dawnscanner 1.6.9 → 2.0.0.rc1

data/lib/dawn/kb/cve_2015_7519.rb

@@ -1,31 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-02-02
-			class CVE_2015_7519
-				# Include the testing skeleton for this CVE
-				include DependencyCheck
-
-				def initialize
-          message ="agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header."
-          super({
-            :title=>title,
-            :name=> "CVE-2015-7519",
-            :cve=>"2015-7519",
-            :osvdb=>"",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2016, 1, 8),
-            :cwe=>"119",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade passenger gem to version 4.0.60, 5.0.22 or later.",
-            :aux_links=>["https://blog.phusion.nl/2015/12/07/cve-2015-7519/"]
-           })
-
-          self.safe_dependencies = [{:name=>"passenger", :version=>['4.0.60', '5.0.22']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_7541.rb

@@ -1,31 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-02-02
-			class CVE_2015_7541
-				# Include the testing skeleton for this CVE
-				include DependencyCheck
-
-				def initialize
-          message = "The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable."
-           super({
-            :title=>title,
-            :name=> "CVE-2015-7541",
-            :cve=>"2015-7541",
-            :osvdb=>"",
-            :cvss=>"AV:N/AC:L/Au:N/C:C/I:C/A:C",
-            :release_date => Date.new(2016, 1, 8),
-            :cwe=>"77",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade colorscore gem to version 0.0.5 or later.",
-            :aux_links=>["http://seclists.org/oss-sec/2016/q1/17"]
-           })
-
-           self.safe_dependencies = [{:name=>"colorscore", :version=>['0.0.5']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_7576.rb

@@ -1,35 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-01-28
-			class CVE_2015_7576
-				# Include the testing skeleton for this CVE
-				# include PatternMatchCheck
-				include DependencyCheck
-				# include RubyVersionCheck
-
-				def initialize
-          message = "There is a timing attack vulnerability in the basic authentication support in Action Controller. Due to the way that Action Controller compares user names and passwords in basic authentication authorization code, it is possible for an attacker to analyze the time taken by a response and intuit the password."
-          super({
-            :title=>title,
-            :name=> "CVE-2015-7576",
-            :cve=>"2015-7576",
-            :osvdb=>"",
-            :cvss=>"",
-            :release_date => Date.new(2016, 1, 26),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade actionpack gem to version 3.2.22.1, 4.1.14.1, 4.2.5.1, 5.0.0.beta1.1 or later.",
-            :aux_links=>["http://securitytracker.com/id/1034816"]
-           })
-          self.save_minor=true
-          self.save_major=true
-          self.safe_dependencies = [{:name=>"actionpack", :version=>['3.2.22.1', '4.1.14.1', '4.2.5.1', '5.0.0.beta1.1']}]
-
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_7577.rb

@@ -1,34 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-01-29
-			class CVE_2015_7577
-				# Include the testing skeleton for this CVE
-				include DependencyCheck
-
-				def initialize
-          message = "There is a vulnerability in how the nested attributes feature in Active Record handles updates in combination with destroy flags when destroying records is disabled."
-          super({
-            :title=>title,
-            :name=> "CVE-2015-7577",
-            :cve=>"2015-7577",
-            :osvdb=>"",
-            :cvss=>"",
-            :release_date => Date.new(2016, 1, 26),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade activerecord gem to version 3.2.22.1, 4.1.14.1, 4.2.5.1, 5.0.0.beta1.1 or later.",
-            :aux_links=>["http://securitytracker.com/id/1034816", "https://groups.google.com/forum/#!topic/rubyonrails-security/cawsWcQ6c8g"]
-           })
-          self.save_minor=true
-          self.save_major=true
-          # self.debug = true
-          self.safe_dependencies = [{:name=>"activerecord", :version=>['3.1.9999','3.2.22.1', '4.1.14.1', '4.2.5.1', '5.0.0.beta1.1']}]
-          self.not_affected = {:name=>"actionpack", :version=>['3.0.x']}
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_7578.rb

@@ -1,30 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-02-01
-			class CVE_2015_7578
-				# Include the testing skeleton for this CVE
-				include DependencyCheck
-
-				def initialize
-          message = "There is a possible XSS vulnerability in rails-html-sanitizer. Certain attributes are not removed from tags when they are sanitized, and these attributes can lead to an XSS attack on target applications."
-           super({
-            :title=>title,
-            :name=> "CVE-2015-7578",
-            :cve=>"2015-7578",
-            :osvdb=>"",
-            :cvss=>"",
-            :release_date => Date.new(2016, 1, 26),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails-html-sanitizer gem to version 1.0.3 or later.",
-            :aux_links=>["http://securitytracker.com/id/1034816"]
-           })
-           self.safe_dependencies = [{:name=>"rails-html-sanitizer", :version=>['1.0.3']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_7579.rb

@@ -1,30 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-01-31
-			class CVE_2015_7579
-				include DependencyCheck
-
-				def initialize
-          message = "There is a XSS vulnerability in Rails::Html::FullSanitizer used by Action View's strip_tags. Due to the way that Rails::Html::FullSanitizer is implemented, if an attacker passes an already escaped HTML entity to the input of Action View's strip_tags these entities will be unescaped what may cause a XSS attack if used in combination with raw or html_safe."
-          super({
-            :title=>title,
-            :name=> "CVE-2015-7579",
-            :cve=>"2015-7579",
-            :osvdb=>"",
-            :cvss=>"",
-            :release_date => Date.new(2016, 1, 26),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails-html-sanitizer to version 1.0.3 or later.",
-            :aux_links=>["http://securitytracker.com/id/1034816"]
-           })
-          self.safe_dependencies = [{:name=>"rails-html-sanitizer", :version=>['1.0.3']}]
-          self.not_affected = {:name=>"rails-html-sanitizer", :version=>['1.0.0', '1.0.1']}
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_7581.rb

@@ -1,33 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-02-01
-			class CVE_2015_7581
-				# Include the testing skeleton for this CVE
-				include DependencyCheck
-
-				def initialize
-          message = "There is an object leak vulnerability for wildcard controllers in Action Pack. Users that have a route that contains the string \":controller\" are susceptible to objects being leaked globally which can lead to unbounded memory growth. "
-            super({
-            :title=>title,
-            :name=> "CVE-2015-7581",
-            :cve=>"2015-7581",
-            :osvdb=>"",
-            :cvss=>"",
-            :release_date => Date.new(2016, 1, 26),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade actionpack gem to version 3.2.22.1, 4.1.14.1, 4.2.5.1, 5.0.0.beta1.1 or later.",
-            :aux_links=>["http://securitytracker.com/id/1034816"]
-           })
-          self.save_minor=true
-          self.save_major=true
-          self.safe_dependencies = [{:name=>"actionpack", :version=>['3.2.22.1', '4.1.14.1', '4.2.5.1', '5.0.0.beta1.1']}]
-
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_8241.rb

@@ -1,32 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-02-02
-			class CVE_2015_8241
-				# Include the testing skeleton for this CVE
-				include DependencyCheck
-
-				def initialize
-          message ="The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data."
-           super({
-            :title=>title,
-            :name=> "CVE-2015-8241",
-            :cve=>"2015-8241",
-            :osvdb=>"",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:N/A:P",
-            :release_date => Date.new(2015, 12, 15),
-            :cwe=>"119",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade nokogiri gem to version 1.6.7.1 or later.",
-            :aux_links=>["https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s"]
-           })
-
-           self.safe_dependencies = [{:name=>"nokogiri", :version=>['1.6.7.1']}]
-           self.not_affected = {:name=>"nokogiri", :version=>['1.5.x', '1.4.x', '1.3.x', '1.1.x', '1.0.x', '0.x.x']}
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_8242.rb

@@ -1,32 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-02-02
-			class CVE_2015_8242
-				# Include the testing skeleton for this CVE
-				include DependencyCheck
-
-				def initialize
-          message = "The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data."
-          super({
-            :title=>title,
-            :name=> "CVE-2015-8242",
-            :cve=>"2015-8242",
-            :osvdb=>"",
-            :cvss=>"AV:N/AC:M/Au:N/C:P/I:N/A:P",
-            :release_date => Date.new(2015, 12, 15),
-            :cwe=>"119",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade nokogiri gem to version 1.6.7.1 or later.",
-            :aux_links=>["https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s"]
-           })
-
-           self.safe_dependencies = [{:name=>"nokogiri", :version=>['1.6.7.1']}]
-           self.not_affected = {:name=>"nokogiri", :version=>['1.5.x', '1.4.x', '1.3.x', '1.1.x', '1.0.x', '0.x.x']}
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_8317.rb

@@ -1,32 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-02-02
-			class CVE_2015_8317
-				# Include the testing skeleton for this CVE
-				include DependencyCheck
-
-				def initialize
-          message = "The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read"
-           super({
-            :title=>title,
-            :name=> "CVE-2015-8317",
-            :cve=>"2015-8317",
-            :osvdb=>"",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:N/A:N",
-            :release_date => Date.new(2015, 12, 15),
-            :cwe=>"119",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade nokogiri gem to version 1.6.7.1 or later.",
-            :aux_links=>["https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s"]
-           })
-
-           self.safe_dependencies = [{:name=>"nokogiri", :version=>['1.6.7.1']}]
-           self.not_affected = {:name=>"nokogiri", :version=>['1.5.x', '1.4.x', '1.3.x', '1.1.x', '1.0.x', '0.x.x']}
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2016_0751.rb

@@ -1,32 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-01-28
-			class CVE_2016_0751
-				# Include the testing skeleton for this CVE
-				include DependencyCheck
-
-				def initialize
-          message = "There is a possible object leak which can lead to a denial of service vulnerability in Action Pack. A carefully crafted accept header can cause a global cache of mime types to grow indefinitely which can lead to a possible denial of service attack in Action Pack."
-          super({
-            :title=>title,
-            :name=> "CVE-2016-0751",
-            :cve=>"2016-0751",
-            :osvdb=>"",
-            :cvss=>"",
-            :release_date => Date.new(2016, 1, 26),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade actionpack gem to version 3.2.22.1, 4.1.14.1, 4.2.5.1, 5.0.0.beta1.1 or later.",
-            :aux_links=>["http://securitytracker.com/id/1034816"]
-           })
-          self.save_minor=true
-          self.save_major=true
-          self.safe_dependencies = [{:name=>"actionpack", :version=>['3.2.22.1', '4.0.9999', '4.1.14.1', '4.2.5.1', '5.0.0.beta1.1']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2016_0752.rb

@@ -1,35 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-01-31
-			class CVE_2016_0752
-				# Include the testing skeleton for this CVE
-				# include PatternMatchCheck
-				include DependencyCheck
-				# include RubyVersionCheck
-
-				def initialize
-          message = "There is a possible directory traversal and information leak vulnerability in Action View. Applications that pass unverified user input to the render method in a controller may be vulnerable to an information leak vulnerability."
-          super({
-            :title=>title,
-            :name=> "CVE-2016-0752",
-            :cve=>"2016-0752",
-            :osvdb=>"",
-            :cvss=>"",
-            :release_date => Date.new(2016, 1, 26),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade actionview gem to version 3.2.22.1, 4.1.14.1, 4.2.5.1, 5.0.0.beta1.1 or later.",
-            :aux_links=>["http://securitytracker.com/id/1034816"]
-           })
-          self.save_minor=true
-          self.save_major=true
-          self.safe_dependencies = [{:name=>"actionview", :version=>['3.2.22.1', '4.1.14.1', '4.2.5.1', '5.0.0.beta1.1']}]
-
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2016_0753.rb

@@ -1,31 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-02-01
-			class CVE_2016_0753
-				include DependencyCheck
-
-				def initialize
-          message = "There is a possible input validation circumvention vulnerability in Active Model. Code that uses Active Model based models (including Active Record models) and does not validate user input before passing it to the model can be subject to an attack where specially crafted input will cause the model to skip validations."
-           super({
-            :title=>title,
-            :name=> "CVE-2016-0753",
-            :cve=>"2016-0753",
-            :osvdb=>"",
-            :cvss=>"",
-            :release_date => Date.new(2016, 1, 26),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade activemodel gem to version 3.2.22.1, 4.1.14.1, 4.2.5.1, 5.0.0.beta1.1 or later.",
-            :aux_links=>["http://securitytracker.com/id/1034816"]
-           })
-          self.save_minor=true
-          self.save_major=true
-          self.safe_dependencies = [{:name=>"activemodel", :version=>['3.2.22.1', '4.1.14.1', '4.2.5.1', '5.0.0.beta1.1']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2016_2097.rb

@@ -1,35 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-03-01
-			class CVE_2016_2097
-				# Include the testing skeleton for this CVE
-				# include PatternMatchCheck
-				include DependencyCheck
-				# include RubyVersionCheck
-
-				def initialize
-         message = "Possible Information Leak Vulnerability in Action View. There is a possible directory traversal and information leak vulnerability in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 patch was not covering all the scenarios."
-          title = "Possible Information Leak Vulnerability in Action View"
-          super({
-            :title=>title,
-            :name=> "CVE-2016-2097",
-            :cve=>"2016-2097",
-            :osvdb=>"",
-            :cvss=>"",
-            :release_date => Date.new(2016, 2, 29),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade actionview gem to version 3.2.22.2, 4.1.14.2 or later.",
-            :aux_links=>[]
-           })
-          self.safe_dependencies = [{:name=>"actionview", :version=>['3.2.22.2', '4.0.99', '4.1.14.2', '5.0.0']}]
-          self.save_minor = true
-          self.save_major = true
- 
-				end
-			end
-		end
-end