osvdb: 115917
-url: http://www.osvdb.org/show/osvdb/115917
-title: Bundler Gem for Ruby install Command Process Listing Local Plaintext Credential Disclosure
-date: 2011-09-20
-description: |
-  Bundler Gem for Ruby contains a flaw that is due to the program listing
-  credential information in plaintext in the install command process listing.
-  This may allow a local attacker to gain access to credential information.
-patched_versions:
-  - ">= 1.1.rc"

data/data/ruby-advisory-db/gems/cap-strap/OSVDB-108574.yml

@@ -1,8 +0,0 @@
----
-gem: cap-strap
-cve: 2014-4992
-osvdb: 108574
-url: http://osvdb.org/show/osvdb/108574
-title: cap-strap Gem for Ruby Process Table Local Plaintext Credential Disclosure
-date: 2014-06-30
-description: cap-strap Gem for Ruby contains a flaw that is due to the application exposing credential information in plaintext in the process table listing. This may allow a local attacker to gain access to credential information.

data/data/ruby-advisory-db/gems/cap-strap/OSVDB-108575.yml

@@ -1,7 +0,0 @@
----
-gem: cap-strap
-osvdb: 108575
-url: http://osvdb.org/show/osvdb/108575
-title: cap-strap Gem for Ruby Hardcoded Password Crypt Hash Salt Weakness
-date: 2014-06-30
-description: cap-strap Gem for Ruby contains a flaw that is due to the application using a hardcoded default 'sa' salt for password encryption. This may allow a local attacker to more easily decrypt passwords.

data/data/ruby-advisory-db/gems/ciborg/OSVDB-108586.yml

@@ -1,8 +0,0 @@
----
-gem: ciborg
-cve: 2014-5003
-osvdb: 108586
-url: http://osvdb.org/show/osvdb/108586
-title: ciborg Gem for Ruby default.rb /tmp/perlbrew-installer Local Symlink File Overwrite
-date: 2014-06-30
-description: ciborg Gem for Ruby contains a flaw as default.rb creates temporary files insecurely. It is possible for a local attacker to use a symlink attack against the /tmp/perlbrew-installer file to cause the program to unexpectedly overwrite an arbitrary file.

data/data/ruby-advisory-db/gems/cocaine/OSVDB-98835.yml

@@ -1,15 +0,0 @@
----
-gem: cocaine
-cve: 2013-4457
-osvdb: 98835
-url: http://www.osvdb.org/show/osvdb/98835
-title: Cocaine Gem for Ruby contains a flaw
-date: 2013-10-22
-description: Cocaine Gem for Ruby contains a flaw that is due to the method
-  of variable interpolation used by the program. With a specially crafted
-  object, a context-dependent attacker can execute arbitrary commands.
-cvss_v2: 6.8
-unaffected_versions:
-  - < 0.4.0
-patched_versions: 
-  - '>= 0.5.3'

data/data/ruby-advisory-db/gems/codders-dataset/OSVDB-108582.yml

@@ -1,8 +0,0 @@
----
-gem: codders-dataset
-cve: 2014-4991
-osvdb: 108582
-url: http://osvdb.org/show/osvdb/108582
-title: codders-dataset Gem for Ruby /lib/dataset/database/postgresql.rb Process Table Local Plaintext Credential Disclosure
-date: 2014-06-30
-description: codders-dataset Gem for Ruby contains a flaw in /lib/dataset/database/postgresql.rb that is due to the application exposing credential information in plaintext in the process table. This may allow a local attacker to gain access to credential information.

data/data/ruby-advisory-db/gems/codders-dataset/OSVDB-108583.yml

@@ -1,8 +0,0 @@
----
-gem: codders-dataset
-cve: 2014-4991
-osvdb: 108583
-url: http://osvdb.org/show/osvdb/108583
-title: codders-dataset Gem for Ruby /lib/dataset/database/mysql.rb Process Table Local Plaintext Credential Disclosure
-date: 2014-06-30
-description: codders-dataset Gem for Ruby contains a flaw in /lib/dataset/database/mysql.rb that is due to the application exposing credential information in plaintext in the process table. This may allow a local attacker to gain access to credential information.

data/data/ruby-advisory-db/gems/colorscore/CVE-2015-7541.yml

@@ -1,21 +0,0 @@
----
-gem: colorscore
-cve: 2015-7541
-osvdb: 132516
-url: http://seclists.org/oss-sec/2016/q1/17
-title: colorscore Gem for Ruby lib/colorscore/histogram.rb Arbitrary Command Injection
-date: 2016-01-04
-description: |
-  The contents of the `image_path`, `colors`, and `depth` variables generated
-  from possibly user-supplied input are passed directly to the shell via
-  `convert ...`.
-
-  If a user supplies a value that includes shell metacharacters such as ';', an
-  attacker may be able to execute shell commands on the remote system as the
-  user id of the Ruby process.
-
-  To resolve this issue, the aforementioned variables (especially `image_path`)
-  must be sanitized for shell metacharacters.
-
-patched_versions: 
-  - '>= 0.0.5'

data/data/ruby-advisory-db/gems/command_wrap/OSVDB-91450.yml

@@ -1,9 +0,0 @@
---- 
-gem: command_wrap
-cve: 2013-1875
-osvdb: 91450
-url: http://osvdb.org/show/osvdb/91450
-title: command_wrap Gem for Ruby URI Handling Arbitrary Command Injection
-date: 2013-03-18
-description: command_wrap Gem for Ruby contains a flaw that is triggered during the handling of input passed via the URL that contains a semicolon character (;). This will allow a remote attacker to inject arbitrary commands and have them executed in the context of the user clicking it.
-cvss_v2: 7.5

data/data/ruby-advisory-db/gems/crack/OSVDB-90742.yml

@@ -1,17 +0,0 @@
----
-gem: crack
-cve: 2013-1800
-osvdb: 90742
-url: http://osvdb.org/show/osvdb/90742
-title: crack Gem for Ruby Type Casting Parameter Parsing Remote Code Execution 
-description: |
-  crack Gem for Ruby contains a flaw that is triggered when a type casting
-  error occurs during the parsing of parameters. This may allow a
-  context-dependent attacker to potentially execute arbitrary code.
-date: 2013-01-09
-
-cvss_v2: 7.5
-
-patched_versions:
-  - ">= 0.3.2"
-

data/data/ruby-advisory-db/gems/cremefraiche/OSVDB-93395.yml

@@ -1,11 +0,0 @@
----
-gem: cremefraiche
-cve: 2013-2090
-osvdb: 93395
-url: http://osvdb.org/show/osvdb/93395
-title: Creme Fraiche Gem for Ruby File Name Shell Metacharacter Injection Arbitrary Command Execution
-date: 2013-05-14
-description: Creme Fraiche Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input in file names. With a specially crafted file name that contains shell metacharacters, a context-dependent attacker can execute arbitrary commands
-cvss_v2: 9.3
-patched_versions:
-  - ">= 0.6.1"

data/data/ruby-advisory-db/gems/curb/OSVDB-114600.yml

@@ -1,12 +0,0 @@
----
-gem: curb
-osvdb: 114600
-url: http://osvdb.org/show/osvdb/114600
-title: curb Gem for Ruby Empty http_put Body Handling Remote DoS
-date: 2010-08-12
-description: |
-  curb Gem for Ruby contains a flaw that is triggered when handling an empty
-  http_put body. This may allow a remote attacker to crash an application
-  linked against the library.
-patched_versions:
-  - ">= 0.7.8"

data/data/ruby-advisory-db/gems/curl/OSVDB-91230.yml

@@ -1,13 +0,0 @@
----
-gem: curl
-cve: 2013-2617
-osvdb: 91230
-url: http://osvdb.org/show/osvdb/91230
-title: Curl Gem for Ruby URI Handling Arbitrary Command Injection
-date: 2013-03-12
-description: Curl Gem for Ruby contains a flaw that is triggered during the
-  handling of specially crafted input passed via the URL.  This may allow
-  a context-dependent attacker to potentially execute arbitrary commands by
-  injecting them via a semi-colon (;).
-cvss_v2: 7.5
-patched_versions:

data/data/ruby-advisory-db/gems/devise-two-factor/CVE-2015-7225.yml

@@ -1,22 +0,0 @@
----
-gem: devise-two-factor
-cve: 2015-7225
-url: http://www.openwall.com/lists/oss-security/2015/09/06/2
-title: |
-  devise-two-factor 1.1.0 and earlier vulnerable to replay attacks
-date: 2015-09-17
-description: |
-  A OTP replay vulnerability in devise-two-factor 1.1.0 and earlier allows local
-  attackers to shoulder-surf a user's TOTP verification code and use it to
-  login after the user has authenticated. 
-
-  By not "burning" a previously used TOTP, devise-two-factor allows a narrow
-  window of opportunity (aka the timestep period) where an attacker can re-use a
-  verification code. 
-  
-  Should an attacker possess a given user's authentication 
-  credentials, this flaw effectively defeats two-factor authentication for the 
-  duration of the timestep. 
-
-patched_versions:
-  - ">= 2.0.0"

data/data/ruby-advisory-db/gems/devise/CVE-2015-8314.yml

@@ -1,14 +0,0 @@
----
-gem: devise
-cve: 2015-8314
-url: http://blog.plataformatec.com.br/2016/01/improve-remember-me-cookie-expiration-in-devise/
-title: Devise Gem for Ruby Unauthorized Access Using Remember Me Cookie
-date: 2016-01-18
-description: |
-  Devise version before 3.5.4 uses cookies to implement a "Remember me"
-  functionality. However, it generates the same cookie for all devices. If an
-  attacker manages to steal a remember me cookie and the user does not change
-  the password frequently, the cookie can be used to gain access to the
-  application indefinitely.
-patched_versions:
-  - ">= 3.5.4"

data/data/ruby-advisory-db/gems/devise/CVE-2019-5421.yml

@@ -1,13 +0,0 @@
----
-gem: devise
-cve: 2019-5421
-url: https://github.com/plataformatec/devise/issues/4981
-title: Devise Gem for Ruby Time-of-check Time-of-use race condition with lockable module
-date: 2019-02-07
-description: |
-  Devise ruby gem before 4.6.0 when the `lockable` module is used is vulnerable to a
-  time-of-check time-of-use (TOCTOU) race condition due to `increment_failed_attempts`
-  within the `Devise::Models::Lockable` class not being concurrency safe.
-
-patched_versions:
-  - ">= 4.6.0"

data/data/ruby-advisory-db/gems/devise/OSVDB-114435.yml

@@ -1,17 +0,0 @@
----
-gem: devise
-osvdb: 114435
-url: http://blog.plataformatec.com.br/2013/08/csrf-token-fixation-attacks-in-devise/
-title: CSRF token fixation attacks in Devise
-date: 2013-08-02
-
-description: |
-  Devise contains a flaw that allows a remote, user-assisted attacker to
-  conduct a CSRF token fixation attack. This issue is triggered as previous
-  CSRF tokens are not properly invalidated when a new token is created.
-  If an attacker has knowledge of said token, a specially crafted request can
-  be made to it, allowing the attacker to conduct CSRF attacks.
-
-patched_versions:
-  - ~> 2.2.5
-  - ">= 3.0.1"

data/data/ruby-advisory-db/gems/devise/OSVDB-89642.yml

@@ -1,20 +0,0 @@
----
-gem: devise
-cve: 2013-0233
-osvdb: 89642
-url: http://osvdb.org/show/osvdb/89642
-title: Devise Database Type Conversion Crafted Request Parsing Security Bypass
-date: 2013-01-28
-
-description: |
-  Devise contains a flaw that is triggered during when a type conversion error
-  occurs during the parsing of a malformed request. With a specially crafted
-  request, a remote attacker can bypass security restrictions.
-
-cvss_v2: 6.8
-
-patched_versions:
-  - ~> 1.5.4
-  - ~> 2.0.5
-  - ~> 2.1.3
-  - ">= 2.2.3"

data/data/ruby-advisory-db/gems/doorkeeper/CVE-2014-8144.yml

@@ -1,26 +0,0 @@
----
-gem: doorkeeper
-cve: 2014-8144
-osvdb: 116010
-url: https://groups.google.com/forum/#!topic/ruby-security-ann/5_VqJtNc8jw
-title: |
-  Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0
-  and earlier.
-date: 2014-12-18
-
-description: |
-  Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0
-  and earlier allows remote attackers to hijack the user's OAuth
-  autorization code. This vulnerability has been assigned the CVE
-  identifier CVE-2014-8144.
-
-  Doorkeeper's endpoints didn't have CSRF protection. Any HTML document
-  on the Internet can then read a user's authorization code with
-  arbitrary scope from any Doorkeeper-compatible Rails app you are
-  logged in.
-
-cvss_v2: 6.8
-
-patched_versions:
-  - ~> 1.4.1
-  - ">= 2.0.0"

data/data/ruby-advisory-db/gems/doorkeeper/CVE-2016-6582.yml

@@ -1,43 +0,0 @@
----
-gem: doorkeeper
-cve: 2016-6582
-date: 2016-08-18
-url: "http://www.openwall.com/lists/oss-security/2016/08/19/2"
-
-title: Doorkeeper gem does not revoke tokens & uses wrong auth/auth method
-
-description: |
-  Doorkeeper failed to implement OAuth 2.0 Token Revocation (RFC 7009) in the
-  following ways:
-
-  1. Public clients making valid, unauthenticated calls to revoke a token
-     would not have their token revoked
-  2. Requests were not properly authenticating the *client credentials* but
-     were, instead, looking at the access token in a second location
-  3. Because of 2, the requests were also not authorizing confidential
-     clients' ability to revoke a given token. It should only revoke tokens
-     that belong to it.
-
-  The security implication is: OAuth 2.0 clients who "log out" a user expect
-  to have the corresponding access & refresh tokens revoked, preventing an
-  attacker who may have already hijacked the session from continuing to
-  impersonate the victim. Because of the bug described above, this is not the
-  case. As far as OWASP is concerned, this counts as broken authentication
-  design.
-
-  MITRE has assigned CVE-2016-6582 due to the security issues raised. An
-  attacker, thanks to 1, can replay a hijacked session after a victim logs
-  out/revokes their token. Additionally, thanks to 2 & 3, an attacker via a
-  compromised confidential client could "grief" other clients by revoking
-  their tokens (albeit this is an exceptionally narrow attack with little
-  value).
-
-unaffected_versions:
-  - "< 1.2.0"
-
-patched_versions:
-  - ">= 4.2.0"
-
-related:
-  url:
-    - https://github.com/doorkeeper-gem/doorkeeper/commit/fb938051777a3c9cb071e96fc66458f8f615bd53