dawnscanner 1.6.0 → 1.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 380c6df2bc5c7d61d6c1b7ada8fb8a56c4a39bb5
-  data.tar.gz: 34245bac1ac6e5b254913388003ca484dd793f6c
+  metadata.gz: 5740023a35a5d8e109e8b6dd5b973f2e82e7285d
+  data.tar.gz: 2cebe55d93ff7dd1b41590dd45edbbe8567e8cc6
 SHA512:
-  metadata.gz: 114a8bf87ec4a07107c74dc843709a642e9bce77e9373384f304538ca3613ff1bcb3eba37bb564b91a505761ebdbe8cf8728a4617df42c210ceca1879feeb9c8
-  data.tar.gz: 3eb5f35bb5acbe11f3bb94d8554d5f6b24142778513ae07256deeab3ecca1289c4d0f55c010bb0706fc0c3f366caa3db247047c1595b6dbb593883bc0ef41ad7
+  metadata.gz: cae38046b407a09d88603392b4a20119a5313bfa4ea39c1891db46a3d80ee78e083fb46092118372596d49761df7d16d6d520dbae13cba9a5a77da3cc08e1765
+  data.tar.gz: 3acfb88214793e28aac716694c783e42fb8f2c0b385d2e69041ccd13bc1c70244450bc3dfeabaffe833373de6d755c7b3db9144e0a3cc9b87b8fb10915260282

data/Changelog.md

@@ -5,7 +5,12 @@ It supports [Sinatra](http://www.sinatrarb.com),
 [Padrino](http://www.padrinorb.com) and [Ruby on Rails](http://rubyonrails.org)
 frameworks.
 
-_latest update: Wed Feb  3 10:59:00 CET 2016_
+_latest update: Wed Feb 24 10:15:17 CET 2016_
+
+## Version 1.6.1 - codename: Tow Mater (2016-02-24)
+
+* Issue #191 - Fixing an issue, applying a pull request by @fronzeSolid, about
+  CVE-2015-1820 false positive in check description.
 
 ## Version 1.6.0 - codename: Tow Mater (2016-02-03)
 

data/README.md

@@ -24,7 +24,7 @@ box:
 
 ---
 
-dawnscanner version 1.6.0 has 227 security checks loaded in its knowledge
+dawnscanner version 1.6.1 has 227 security checks loaded in its knowledge
 base. Most of them are CVE bulletins applying to gems or the ruby interpreter
 itself. There are also some check coming from Owasp Ruby on Rails cheatsheet.
 

data/VERSION

@@ -12,4 +12,4 @@
 # |   "Guido"       |  x.x.0  |
 # |   "Luigi"       |  x.x.0  |
 # | "Doc Hudson"    |  x.x.0  |
-1.6.0 - Tow Mater
+1.6.1 - Tow Mater

data/certs/paolo_at_dawnscanner_dot_org.pem

@@ -1,7 +1,7 @@
 -----BEGIN CERTIFICATE-----
 MIIDfDCCAmSgAwIBAgIBATANBgkqhkiG9w0BAQUFADBCMQ4wDAYDVQQDDAVwYW9s
 bzEbMBkGCgmSJomT8ixkARkWC2Rhd25zY2FubmVyMRMwEQYKCZImiZPyLGQBGRYD
-b3JnMB4XDTE1MDIxODA5NTkwMloXDTE2MDIxODA5NTkwMlowQjEOMAwGA1UEAwwF
+b3JnMB4XDTE2MDIyNDA5MjAzMloXDTE3MDIyMzA5MjAzMlowQjEOMAwGA1UEAwwF
 cGFvbG8xGzAZBgoJkiaJk/IsZAEZFgtkYXduc2Nhbm5lcjETMBEGCgmSJomT8ixk
 ARkWA29yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKY7klJMYUud
 10+6gsb1R7Vvnn96BpVc6sPXxInmQeoaQCZ4lT04ARfya7M6E5NHQDjCtSxv2Nib
@@ -12,10 +12,10 @@ a3yXoWmTlnnxAlJUqSGn83n7r1roHasdT7KzhPmAQ42qh6FrjbkQl/jdJA2fl3I3
 F0+emUMo9J8CAwEAAaN9MHswCQYDVR0TBAIwADALBgNVHQ8EBAMCBLAwHQYDVR0O
 BBYEFGrgDWYLVLOvh1i9ValuYILfIy7rMCAGA1UdEQQZMBeBFXBhb2xvQGRhd25z
 Y2FubmVyLm9yZzAgBgNVHRIEGTAXgRVwYW9sb0BkYXduc2Nhbm5lci5vcmcwDQYJ
-KoZIhvcNAQEFBQADggEBAHUtvMzOpPpdJUdUDOHk6mcjj2YgqbS96xg5Q+NxN6ff
-UWRuTNMccWT5rdp/vU0+SVa6yrVX1yl5C+HSk78hAclANfBgf46d0mpkuCincxg1
-7W1Ud+M92Zpzg7pIG1SYxEre8sdSvDltlB2cmWqsSkRG7nKQ0wxbURhcQBR5qh7D
-wRoXHFQ+jkY/h93oO8VhJW6rcFB64603Zj/gzk9/x+wiYgrio2/eDtkHOmFCo1ks
-1zH2rpK27DW5pOeHUEJn31+gGd111ogP5tYruPV7Qgfy2jUrUPmP67v7nRNlgd84
-Z5mHj9jGk4wgMQy2pk4GDwsXiirZfI0z2WZfySqEldE=
+KoZIhvcNAQEFBQADggEBACGgU0g0JdsxMCAVu485qXfNYSgCHzJ3R+wMThHg/kn9
++eJLlpFtdM4WsYuFDa+kyk8Gzbb9yWo327SqA+KMzrOr9y5Xyn0UARnNzZ4/N258
++8Dj2CGATlFzPjREEihAW3CcuoLhojhDOVA4tpmrcxX9ynV7Jm2m8lGvcic6VfVg
+yV368nbU6S1n4Tz7I5TAdEsI8+Zk6VLVuPRbgY+W8iePoBSxrI+CdA4+iB12O+yM
+jm6Bw8fGx65GCWIdgMhH/P0icixcnyrnotnnOrEcmPudIlgEN9qaUYcguOfFBhTH
+1sGpM7KzrYHU8qJJPrdaX0ezIDL4cN/kA/DxYTfUiMw=
 -----END CERTIFICATE-----

data/checksum/dawnscanner-1.6.0.gem.sha1

@@ -0,0 +1 @@
+0dac5523c5b788786b877f3e2f7d66358a3bf726

data/lib/dawn/kb/osvdb_119878.rb

@@ -8,7 +8,7 @@ module Dawn
 				# include RubyVersionCheck
 
 				def initialize
-          message="ret-client Gem for Ruby contains a flaw in abstract_response.rb related to the handling of set-cookie headers in redirection responses that allows a remote, user-assisted attacker to conduct a session fixation attack. This flaw exists because the application, when establishing a new session, does not invalidate an existing session identifier and assign a new one. With a specially crafted request fixating the session identifier, a context-dependent attacker can ensure a user authenticates with the known session identifier, allowing the session to be subsequently hijacked."
+          message="rest-client Gem for Ruby contains a flaw in abstract_response.rb related to the handling of set-cookie headers in redirection responses that allows a remote, user-assisted attacker to conduct a session fixation attack. This flaw exists because the application, when establishing a new session, does not invalidate an existing session identifier and assign a new one. With a specially crafted request fixating the session identifier, a context-dependent attacker can ensure a user authenticates with the known session identifier, allowing the session to be subsequently hijacked."
 
           super({
             :name=> "OSVDB_119878",
@@ -21,10 +21,10 @@ module Dawn
             :applies=>["rails", "sinatra", "padrino"],
             :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
             :message=>message,
-            :mitigation=>"Please upgrade rest-client gem version to 2.0.0.rc1 or later.",
-            :aux_links=>[""]
+            :mitigation=>"Please upgrade rest-client gem version to 1.8.0 or later.",
+            :aux_links=>["https://github.com/rest-client/rest-client/issues/369"]
            })
-          self.safe_dependencies = [{:name=>"rest-client", :version=>['2.0.0.rc1']}]
+          self.safe_dependencies = [{:name=>"rest-client", :version=>['1.8.0', '2.0.0.rc1', '2.0.0.rc2']}]
 
 				end
 			end

data/lib/dawn/version.rb

@@ -1,7 +1,7 @@
 module Dawn
-    VERSION = "1.6.0"
+    VERSION = "1.6.1"
     CODENAME = "Tow Mater"
-    RELEASE = "20160203"
-    BUILD = "23"
-    COMMIT = "g46c66f6"
+    RELEASE = "20160224"
+    BUILD = "8"
+    COMMIT = "g3e4217f"
 end

data/spec/lib/kb/osvdb_119878_spec.rb

@@ -4,13 +4,89 @@ describe "The OSVDB_119878 vulnerability" do
 		@check = Dawn::Kb::OSVDB_119878.new
 		# @check.debug = true
 	end
-  it "is reported when a vulnerable version it has been found (1.8.0)" do
-    @check.dependencies = [{:name=>"rest-client", :version=>"1.8.0"}]
+  it "is reported when a vulnerable version it has been found (1.6.1.a)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.6.1.a"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.6.1)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.6.1"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.6.2" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.6.2"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.6.2.a" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.6.2.a"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.6.3)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.6.3"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.6.4)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.6.4"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.6.5)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.6.5"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.6.6)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.6.6"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.6.7)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.6.7"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.6.8)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.6.8"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.6.8.rc1)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.6.8.rc1"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.6.9)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.6.9"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.7.0.rc1)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.7.0.rc1"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.7.0)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.7.0"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.7.1)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.7.1"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.7.2)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.7.2"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.7.2.rc1)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.7.2.rc1"}]
+    @check.vuln?.should   == true
+  end
+  it "is reported when a vulnerable version it has been found (1.7.3)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.7.3"}]
     @check.vuln?.should   == true
   end
+  it "is not reported when a safe version it has been found (1.8.0)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"1.8.0"}]
+    @check.vuln?.should   == false
+  end
   it "is not reported when a safe version it has been found (2.0.0.rc1)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"2.0.0.rc1"}]
     @check.vuln?.should   == false
   end
+  it "is not reported when a safe version it has been found (2.0.0.rc2)" do
+    @check.dependencies = [{:name=>"rest-client", :version=>"2.0.0.rc2"}]
+    @check.vuln?.should   == false
+  end
 
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dawnscanner
 version: !ruby/object:Gem::Version
-  version: 1.6.0
+  version: 1.6.1
 platform: ruby
 authors:
 - Paolo Perego
@@ -12,7 +12,7 @@ cert_chain:
   -----BEGIN CERTIFICATE-----
   MIIDfDCCAmSgAwIBAgIBATANBgkqhkiG9w0BAQUFADBCMQ4wDAYDVQQDDAVwYW9s
   bzEbMBkGCgmSJomT8ixkARkWC2Rhd25zY2FubmVyMRMwEQYKCZImiZPyLGQBGRYD
-  b3JnMB4XDTE1MDIxODA5NTkwMloXDTE2MDIxODA5NTkwMlowQjEOMAwGA1UEAwwF
+  b3JnMB4XDTE2MDIyNDA5MjAzMloXDTE3MDIyMzA5MjAzMlowQjEOMAwGA1UEAwwF
   cGFvbG8xGzAZBgoJkiaJk/IsZAEZFgtkYXduc2Nhbm5lcjETMBEGCgmSJomT8ixk
   ARkWA29yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKY7klJMYUud
   10+6gsb1R7Vvnn96BpVc6sPXxInmQeoaQCZ4lT04ARfya7M6E5NHQDjCtSxv2Nib
@@ -23,14 +23,14 @@ cert_chain:
   F0+emUMo9J8CAwEAAaN9MHswCQYDVR0TBAIwADALBgNVHQ8EBAMCBLAwHQYDVR0O
   BBYEFGrgDWYLVLOvh1i9ValuYILfIy7rMCAGA1UdEQQZMBeBFXBhb2xvQGRhd25z
   Y2FubmVyLm9yZzAgBgNVHRIEGTAXgRVwYW9sb0BkYXduc2Nhbm5lci5vcmcwDQYJ
-  KoZIhvcNAQEFBQADggEBAHUtvMzOpPpdJUdUDOHk6mcjj2YgqbS96xg5Q+NxN6ff
-  UWRuTNMccWT5rdp/vU0+SVa6yrVX1yl5C+HSk78hAclANfBgf46d0mpkuCincxg1
-  7W1Ud+M92Zpzg7pIG1SYxEre8sdSvDltlB2cmWqsSkRG7nKQ0wxbURhcQBR5qh7D
-  wRoXHFQ+jkY/h93oO8VhJW6rcFB64603Zj/gzk9/x+wiYgrio2/eDtkHOmFCo1ks
-  1zH2rpK27DW5pOeHUEJn31+gGd111ogP5tYruPV7Qgfy2jUrUPmP67v7nRNlgd84
-  Z5mHj9jGk4wgMQy2pk4GDwsXiirZfI0z2WZfySqEldE=
+  KoZIhvcNAQEFBQADggEBACGgU0g0JdsxMCAVu485qXfNYSgCHzJ3R+wMThHg/kn9
+  +eJLlpFtdM4WsYuFDa+kyk8Gzbb9yWo327SqA+KMzrOr9y5Xyn0UARnNzZ4/N258
+  +8Dj2CGATlFzPjREEihAW3CcuoLhojhDOVA4tpmrcxX9ynV7Jm2m8lGvcic6VfVg
+  yV368nbU6S1n4Tz7I5TAdEsI8+Zk6VLVuPRbgY+W8iePoBSxrI+CdA4+iB12O+yM
+  jm6Bw8fGx65GCWIdgMhH/P0icixcnyrnotnnOrEcmPudIlgEN9qaUYcguOfFBhTH
+  1sGpM7KzrYHU8qJJPrdaX0ezIDL4cN/kA/DxYTfUiMw=
   -----END CERTIFICATE-----
-date: 2016-02-03 00:00:00.000000000 Z
+date: 2016-02-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cvss
@@ -314,6 +314,7 @@ files:
 - checksum/dawnscanner-1.5.0.gem.sha1
 - checksum/dawnscanner-1.5.1.gem.sha1
 - checksum/dawnscanner-1.5.2.gem.sha1
+- checksum/dawnscanner-1.6.0.gem.sha1
 - dawnscanner.gemspec
 - doc/dawn_1_0_announcement.md
 - doc/dawn_1_1_announcement.md