codesake-dawn 1.1.0.rc2 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: b45bb6703fbdd7c1adc81a3b6289b44c02804ddc
-  data.tar.gz: 8ba2c9dab525a8c1c1c036283d1d94ea115a76eb
+  metadata.gz: a6587e023ec76144d8c6a48e1b8130cee3a99b9d
+  data.tar.gz: 149559e865d2425e786fe587054d49a41d8fb69c
 SHA512:
-  metadata.gz: 815e5aeef96ebbbc166cddba61e3495ed87c4293f035518be5aa7e69e2e1e14e40ca338c8f5ed06a003bd16b99ad2fd9c17fe023c04facfa2275d286c82d93ab
-  data.tar.gz: 8aad05efc5b55b5a21fb094a28138bd7d586de4e332fbb6556767787fd08e27478e8535f5257b10e8af13013beeb2ef8c78b93e22fb04a98ecfcce08a94cb6ef
+  metadata.gz: cadec13f2cdc11c1d3934b1da01a8eec2d2c4cac14cb4cd0b638601af3a46a7a493884993e4706adccbf41f50c5f7e92aa65271c0f0bc0ad83d710d8a0f9d171
+  data.tar.gz: 5f75eba4b560ed3cff6139ba2b42b0d0428933257d4664657510575bbd44af746ea1afa2e831026fbda7d6e31b66213ba3f0dfa003c5cab39f5371809d5f02c3

data/Changelog.md

@@ -5,9 +5,9 @@ It supports [Sinatra](http://www.sinatrarb.com),
 [Padrino](http://www.padrinorb.com) and [Ruby on Rails](http://rubyonrails.org)
 frameworks.
 
-_latest update: Sun Mar 23 23:06:38 CET 2014_
+_latest update: Mon Mar 31 09:05:57 CEST 2014_
 
-## Version 1.1.0 - codename: Lightning McQueen (2014-xx-xx)
+## Version 1.1.0 - codename: Lightning McQueen (2014-04-04)
 
 * Added a check for CVE-2011-5036
 * Added a check for CVE-2012-6109
@@ -24,6 +24,7 @@ _latest update: Sun Mar 23 23:06:38 CET 2014_
 * Added a check for CVE-2013-4593
 * Added a check for CVE-2013-5671
 * Added a check for CVE-2014-0080
+* Added a check for CVE-2014-2525
 * Added remaining compliance checks against Owasp Ruby on Rails cheatsheet.
   Some other checks in the cheatsheet can't be turned into a Codesake::Dawn
   test, so all the cheatsheet content is covered since now.
@@ -80,6 +81,8 @@ _latest update: Sun Mar 23 23:06:38 CET 2014_
 
 ## Version 1.0.6 - codename: Lightning McQueen (2014-03-23)
 
+## Version 1.0.6 - codename: Lightning McQueen (2014-03-23)
+
 * Added a check for CVE-2014-2538
 
 ## Version 1.0.5 - codename: Lightning McQueen (2014-03-18)

data/KnowledgeBase.md

@@ -1,37 +1,8 @@
 # Codesake::Dawn Knowledge base
 
-The knowledge base library for Codesake::Dawn version 1.0.5 contains 155 security checks.
+The knowledge base library for Codesake::Dawn version 1.1.0 contains 171 security checks.
 ---
-* Not revised code: Analyzing comments, it seems your code is waiting from some review from you. Please consider take action before putting it in production.
-This check will analyze the source code looking for the following patterns: XXX, TO_CHECK, CHECKME, CHECK and FIXME
-* Owasp Ror CheatSheet: Command Injection: Ruby offers a function called "eval" which will dynamically build new Ruby code based on Strings. It also has a number of ways to call system commands. While the power of these commands is quite useful, extreme care should be taken when using them in a Rails based application. Usually, its just a bad idea. If need be, a whitelist of possible values should be used and any input should be validated as thoroughly as possible. The Ruby Security Reviewer's Guide has a section on injection and there are a number of OWASP references for it, starting at the top: Command Injection.
-* Owasp Ror CheatSheet: Cross Site Request Forgery: Ruby on Rails has specific, built in support for CSRF tokens. To enable it, or ensure that it is enabled, find the base ApplicationController and look for the protect_from_forgery directive. Note that by default Rails does not provide CSRF protection for any HTTP GET request.
-* Owasp Ror CheatSheet: Session management: By default, Ruby on Rails uses a Cookie based session store. What that means is that unless you change something, the session will not expire on the server. That means that some default applications may be vulnerable to replay attacks. It also means that sensitive information should never be put in the session.
-* Owasp Ror CheatSheet: Mass Assignement in model: Although the major issue with Mass Assignment has been fixed by default in base Rails specifically when generating new projects, it still applies to older and upgraded projects so it is important to understand the issue and to ensure that only attributes that are intended to be modifiable are exposed.
-* Owasp Ror CheatSheet: Security Related Headers: To set a header value, simply access the response.headers object as a hash inside your controller (often in a before/after_filter). Rails 4 provides the "default_headers" functionality that will automatically apply the values supplied. This works for most headers in almost all cases.
-* Owasp Ror CheatSheet: Check for safe redirect and forward: Web applications often require the ability to dynamically redirect users based
-on client-supplied data. To clarify, dynamic redirection usually entails the
-client including a URL in a parameter within a request to the application. Once
-received by the application, the user is redirected to the URL specified in the
-request.
-
-For example: http://www.example.com/redirect?url=http://www.example_commerce_site.com/checkout
-
-The above request would redirect the user to http://www.example.com/checkout.
-
-The security concern associated with this functionality is leveraging an
-organization's trusted brand to phish users and trick them into visiting a
-malicious site, in our example, "badhacker.com".
-
-Example: http://www.example.com/redirect?url=http://badhacker.com
-
-The most basic, but restrictive protection is to use the :only_path option.
-Setting this to true will essentially strip out any host information.
-* Owasp Ror CheatSheet: Sensitive Files: Many Ruby on Rails apps are open source and hosted on publicly available source code repositories. Whether that is the case or the code is committed to a corporate source control system, there are certain files that should be either excluded or carefully managed.
 * Simple Form XSS - 20131129: There is a XSS vulnerability on Simple Form's label, hint and error options. When Simple Form creates a label, hint or error message it marks the text as being HTML safe, even though it may contain HTML tags. In applications where the text of these helpers can be provided by the users, malicious values can be provided and Simple Form will mark it as safe.
-* Nokogiri - Denial of service - 20131217: There is a vulnerability in Nokogiri when using JRuby where the parser can enter an infinite loop and exhaust the process memory. Nokogiri users on JRuby using the native Java extension.  Attackers can send XML documents with carefully crafted documents which can cause the XML processor to enter an infinite loop, causing the server to run out of memory and crash.
-* Nokogiri - Entity expasion denial of service - 20131217: There is an entity expansion vulnerability in Nokogiri when using JRuby. Nokogiri users on JRuby using the native Java extension.  Attackers can send
-XML documents with carefully crafted entity expansion strings which can cause the server to run out of memory and crash.
 * [CVE-2004-0755](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0755): The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions.
 * [CVE-2004-0983](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0983): The CGI module in Ruby 1.6 before 1.6.8, and 1.8 before 1.8.2, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certain HTTP request.
 * [CVE-2005-1992](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1992): The XMLRPC server in utils.rb for the ruby library (libruby) 1.8 sets an invalid default value that prevents "security protection" using handlers, which allows remote attackers to execute arbitrary commands.
@@ -91,6 +62,7 @@ XML documents with carefully crafted entity expansion strings which can cause th
 * [CVE-2011-3187](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3187): The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
 * [CVE-2011-4319](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4319): Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring.
 * [CVE-2011-4815](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4815): Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
+* [CVE-2011-5036](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5036): Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
 * [CVE-2012-1098](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1098): Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods.
 * [CVE-2012-1099](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1099): Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.
 * [CVE-2012-1241](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1241): GRScript18.dll before 1.2.2.0 in ActiveScriptRuby (ASR) before 1.8.7 does not properly restrict interaction with an Internet Explorer ActiveX environment, which allows remote attackers to execute arbitrary Ruby code via a crafted HTML document.
@@ -112,6 +84,7 @@ XML documents with carefully crafted entity expansion strings which can cause th
 * [CVE-2012-5370](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5370): JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4838.
 * [CVE-2012-5371](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5371): Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against a variant of the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4815.
 * [CVE-2012-5380](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5380): ** DISPUTED ** Untrusted search path vulnerability in the installation functionality in Ruby 1.9.3-p194, when installed in the top-level C: directory, might allow local users to gain privileges via a Trojan horse DLL in the C:Ruby193in directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview. NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the Ruby installation.
+* [CVE-2012-6109](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6109): lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
 * [CVE-2012-6134](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6134): Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.
 * [CVE-2012-6496](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6496): SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
 * [CVE-2012-6497](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6497): The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secret_token value, as demonstrated by a value contained in secret_token.rb in an open-source product.
@@ -119,8 +92,11 @@ XML documents with carefully crafted entity expansion strings which can cause th
 * [CVE-2013-0156](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0156): active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
 * [CVE-2013-0162](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0162): The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
 * [CVE-2013-0175](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0175): multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
+* [CVE-2013-0183](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0183): multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.
+* [CVE-2013-0184](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0184): Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."
 * [CVE-2013-0233](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0233): Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
 * [CVE-2013-0256](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0256): darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
+* [CVE-2013-0262](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0262): rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
 * [CVE-2013-0263](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0263): Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
 * [CVE-2013-0269](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0269): The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
 * [CVE-2013-0276](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0276): ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.
@@ -128,6 +104,7 @@ XML documents with carefully crafted entity expansion strings which can cause th
 * [CVE-2013-0284](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0284): Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data.
 * [CVE-2013-0285](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0285): The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
 * [CVE-2013-0333](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0333): lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
+* [CVE-2013-1607](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1607): PDFKit Gem for Ruby contains a flaw that is due to the program failing to properly validate input during the handling of parameters when generating PDF files. This may allow a remote attacker to potentially execute arbitrary code via the pdfkit generation options.
 * [CVE-2013-1655](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1655): Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when
           running Ruby 1.9.3 or later, allows remote attackers to execute
           arbitrary code via vectors related to "serialized attributes."
@@ -151,33 +128,72 @@ XML documents with carefully crafted entity expansion strings which can cause th
 * [CVE-2013-2065](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2065): Native functions exposed to Ruby with DL or Fiddle do not check the taint values set on the objects passed in. This can result in tainted objects being accepted as input when a SecurityError exception should be raised.
 * [CVE-2013-2090](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2090): Ruby Gem Creme Fraiche version 0.6 suffers from a remote command injection vulnerability due to unsanitized input.
 * [CVE-2013-2119](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2119): Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.
+* [CVE-2013-2512](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2512): ftpd Gem for Ruby contains a flaw that is triggered when handling a specially crafted option or filename that contains a shell character. This may allow a remote attacker to inject arbitrary commands
+* [CVE-2013-2513](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2513): flash_tool Gem for Ruby contains a flaw that is triggered during the handling of downloaded files that contain shell characters. With a specially crafted file, a context-dependent attacker can execute arbitrary commands.
+* [CVE-2013-2516](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2516): fileutils Gem for Ruby contains a flaw in file_utils.rb. The issue is triggered when handling a specially crafted URL containing a command after a delimiter (;). This may allow a remote attacker to potentially execute arbitrary commands.
 * [CVE-2013-2615](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2615): lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
 * [CVE-2013-2616](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2616): lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
 * [CVE-2013-2617](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2617): lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
 * [CVE-2013-3221](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3221): The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
 * [CVE-2013-4164](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4164): Any time a string is converted to a floating point value, a specially crafted string can cause a heap overflow. This can lead to a denial of service attack via segmentation faults and possibly arbitrary code execution. Any program that converts input of unknown origin to floating point values (especially common when accepting JSON) are vulnerable.
+* [CVE-2013-4203](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4203): The self.run_gpg function in lib/rgpg/gpg_helper.rb in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
 * [CVE-2013-4389](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389): Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
+* [CVE-2013-4413](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4413): Wicked Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input passed via the 'the_step' parameter upon submission to the render_redirect.rb script. This may allow a remote attacker to gain access to arbitrary files.
 * [CVE-2013-4457](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4457): The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation.
 * [CVE-2013-4478](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4478): Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
 * [CVE-2013-4479](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4479): lib/sup/message_chunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the content_type of an email attachment.
+* [CVE-2013-4489](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4489): There is a remote code execution vulnerability in the code search feature of GitLab provided by the grit gem.
 * [CVE-2013-4491](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491): Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.
 * [CVE-2013-4492](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4492): Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call.
 * [CVE-2013-4562](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4562): Because of the way that omniauth-facebook supports setting a per-request state parameter by storing it in the session, it is possible to circumvent the automatic CSRF protection. Therefore the CSRF added in 1.4.1 should be considered broken. If you are currently providing a custom state, you will need to store and retrieve this yourself (for example, by using the session store) to use 1.5.0.
+* [CVE-2013-4593](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4593): omniauth-facebook Gem for Ruby contains a flaw that is due to the application supporting passing the access token via the URL. This may allow a remote attacker to bypass authentication and authenticate as another user.
 * [CVE-2013-5647](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5647): lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
+* [CVE-2013-5671](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5671): fog-dragonfly Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input passed via the imagemagickutils.rb script. This may allow a remote attacker to execute arbitrary commands.
 * [CVE-2013-6414](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414): actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.
 * [CVE-2013-6415](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415): Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.
 * [CVE-2013-6416](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6416): Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.
 * [CVE-2013-6417](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417): actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
 * [CVE-2013-6421](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6421): The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.
 * [CVE-2013-6459](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6459): Cross-site scripting (XSS) vulnerability in the will_paginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links.
+* [CVE-2013-6460](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6460): There is a vulnerability in Nokogiri when using JRuby where the parser can enter an infinite loop and exhaust the process memory. Nokogiri users on JRuby using the native Java extension.  Attackers can send XML documents with carefully crafted documents which can cause the XML processor to enter an infinite loop, causing the server to run out of memory and crash.
+* [CVE-2013-6461](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6461): There is an entity expansion vulnerability in Nokogiri when using JRuby. Nokogiri users on JRuby using the native Java extension.  Attackers can send
+XML documents with carefully crafted entity expansion strings which can cause the server to run out of memory and crash.
 * [CVE-2013-7086](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7086): The message function in lib/webbynode/notify.rb in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message.
 * [CVE-2014-0036](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0036): rbovirt Gem for Ruby contains a flaw related to certificate validation. The issue is due to the program failing to validate SSL certificates. This may allow an attacker with access to network traffic (e.g. MiTM, DNS cache poisoning) to spoof the SSL server via an arbitrary certificate that appears valid. Such an attack would allow for the interception of sensitive traffic, and potentially allow for the injection of content into the SSL stream.
+* [CVE-2014-0080](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0080): SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving  (backslash) characters that are not properly handled in operations on array columns.
 * [CVE-2014-0081](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0081): Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.
 * [CVE-2014-0082](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0082): actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.
 * [CVE-2014-1233](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1233): The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process.
 * [CVE-2014-1234](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1234): The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process.
 * [CVE-2014-2322](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2322): Arabic Prawn Gem for Ruby contains a flaw in the ib/string_utf_support.rb file. The issue is due to the program failing to sanitize user input. This may allow a remote attacker to inject arbitrary commands.
+* [CVE-2014-2525](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2525): 
 * [CVE-2014-2538](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2538): rack-ssl Gem for Ruby contains a flaw that allows a reflected cross-site scripting (XSS) attack. This flaw exists because the program does not validate input passed via error messages before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
+* Owasp Ror CheatSheet: Command Injection: Ruby offers a function called "eval" which will dynamically build new Ruby code based on Strings. It also has a number of ways to call system commands. While the power of these commands is quite useful, extreme care should be taken when using them in a Rails based application. Usually, its just a bad idea. If need be, a whitelist of possible values should be used and any input should be validated as thoroughly as possible. The Ruby Security Reviewer's Guide has a section on injection and there are a number of OWASP references for it, starting at the top: Command Injection.
+* Owasp Ror CheatSheet: Cross Site Request Forgery: Ruby on Rails has specific, built in support for CSRF tokens. To enable it, or ensure that it is enabled, find the base ApplicationController and look for the protect_from_forgery directive. Note that by default Rails does not provide CSRF protection for any HTTP GET request.
+* Owasp Ror CheatSheet: Session management: By default, Ruby on Rails uses a Cookie based session store. What that means is that unless you change something, the session will not expire on the server. That means that some default applications may be vulnerable to replay attacks. It also means that sensitive information should never be put in the session.
+* Owasp Ror CheatSheet: Mass Assignement in model: Although the major issue with Mass Assignment has been fixed by default in base Rails specifically when generating new projects, it still applies to older and upgraded projects so it is important to understand the issue and to ensure that only attributes that are intended to be modifiable are exposed.
+* Owasp Ror CheatSheet: Security Related Headers: To set a header value, simply access the response.headers object as a hash inside your controller (often in a before/after_filter). Rails 4 provides the "default_headers" functionality that will automatically apply the values supplied. This works for most headers in almost all cases.
+* Owasp Ror CheatSheet: Check for safe redirect and forward: Web applications often require the ability to dynamically redirect users based
+on client-supplied data. To clarify, dynamic redirection usually entails the
+client including a URL in a parameter within a request to the application. Once
+received by the application, the user is redirected to the URL specified in the
+request.
+
+For example: http://www.example.com/redirect?url=http://www.example_commerce_site.com/checkout
+
+The above request would redirect the user to http://www.example.com/checkout.
+
+The security concern associated with this functionality is leveraging an
+organization's trusted brand to phish users and trick them into visiting a
+malicious site, in our example, "badhacker.com".
+
+Example: http://www.example.com/redirect?url=http://badhacker.com
+
+The most basic, but restrictive protection is to use the :only_path option.
+Setting this to true will essentially strip out any host information.
+* Owasp Ror CheatSheet: Sensitive Files: Many Ruby on Rails apps are open source and hosted on publicly available source code repositories. Whether that is the case or the code is committed to a corporate source control system, there are certain files that should be either excluded or carefully managed.
+* Not revised code: Analyzing comments, it seems your code is waiting from some review from you. Please consider take action before putting it in production.
+This check will analyze the source code looking for the following patterns: XXX, TO_CHECK, CHECKME, CHECK and FIXME
 
 
-_Last updated: Sun 23 Mar 22:44:00 CET 2014_
+_Last updated: Tue 01 Apr 08:13:46 CEST 2014_

data/README.md

@@ -17,10 +17,11 @@ MVC (Model View Controller) frameworks, like:
 [![Build Status](https://travis-ci.org/codesake/codesake-dawn.png?branch=master)](https://travis-ci.org/codesake/codesake-dawn)
 [![Dependency Status](https://gemnasium.com/codesake/codesake-dawn.png)](https://gemnasium.com/codesake/codesake-dawn)
 [![Coverage Status](https://coveralls.io/repos/codesake/codesake-dawn/badge.png)](https://coveralls.io/r/codesake/codesake-dawn)
+[![Bitdeli Badge](https://d2weczhvl823v0.cloudfront.net/codesake/codesake-dawn/trend.png)](https://bitdeli.com/free "Bitdeli Badge")
 
 ---
 
-Codesake::Dawn version 1.1 has 169 security checks loaded in its knowledge
+Codesake::Dawn version 1.1 has 171 security checks loaded in its knowledge
 base. Most of them are CVE bulletins applying to gems or the ruby interpreter
 itself. There are also some check coming from Owasp Ruby on Rails cheatsheet.
 
@@ -84,8 +85,9 @@ And then upgrade your bundle
 
 You may want to build it from source, so you have to check it out from github first:
 
-    $ git clone https://github.com/codesake/codesake-dawn/codesake-dawn.git
+    $ git clone https://github.com/codesake/codesake-dawn.git
     $ cd codesake-dawn
+    $ bundle install
     $ rake install
 
 And the codesake-dawn gem will be built in a pkg directory and then installed
@@ -273,7 +275,7 @@ The list of knowledge base content: [http://dawn.codesake.com/knowledge-base](ht
 
 Mailing list: [https://groups.google.com/forum/#!forum/codesake-dawn](https://groups.google.com/forum/#!forum/codesake-dawn)
 
-## Supporters
+## Support us
 
 Feedbacks are great and we really love to hear your voice.
 
@@ -346,3 +348,6 @@ LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
+
+
+

data/Rakefile

@@ -36,7 +36,7 @@ task :cve, :name do |t,args|
   SRC_DIR   = "./lib/codesake/dawn/kb/"
   SPEC_DIR  = "./spec/lib/kb/"
 
-  raise "### It seems that #{name} is already in Dawn knowledge base" unless Codesake::Dawn::KnowledgeBase.new.find(nil, name).nil?
+  raise "### It seems that #{name} is already in Dawn knowledge base" unless Codesake::Dawn::KnowledgeBase.find(nil, name).nil?
   raise "### Invalid CVE title: #{name}" if name.nil? or name.empty? or /CVE-\d{4}-\d{4}/.match(name).nil?
   raise "### No target directory: #{SRC_DIR}" unless Dir.exists?(SRC_DIR)
   raise "### No rspec directory: #{SPEC_DIR}" unless Dir.exists?(SPEC_DIR)

data/Roadmap.md

@@ -3,94 +3,57 @@
 Codesake::Dawn is a static analysis security scanner for ruby written web applications.
 It supports [Sinatra](http://www.sinatrarb.com),
 [Padrino](http://www.padrinorb.com) and [Ruby on Rails](http://rubyonrails.org)
-frameworks. 
+frameworks.
 
 This is an ongoing roadmap for the Codesake::Dawn source code review tool.
 
-_latest update: Thu Jan 30 08:39:13 CET 2014_
-
-## Version 1.1.0
-
-* CVE-2014-1234
-* CVE-2014-1233
-* CVE-2013-5671
-* CVE-2013-4593
-* CVE-2013-4489
-* CVE-2013-4413
-* CVE-2013-2516
-* CVE-2013-2513
-* CVE-2013-2512
-* CVE-2013-1607
-* CVE-2013-0262
-* CVE-2013-0184
-* CVE-2013-0183
-* CVE-2012-6109
-* CVE-2011-5036
-* CVE-2007-6183
-* adding test for RoRCheatSheet\_2
-* adding test for RoRCheatSheet\_3
-* adding test for RoRCheatSheet\_5
-* adding test for RoRCheatSheet\_6
-* adding test for RoRCheatSheet\_9
-* adding test for RoRCheatSheet\_10
-* adding test for RoRCheatSheet\_11
-* adding test for RoRCheatSheet\_12
-* adding test for RoRCheatSheet\_13
-* adding test for RoRCheatSheet\_14
-* adding test for RoRCheatSheet\_15
-* adding test for RoRCheatSheet\_16
-* add a check against deprecated ruby / gems version. I will handle MVC gems
-  right now.
-* Better bin/dawn script output formatting using some library like PrettyPrint
-  (this can involve a change in codesake-commons package). We will use tables
-  to create ascii organized reports.
-* Create a digital signature as described [here](http://rubygems.rubyforge.org/rubygems-update/Gem/Security.html)
-* bin/dawn refactoring using the new Reporting class to produce json, csv, html output
-* add config file with setting (css directory, report options, ...)
+_latest update: Mon Mar 31 13:01:21 CEST 2014_
 
 ## Version 1.2.0
 
-* move is\_vulnerable\_version? and is\_vulnerable\_patchlevel? to an adhoc
-  class handling version comparison
-* add @rubysec vulnerability database integration using rake
 * create a task to check for new CVE in NVD website
+* SQLite3 integration for saving data. Each project will have its own SQLite
+  database containing reviews, findings and all. A table with Codesake::Dawn version it
+  created the database will be inserted as well
 * add a language check. It will handle a ruby script as input and a
   ruby\_parser line as unsafe pattern. It will compile the ruby and look for
   the unsafe pattern
 * Add preliminary Cross Site Scripting detection for Ruby on Rails.
-* Issue #40: Support for string version modifiers
 * Issue #7: Improving HTML output and let the user the capability to provide a
   basic layout to customize report
-* Add a --github option to Codesake::Dawn to clone a remote repository, perform
-  a bundle install and do a code review.
-* Add support for github hooks
 * Add a ruby deprecation check, accordingly to
   https://bugs.ruby-lang.org/projects/ruby/wiki/ReleaseEngineering
-* Add a severity attribute to basic check. It must be calculated automatically
-  on the cvss_score or it may be overriden upon check creation.
 
 ## Version 1.3.0
 
-* Add support for ERB for in detect\_views 
+* Add support for ERB for in detect\_views
 * Add preliminary javascript support
-* adding test for CVE-2011-4969  XSS in jquery < 1.6.2 
+* adding test for CVE-2011-4969  XSS in jquery < 1.6.2
 * add support for pure Rack applications
 * Cross Site Scripting detection: it must be done for all MVC frameworks
   (including Rack) and it must cover either reflected than stored attack
   patterns
+* Add a --github option to Codesake::Dawn to clone a remote repository, perform
+  a bundle install and do a code review.
+* Add support for github hooks
 * Add premilinary SQL injection detection for Ruby on Rails
 
 ## Version 1.5.0
 
 * Add insecure direct object reference detection for all MVC frameworks (including Rack)
 * SQL Injection detection: it must be done for all MVC frameworks (including Rack)
-* Add automatic mitigation patch generation 
-* SQLite3 integration for saving data. Each project will have its own SQLite
-  database containing reviews, findings and all. A table with Codesake::Dawn version it
-  created the database will be inserted as well
+* Add automatic mitigation patch generation
 * Add support for Javascript
 
-## Version 2.0.0
+# Spinoff projects
+
+Codesake::Dawn is a security scanner for ruby code. Modern web applications
+however are wrote in a plenty of great technologies deserving a good tool for
+security scan.
+
+Node.js and Go are very promising programming languages and a tool similiar to
+Codesake::Dawn can be wrote also to support them:
 
-* Add support for node.js
-* Add support for Go
+Initially they were in the Codesake::Dawn roadmap for a 2.0.0 version. However
+we decide to drop this in the name of being focused on ruby programming
+language.

data/checksum/codesake-dawn-1.1.0.gem.sha512

@@ -0,0 +1 @@
+57977e5c9f5349f28858053a5a6663b21a003fae1ad9bd099f70cdbc4595a299b5e0de7d01a6d4954e8393815a288d5d861e3e165f037da6c605918ae2a28ccd

data/doc/dawn_1_1_announcement.md

@@ -0,0 +1,67 @@
+## Press announcement
+
+The April 4th 2013, the first Codesake::Dawn import in Github happened. After
+1 year and three months later than the first major released, I'm happy to
+annonunce Codesake::Dawn 1.1.0, codename Lightning McQueen
+
+Codesake::Dawn is a source code scanner designed to review your code for
+security issues.
+
+Codesake::Dawn is able to scan your ruby standalone programs but its main usage
+is to deal with web applications. It supports applications written using majors
+MVC (Model View Controller) frameworks, like:
+
+* [Ruby on Rails](http://rubyonrails.org)
+* [Sinatra](http://www.sinatrarb.com)
+* [Padrino](http://www.padrinorb.com)
+
+Codesake::Dawn version 1.1 has 171 security checks loaded in its knowledge
+base. Most of them are CVE bulletins applying to gems or the ruby interpreter
+itself. There are also some check coming from Owasp Ruby on Rails cheatsheet.
+
+Writing safe code it's important, but sometimes security issues are introduced
+by third party code your application relies on. As example, consider a SQL
+Injection vulnerability introduced by Ruby on Rails framework. 
+
+Despite the effort you spend in sanitizing inputs, your web application
+inherits the vulnerability suffering as well. An attacker can easily exploit it
+and break into your database unless you upgrade the offended gem.
+
+There is a comprehensive set of command line flags you can read more by issuing
+```dawn --list-knowledge-base``` flag or by reading [project
+README](https://github.com/codesake/codesake-dawn/raw/master/README.md) file.
+
+The list of security checks included in version 1.1.0 can be found online at:
+[http://dawn.codesake.com/knowledge-base](http://dawn.codesake.com/knowledge-base).
+
+You can use [facilities provided by
+github](https://github.com/codesake/codesake-dawn/issues) to submit bug
+reports, product enhancements, new security checks you want to me to add in
+future releases and even success stories.
+
+Now it's time for you to install Codesake::Dawn version 1.1.0 with the
+following command and start reviewing your code for security issues:
+
+```
+$ gem install codesake-dawn
+```
+
+You can find the announcement on the web here: [http://dawn.codesake.com/blog/announce-codesake-dawn-v1-1-0-released/](http://dawn.codesake.com/blog/announce-codesake-dawn-v1-1-0-released/)
+Enjoy it!
+Paolo - paolo@codesake.com
+
+## Twitter announcement
+
+### version 1.1.0
+@dawnscanner version 1.1.0 is out. 171 security checks. Improved output and more. Read the announcement: http://dawn.codesake.com/blog/announce-codesake-dawn-v1-1-0-released/ #ruby #rails #sinatra #padrina #security #scanner
+
+## Linkedin announcement
+
+### version 1.0.0
+@dawnscanner version 1.1.0 is out. Read the announcement online. Codesake::Dawn makes security code review fun for ruby developers, it scans 171 CVE bulletins and future release will be able to scan custom ruby code for XSS, SQL Injections and business logic flaws. It supports Sinatra, Padrino and Ruby on Rails MVC frameworks out of the box.
+
+$ gem install codesake-dawn
+$ have fun
+
+## HN Link
+## Reddit

data/lib/codesake/dawn/kb/cve_2014_2525.rb

@@ -0,0 +1,61 @@
+module Codesake
+	module Dawn
+		module Kb
+      class CVE_2014_2525_a
+        include BasicCheck
+
+        def initialize
+          message = "When relying on system wide libyaml, this must be > 0.1.5"
+          super({
+            :name=>"CVE-2014-2525-a",
+            :kind=>Codesake::Dawn::KnowledgeBase::CUSTOM_CHECK,
+          })
+        end
+        def vuln?
+          require 'yaml'
+          lyv = Psych.libyaml_version.join(".")
+          c = Codesake::Dawn::Kb::VersionCheck.new
+          return c.is_vulnerable_version?('0.1.6', lyv)
+        end
+      end
+      class CVE_2014_2525_b
+        include DependencyCheck
+
+        def initialize
+          message = "When non relying on system wide libyaml, psych gem must be > 2.0.5"
+          super({
+            :name=>"CVE-2014-2525-b",
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+          })
+          self.safe_dependencies = [{:name=>"psych", :version=>['2.0.5']}]
+        end
+
+      end
+
+			# Automatically created with rake on 2014-03-31
+			class CVE_2014_2525
+				include ComboCheck
+
+				def initialize
+          message = ""
+
+          super({
+            :name=>"CVE-2014-2525",
+            :cvss=>"",
+            :release_date => Date.new(2014, 3, 28),
+            :cwe=>"",
+            :owasp=>"A9",
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::COMBO_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade your system libyaml or upgrade psych gem to version 2.0.5 or higher that is linked with a safe libyaml version.",
+            :aux_links=>["https://www.ruby-lang.org/en/news/2014/03/29/heap-overflow-in-yaml-uri-escape-parsing-cve-2014-2525"],
+            :severity=>:high,
+            :prority=>:high,
+            :checks=>[CVE_2014_2525_a.new, CVE_2014_2525_b.new]
+          })
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2014_2538.rb

@@ -9,18 +9,18 @@ module Codesake
           message = "rack-ssl Gem for Ruby contains a flaw that allows a reflected cross-site scripting (XSS) attack. This flaw exists because the program does not validate input passed via error messages before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server."
            super({
             :name=>"CVE-2014-2538",
-            :cvss=>"",
-            :release_date => Date.new(2013, 7, 9),
+            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
+            :release_date => Date.new(2014, 3, 25),
             :cwe=>"79",
             :owasp=>"A3",
             :applies=>["rails"],
             :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
             :message=>message,
-            :mitigation=>"A new version for rack-ssl version it has been released. Pleas upgrade at least to version 1.4.1 or higher.",
+            :mitigation=>"A new version for rack-ssl version it has been released. Pleas upgrade at least to version 1.4.0 or higher.",
             :aux_links=>["http://seclists.org/oss-sec/2014/q1/594"]
            })
 
-           self.safe_dependencies = [{:name=>"rack-ssl", :version=>['1.4.1']}]
+           self.safe_dependencies = [{:name=>"rack-ssl", :version=>['1.4.0']}]
 				end
 			end
 		end

data/lib/codesake/dawn/kb/owasp_ror_cheatsheet/session_stored_in_database.rb

@@ -25,7 +25,7 @@ module Codesake
               :mitigation=>"Use ActiveRecord or the ORM you love most to handle your code session_store. Add \"Application.config.session_store :active_record_store\" to your session_store.rb file."
             })
             # @debug = true
-          end 
+          end
         end
       end
     end

data/lib/codesake/dawn/knowledge_base.rb

@@ -1,4 +1,4 @@
-# Core KB 
+# Core KB
 require "codesake/dawn/kb/basic_check"
 require "codesake/dawn/kb/pattern_match_check"
 require "codesake/dawn/kb/dependency_check"
@@ -27,7 +27,7 @@ require 'codesake/dawn/kb/owasp_ror_cheatsheet/sensitive_files'
 
 # A XSS issue on Simple Form gem reported by Rafael Mendonça França on
 # November, 29 2013
-# 
+#
 # https://groups.google.com/forum/#!topic/ruby-security-ann/flHbLMb07tE
 require "codesake/dawn/kb/simpleform_xss_20131129"
 
@@ -58,7 +58,7 @@ require "codesake/dawn/kb/cve_2007_5770"
 require "codesake/dawn/kb/cve_2007_6077"
 require "codesake/dawn/kb/cve_2007_6612"
 
-# CVE - 2008 
+# CVE - 2008
 
 require "codesake/dawn/kb/cve_2008_1145"
 require "codesake/dawn/kb/cve_2008_1891"
@@ -214,6 +214,7 @@ require "codesake/dawn/kb/cve_2014_0082"
 require "codesake/dawn/kb/cve_2014_1233"
 require "codesake/dawn/kb/cve_2014_1234"
 require "codesake/dawn/kb/cve_2014_2322"
+require "codesake/dawn/kb/cve_2014_2525"
 require "codesake/dawn/kb/cve_2014_2538"
 
 module Codesake
@@ -228,6 +229,7 @@ module Codesake
       RUBY_VERSION_CHECK  = :ruby_version_check
       OS_CHECK            = :os_check
       COMBO_CHECK         = :combo_check
+      CUSTOM_CHECK        = :custom_check
 
       def initialize(options={})
         @enabled_checks = Codesake::Dawn::Kb::BasicCheck::ALLOWED_FAMILIES
@@ -260,7 +262,7 @@ module Codesake
       # MVC name should be passed as constructor option, so the all_by_mvc can
       #
       # be called without parameter, having a nice-to-read code.
-      # @checks = Codesake::Dawn::KnowledgeBase.new({:enabled_checks=>@enabled_checks}).all_by_mvc(@name) 
+      # @checks = Codesake::Dawn::KnowledgeBase.new({:enabled_checks=>@enabled_checks}).all_by_mvc(@name)
       def all_by_mvc(mvc)
         ret = []
         @security_checks.each do |sc|
@@ -332,48 +334,48 @@ module Codesake
           Codesake::Dawn::Kb::CVE_2010_3933.new,
           Codesake::Dawn::Kb::CVE_2011_0188.new,
           Codesake::Dawn::Kb::CVE_2011_0446.new,
-          Codesake::Dawn::Kb::CVE_2011_0447.new, 
-          Codesake::Dawn::Kb::CVE_2011_0739.new, 
-          Codesake::Dawn::Kb::CVE_2011_0995.new, 
-          Codesake::Dawn::Kb::CVE_2011_1004.new, 
-          Codesake::Dawn::Kb::CVE_2011_1005.new, 
-          Codesake::Dawn::Kb::CVE_2011_2197.new, 
-          Codesake::Dawn::Kb::CVE_2011_2686.new, 
-          Codesake::Dawn::Kb::CVE_2011_2705.new, 
-          Codesake::Dawn::Kb::CVE_2011_2929.new, 
-          Codesake::Dawn::Kb::CVE_2011_2930.new, 
-          Codesake::Dawn::Kb::CVE_2011_2931.new, 
-          Codesake::Dawn::Kb::CVE_2011_2932.new, 
-          Codesake::Dawn::Kb::CVE_2011_3009.new, 
-          Codesake::Dawn::Kb::CVE_2011_3186.new, 
-          Codesake::Dawn::Kb::CVE_2011_3187.new, 
-          Codesake::Dawn::Kb::CVE_2011_4319.new, 
-          Codesake::Dawn::Kb::CVE_2011_4815.new, 
-          Codesake::Dawn::Kb::CVE_2011_5036.new, 
-          Codesake::Dawn::Kb::CVE_2012_1098.new, 
-          Codesake::Dawn::Kb::CVE_2012_1099.new, 
-          Codesake::Dawn::Kb::CVE_2012_1241.new, 
-          Codesake::Dawn::Kb::CVE_2012_2139.new, 
-          Codesake::Dawn::Kb::CVE_2012_2140.new, 
-          Codesake::Dawn::Kb::CVE_2012_2660.new, 
-          Codesake::Dawn::Kb::CVE_2012_2661.new, 
-          Codesake::Dawn::Kb::CVE_2012_2671.new, 
-          Codesake::Dawn::Kb::CVE_2012_2694.new, 
-          Codesake::Dawn::Kb::CVE_2012_2695.new, 
-          Codesake::Dawn::Kb::CVE_2012_3424.new, 
-          Codesake::Dawn::Kb::CVE_2012_3463.new, 
-          Codesake::Dawn::Kb::CVE_2012_3464.new, 
-          Codesake::Dawn::Kb::CVE_2012_3465.new, 
-          Codesake::Dawn::Kb::CVE_2012_4464.new, 
-          Codesake::Dawn::Kb::CVE_2012_4466.new, 
-          Codesake::Dawn::Kb::CVE_2012_4481.new, 
-          Codesake::Dawn::Kb::CVE_2012_4522.new, 
-          Codesake::Dawn::Kb::CVE_2012_5370.new, 
-          Codesake::Dawn::Kb::CVE_2012_5371.new, 
-          Codesake::Dawn::Kb::CVE_2012_5380.new, 
-          Codesake::Dawn::Kb::CVE_2012_6109.new, 
-          Codesake::Dawn::Kb::CVE_2012_6134.new, 
-          Codesake::Dawn::Kb::CVE_2012_6496.new, 
+          Codesake::Dawn::Kb::CVE_2011_0447.new,
+          Codesake::Dawn::Kb::CVE_2011_0739.new,
+          Codesake::Dawn::Kb::CVE_2011_0995.new,
+          Codesake::Dawn::Kb::CVE_2011_1004.new,
+          Codesake::Dawn::Kb::CVE_2011_1005.new,
+          Codesake::Dawn::Kb::CVE_2011_2197.new,
+          Codesake::Dawn::Kb::CVE_2011_2686.new,
+          Codesake::Dawn::Kb::CVE_2011_2705.new,
+          Codesake::Dawn::Kb::CVE_2011_2929.new,
+          Codesake::Dawn::Kb::CVE_2011_2930.new,
+          Codesake::Dawn::Kb::CVE_2011_2931.new,
+          Codesake::Dawn::Kb::CVE_2011_2932.new,
+          Codesake::Dawn::Kb::CVE_2011_3009.new,
+          Codesake::Dawn::Kb::CVE_2011_3186.new,
+          Codesake::Dawn::Kb::CVE_2011_3187.new,
+          Codesake::Dawn::Kb::CVE_2011_4319.new,
+          Codesake::Dawn::Kb::CVE_2011_4815.new,
+          Codesake::Dawn::Kb::CVE_2011_5036.new,
+          Codesake::Dawn::Kb::CVE_2012_1098.new,
+          Codesake::Dawn::Kb::CVE_2012_1099.new,
+          Codesake::Dawn::Kb::CVE_2012_1241.new,
+          Codesake::Dawn::Kb::CVE_2012_2139.new,
+          Codesake::Dawn::Kb::CVE_2012_2140.new,
+          Codesake::Dawn::Kb::CVE_2012_2660.new,
+          Codesake::Dawn::Kb::CVE_2012_2661.new,
+          Codesake::Dawn::Kb::CVE_2012_2671.new,
+          Codesake::Dawn::Kb::CVE_2012_2694.new,
+          Codesake::Dawn::Kb::CVE_2012_2695.new,
+          Codesake::Dawn::Kb::CVE_2012_3424.new,
+          Codesake::Dawn::Kb::CVE_2012_3463.new,
+          Codesake::Dawn::Kb::CVE_2012_3464.new,
+          Codesake::Dawn::Kb::CVE_2012_3465.new,
+          Codesake::Dawn::Kb::CVE_2012_4464.new,
+          Codesake::Dawn::Kb::CVE_2012_4466.new,
+          Codesake::Dawn::Kb::CVE_2012_4481.new,
+          Codesake::Dawn::Kb::CVE_2012_4522.new,
+          Codesake::Dawn::Kb::CVE_2012_5370.new,
+          Codesake::Dawn::Kb::CVE_2012_5371.new,
+          Codesake::Dawn::Kb::CVE_2012_5380.new,
+          Codesake::Dawn::Kb::CVE_2012_6109.new,
+          Codesake::Dawn::Kb::CVE_2012_6134.new,
+          Codesake::Dawn::Kb::CVE_2012_6496.new,
           Codesake::Dawn::Kb::CVE_2012_6497.new,
           Codesake::Dawn::Kb::CVE_2013_0155.new,
           Codesake::Dawn::Kb::CVE_2013_0156.new,
@@ -400,29 +402,29 @@ module Codesake
           Codesake::Dawn::Kb::CVE_2013_1802.new,
           Codesake::Dawn::Kb::CVE_2013_1812.new,
           Codesake::Dawn::Kb::CVE_2013_1821.new,
-          Codesake::Dawn::Kb::CVE_2013_1854.new, 
-          Codesake::Dawn::Kb::CVE_2013_1855.new, 
-          Codesake::Dawn::Kb::CVE_2013_1856.new, 
-          Codesake::Dawn::Kb::CVE_2013_1857.new, 
-          Codesake::Dawn::Kb::CVE_2013_1875.new, 
-          Codesake::Dawn::Kb::CVE_2013_1898.new, 
-          Codesake::Dawn::Kb::CVE_2013_1911.new, 
-          Codesake::Dawn::Kb::CVE_2013_1933.new, 
-          Codesake::Dawn::Kb::CVE_2013_1947.new, 
-          Codesake::Dawn::Kb::CVE_2013_1948.new, 
-          Codesake::Dawn::Kb::CVE_2013_2065.new, 
-          Codesake::Dawn::Kb::CVE_2013_2090.new, 
-          Codesake::Dawn::Kb::CVE_2013_2119.new, 
-          Codesake::Dawn::Kb::CVE_2013_2512.new, 
-          Codesake::Dawn::Kb::CVE_2013_2513.new, 
-          Codesake::Dawn::Kb::CVE_2013_2516.new, 
-          Codesake::Dawn::Kb::CVE_2013_2615.new, 
-          Codesake::Dawn::Kb::CVE_2013_2616.new, 
-          Codesake::Dawn::Kb::CVE_2013_2617.new, 
-          Codesake::Dawn::Kb::CVE_2013_3221.new, 
-          Codesake::Dawn::Kb::CVE_2013_4164.new, 
-          Codesake::Dawn::Kb::CVE_2013_4203.new, 
-          Codesake::Dawn::Kb::CVE_2013_4389.new, 
+          Codesake::Dawn::Kb::CVE_2013_1854.new,
+          Codesake::Dawn::Kb::CVE_2013_1855.new,
+          Codesake::Dawn::Kb::CVE_2013_1856.new,
+          Codesake::Dawn::Kb::CVE_2013_1857.new,
+          Codesake::Dawn::Kb::CVE_2013_1875.new,
+          Codesake::Dawn::Kb::CVE_2013_1898.new,
+          Codesake::Dawn::Kb::CVE_2013_1911.new,
+          Codesake::Dawn::Kb::CVE_2013_1933.new,
+          Codesake::Dawn::Kb::CVE_2013_1947.new,
+          Codesake::Dawn::Kb::CVE_2013_1948.new,
+          Codesake::Dawn::Kb::CVE_2013_2065.new,
+          Codesake::Dawn::Kb::CVE_2013_2090.new,
+          Codesake::Dawn::Kb::CVE_2013_2119.new,
+          Codesake::Dawn::Kb::CVE_2013_2512.new,
+          Codesake::Dawn::Kb::CVE_2013_2513.new,
+          Codesake::Dawn::Kb::CVE_2013_2516.new,
+          Codesake::Dawn::Kb::CVE_2013_2615.new,
+          Codesake::Dawn::Kb::CVE_2013_2616.new,
+          Codesake::Dawn::Kb::CVE_2013_2617.new,
+          Codesake::Dawn::Kb::CVE_2013_3221.new,
+          Codesake::Dawn::Kb::CVE_2013_4164.new,
+          Codesake::Dawn::Kb::CVE_2013_4203.new,
+          Codesake::Dawn::Kb::CVE_2013_4389.new,
           Codesake::Dawn::Kb::CVE_2013_4413.new,
           Codesake::Dawn::Kb::CVE_2013_4457.new,
           Codesake::Dawn::Kb::CVE_2013_4478.new,
@@ -430,26 +432,27 @@ module Codesake
           Codesake::Dawn::Kb::CVE_2013_4489.new,
           Codesake::Dawn::Kb::CVE_2013_4491.new,
           Codesake::Dawn::Kb::CVE_2013_4492.new,
-          Codesake::Dawn::Kb::CVE_2013_4562.new, 
-          Codesake::Dawn::Kb::CVE_2013_4593.new, 
-          Codesake::Dawn::Kb::CVE_2013_5647.new, 
-          Codesake::Dawn::Kb::CVE_2013_5671.new, 
-          Codesake::Dawn::Kb::CVE_2013_6414.new, 
-          Codesake::Dawn::Kb::CVE_2013_6415.new, 
-          Codesake::Dawn::Kb::CVE_2013_6416.new, 
-          Codesake::Dawn::Kb::CVE_2013_6417.new, 
-          Codesake::Dawn::Kb::CVE_2013_6421.new, 
-          Codesake::Dawn::Kb::CVE_2013_6459.new, 
+          Codesake::Dawn::Kb::CVE_2013_4562.new,
+          Codesake::Dawn::Kb::CVE_2013_4593.new,
+          Codesake::Dawn::Kb::CVE_2013_5647.new,
+          Codesake::Dawn::Kb::CVE_2013_5671.new,
+          Codesake::Dawn::Kb::CVE_2013_6414.new,
+          Codesake::Dawn::Kb::CVE_2013_6415.new,
+          Codesake::Dawn::Kb::CVE_2013_6416.new,
+          Codesake::Dawn::Kb::CVE_2013_6417.new,
+          Codesake::Dawn::Kb::CVE_2013_6421.new,
+          Codesake::Dawn::Kb::CVE_2013_6459.new,
           Codesake::Dawn::Kb::CVE_2013_6460.new,
           Codesake::Dawn::Kb::CVE_2013_6461.new,
-          Codesake::Dawn::Kb::CVE_2013_7086.new, 
-          Codesake::Dawn::Kb::CVE_2014_0036.new, 
-          Codesake::Dawn::Kb::CVE_2014_0080.new, 
-          Codesake::Dawn::Kb::CVE_2014_0081.new, 
-          Codesake::Dawn::Kb::CVE_2014_0082.new, 
+          Codesake::Dawn::Kb::CVE_2013_7086.new,
+          Codesake::Dawn::Kb::CVE_2014_0036.new,
+          Codesake::Dawn::Kb::CVE_2014_0080.new,
+          Codesake::Dawn::Kb::CVE_2014_0081.new,
+          Codesake::Dawn::Kb::CVE_2014_0082.new,
           Codesake::Dawn::Kb::CVE_2014_1233.new,
           Codesake::Dawn::Kb::CVE_2014_1234.new,
           Codesake::Dawn::Kb::CVE_2014_2322.new,
+          Codesake::Dawn::Kb::CVE_2014_2525.new,
           Codesake::Dawn::Kb::CVE_2014_2538.new,
         ]
         # END @cve_security_checks array
@@ -458,8 +461,8 @@ module Codesake
           Codesake::Dawn::Kb::OwaspRorCheatSheet::CommandInjection.new,
           Codesake::Dawn::Kb::OwaspRorCheatSheet::Csrf.new,
           Codesake::Dawn::Kb::OwaspRorCheatSheet::SessionStoredInDatabase.new,
-          Codesake::Dawn::Kb::OwaspRorCheatSheet::MassAssignmentInModel.new, 
-          Codesake::Dawn::Kb::OwaspRorCheatSheet::SecurityRelatedHeaders.new, 
+          Codesake::Dawn::Kb::OwaspRorCheatSheet::MassAssignmentInModel.new,
+          Codesake::Dawn::Kb::OwaspRorCheatSheet::SecurityRelatedHeaders.new,
           Codesake::Dawn::Kb::OwaspRorCheatSheet::CheckForSafeRedirectAndForward.new,
           Codesake::Dawn::Kb::OwaspRorCheatSheet::SensitiveFiles.new,
         ]

data/lib/codesake/dawn/version.rb

@@ -19,10 +19,10 @@ module Codesake
     # |   "Luigi"       |  7.0.0  |
     # | "Doc Hudson"    |  8.0.0  |
 
-    VERSION   = "1.1.0.rc2"
+    VERSION   = "1.1.0"
     CODENAME  = "Lightning McQueen"
     #RELEASE   = "(development)"
-    RELEASE   = "20140328"
+    RELEASE   = "20140404"
 
   end
 end

data/spec/lib/dawn/codesake_knowledgebase_spec.rb

@@ -882,4 +882,9 @@ end
         sc.should_not   be_nil
           sc.class.should == Codesake::Dawn::Kb::CVE_2013_4203
   end
+  it "must have test for CVE-2014-2525" do
+      sc = kb.find("CVE-2014-2525")
+        sc.should_not   be_nil
+          sc.class.should == Codesake::Dawn::Kb::CVE_2014_2525
+  end
 end

data/spec/lib/kb/cve_2014_2538_spec.rb

@@ -4,13 +4,12 @@ describe "The CVE-2014-2538 vulnerability" do
 		@check = Codesake::Dawn::Kb::CVE_2014_2538.new
 		# @check.debug = true
 	end
-  it "is reported when rack-ssl vulnerable version it has been found (1.4.0)" do
-    @check.dependencies = [{:name=>'rack-ssl', :version=>'1.4.0'}]
+  it "is reported when rack-ssl vulnerable version it has been found (1.3.9)" do
+    @check.dependencies = [{:name=>'rack-ssl', :version=>'1.3.9'}]
     @check.vuln?.should   be_true
   end
-  it "is reported when rack-ssl not vulnerable version it has been found (1.5.0)" do
-    @check.dependencies = [{:name=>'rack-ssl', :version=>'1.5.0'}]
+  it "is reported when rack-ssl not vulnerable version it has been found (1.4.0)" do
+    @check.dependencies = [{:name=>'rack-ssl', :version=>'1.4.0'}]
     @check.vuln?.should   be_false
   end
-  it "must be filled with CVSS information"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: codesake-dawn
 version: !ruby/object:Gem::Version
-  version: 1.1.0.rc2
+  version: 1.1.0
 platform: ruby
 authors:
 - Paolo Perego
@@ -30,7 +30,7 @@ cert_chain:
   Fh7BfxFDBZdj1mI2V+I+IYYMPKIouvwX3r7NTZgZ4TYuKVpOk9VSCxzhrPhnl4kb
   1LyVQIFlhF6nL0casp0ixer8N60=
   -----END CERTIFICATE-----
-date: 2014-03-28 00:00:00.000000000 Z
+date: 2014-04-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: codesake-commons
@@ -282,10 +282,12 @@ files:
 - bin/dawn
 - certs/paolo_at_codesake_dot_com.pem
 - checksum/.placeholder
+- checksum/codesake-dawn-1.1.0.gem.sha512
 - checksum/codesake-dawn-1.1.0.rc1.gem.sha512
 - codesake-dawn.gemspec
 - doc/codesake-dawn.yaml.sample
 - doc/dawn_1_0_announcement.md
+- doc/dawn_1_1_announcement.md
 - features/dawn_complains_about_an_incorrect_command_line.feature.disabled
 - features/dawn_scan_a_secure_sinatra_app.feature.disabled
 - features/dawn_scan_a_vulnerable_sinatra_app.feature.disabled
@@ -457,6 +459,7 @@ files:
 - lib/codesake/dawn/kb/cve_2014_1233.rb
 - lib/codesake/dawn/kb/cve_2014_1234.rb
 - lib/codesake/dawn/kb/cve_2014_2322.rb
+- lib/codesake/dawn/kb/cve_2014_2525.rb
 - lib/codesake/dawn/kb/cve_2014_2538.rb
 - lib/codesake/dawn/kb/dependency_check.rb
 - lib/codesake/dawn/kb/deprecation_check.rb
@@ -557,9 +560,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 1.9.2
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>'
+  - - '>='
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubyforge_project: 
 rubygems_version: 2.1.11