Skip to content

Commit 4921d43

Browse files
reedlodenreedloden
committed
Sync with GitHub Security Advisories
* Add exiftool_vendored/GHSA-q95h-cqrv-8jv5, fat_free_crm/CVE-2019-10226, publify_core/CVE-2022-2815, publify_core/CVE-2023-0299, sisimai/CVE-2022-4891 * Update CVSSv3 for fat_free_crm/CVE-2015-1585
1 parent 6a79ac9 commit 4921d43

File tree

6 files changed

+92
-2
lines changed

6 files changed

+92
-2
lines changed

‎gems/exiftool_vendored/GHSA-q95h-cqrv-8jv5.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
gem: exiftool_vendored
3+
ghsa: q95h-cqrv-8jv5
4+
url: https://github.com/exiftool-rb/exiftool_vendored.rb/security/advisories/GHSA-q95h-cqrv-8jv5
5+
title: ExifTool vulnerable to arbitrary code execution
6+
date: 2023-01-20
7+
description: |-
8+
### Impact
9+
Arbitrary code execution can occur when running `exiftool` against files with hostile metadata payloads
10+
11+
### Patches
12+
ExifTool has already been patched in version 12.24. `exiftool_vendored.rb`, which vendors ExifTool, includes this patch in [v12.25.0](https://github.com/exiftool-rb/exiftool_vendored.rb/releases/tag/v12.25.0).
13+
14+
### Workarounds
15+
No
16+
cvss_v3: 7.8
17+
patched_versions:
18+
- ">= 12.25.0"
19+
related:
20+
url:
21+
- https://twitter.com/wcbowling/status/1385803927321415687
22+
cve:
23+
- 2021-22204

‎gems/fat_free_crm/CVE-2015-1585.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
---
22
gem: fat_free_crm
3-
osvdb: 118465
43
cve: 2015-1585
4+
osvdb: 118465
5+
ghsa: wx7c-8j35-mpg8
56
url: https://nvd.nist.gov/vuln/detail/CVE-2015-1585
67
title: Fat Free CRM Gem being vulnerable to CSRF-type attacks
78
date: 2015-02-16
@@ -14,4 +15,4 @@ description: |
1415
users.
1516
cvss_v2: 6.8
1617
patched_versions:
17-
- '>= 0.13.6'
18+
- ">= 0.13.6"

‎gems/fat_free_crm/CVE-2019-10226.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
gem: fat_free_crm
3+
cve: 2019-10226
4+
ghsa: gmg5-r3c4-3fm9
5+
url: http://packetstormsecurity.com/files/152263/Fat-Free-CRM-0.19.0-HTML-Injection.html
6+
title: Fat Free CRM Cross-site Scripting vulnerability
7+
date: 2022-05-24
8+
description: |
9+
HTML Injection has been discovered in the v0.19.0 version of the Fat
10+
Free CRM product via an authenticated request to the /comments URI.
11+
cvss_v3: 5.4

‎gems/publify_core/CVE-2022-2815.yml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
gem: publify_core
3+
cve: 2022-2815
4+
ghsa: 79wq-g4v9-gfj4
5+
url: https://github.com/publify/publify/commit/af69097d349f4c00f244c51cd3c3e937fd3387cd
6+
title: Publify Core does not strip metadata from images
7+
date: 2023-01-14
8+
description: |
9+
Insecure Storage of Sensitive Information in GitHub repository publify/publify
10+
prior to 9.2.10.
11+
cvss_v3: 6.5
12+
patched_versions:
13+
- ">= 9.2.10"
14+
related:
15+
url:
16+
- https://huntr.dev/bounties/22fdcc39-8c1a-4e4c-8eae-be3fd764f8b4
17+
- https://github.com/publify/publify_core/commit/33f897c12b6efdcdfd8cf9df924deba0f878b71e

‎gems/publify_core/CVE-2023-0299.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
gem: publify_core
3+
cve: 2023-0299
4+
ghsa: q3rm-f527-ghxj
5+
url: https://github.com/publify/publify/commit/ca46da283572b4f8c0b5aa245008756c8a5fd1b1
6+
title: Publify Improper Input Validation vulnerability
7+
date: 2023-01-14
8+
description: |
9+
Improper Input Validation in GitHub repository publify/publify prior
10+
to 9.2.10.
11+
patched_versions:
12+
- ">= 9.2.10"
13+
related:
14+
url:
15+
- https://huntr.dev/bounties/0049774b-1857-46dc-a834-f1fb15138c53
16+
- https://github.com/publify/publify_core/commit/34f6e9c98e0e3b3f9896f9676b3d6442220e2b4e

‎gems/sisimai/CVE-2022-4891.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
gem: sisimai
3+
cve: 2022-4891
4+
ghsa: vm74-j4wq-82xj
5+
url: https://github.com/sisimai/rb-sisimai/pull/244
6+
title: Sisimai Inefficient Regular Expression Complexity vulnerability
7+
date: 2023-01-17
8+
description: |
9+
A vulnerability has been found in Sisimai up to 4.25.14p11 and classified
10+
as problematic. This vulnerability affects the function `to_plain` of the file `lib/sisimai/string.rb`.
11+
The manipulation leads to inefficient regular expression complexity. The exploit
12+
has been disclosed to the public and may be used. Upgrading to version 4.25.14p12
13+
is able to address this issue. The name of the patch is 51fe2e6521c9c02b421b383943dc9e4bbbe65d4e.
14+
It is recommended to upgrade the affected component.
15+
patched_versions:
16+
- ">= 4.25.14p12"
17+
related:
18+
url:
19+
- https://github.com/sisimai/rb-sisimai/commit/51fe2e6521c9c02b421b383943dc9e4bbbe65d4e
20+
- https://gist.githubusercontent.com/gmcabrita/e5dc0332473fc2e3a7a407434c8d21c7/raw/00b12035e5e1b685469f143b94301a50306376ba/example.html
21+
- https://github.com/sisimai/rb-sisimai/releases/tag/v4.25.14p12
22+
- https://vuldb.com/?id.218452

0 commit comments

Comments
 (0)