Skip to content

Commit 6a79ac9

Browse files
reedlodenreedloden
committed
Sync with GitHub Security Advisories
* Add curupira/CVE-2015-10053 * Add rack/CVE-2022-44571 * Add actionpack/CVE-2023-22792 * Add activesupport/CVE-2023-22796 * Add actionpack/CVE-2023-22797 * Add activerecord/CVE-2022-44566 * Add actionpack/CVE-2023-22795 * Add activerecord/CVE-2023-22794 * Add rack/CVE-2022-44570 * Add rack/CVE-2022-44572 * Add globalid/CVE-2023-22799
1 parent 9a50a4f commit 6a79ac9

File tree

11 files changed

+388
-0
lines changed

11 files changed

+388
-0
lines changed

‎gems/actionpack/CVE-2023-22792.yml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
gem: actionpack
3+
cve: 2023-22792
4+
ghsa: p84v-45xj-wwqj
5+
url: https://github.com/rails/rails/releases/tag/v7.0.4.1
6+
title: ReDoS based DoS vulnerability in Action Dispatch
7+
date: 2023-01-18
8+
description: |
9+
There is a possible regular expression based DoS vulnerability in Action
10+
Dispatch. This vulnerability has been assigned the CVE identifier
11+
CVE-2023-22792.
12+
13+
Versions Affected: >= 3.0.0
14+
Not affected: < 3.0.0
15+
Fixed Versions: 6.1.7.1, 7.0.4.1
16+
17+
# Impact
18+
19+
Specially crafted cookies, in combination with a specially crafted
20+
X_FORWARDED_HOST header can cause the regular expression engine to enter a
21+
state of catastrophic backtracking. This can cause the process to use large
22+
amounts of CPU and memory, leading to a possible DoS vulnerability All users
23+
running an affected release should either upgrade or use one of the
24+
workarounds immediately.
25+
26+
# Workarounds
27+
28+
We recommend that all users upgrade to one of the FIXED versions. In the
29+
meantime, users can mitigate this vulnerability by using a load balancer or
30+
other device to filter out malicious X_FORWARDED_HOST headers before they
31+
reach the application.
32+
unaffected_versions:
33+
- "< 3.0.0"
34+
patched_versions:
35+
- "~> 6.1.7, >= 6.1.7.1"
36+
- ">= 7.0.4.1"

‎gems/actionpack/CVE-2023-22795.yml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
gem: actionpack
3+
cve: 2023-22795
4+
ghsa: 8xww-x3g3-6jcv
5+
url: https://github.com/rails/rails/releases/tag/v7.0.4.1
6+
title: ReDoS based DoS vulnerability in Action Dispatch
7+
date: 2023-01-18
8+
description: |-
9+
There is a possible regular expression based DoS vulnerability in Action
10+
Dispatch related to the If-None-Match header. This vulnerability has been
11+
assigned the CVE identifier CVE-2023-22795.
12+
13+
Versions Affected: All
14+
Not affected: None
15+
Fixed Versions: 6.1.7.1, 7.0.4.1
16+
17+
# Impact
18+
19+
A specially crafted HTTP If-None-Match header can cause the regular
20+
expression engine to enter a state of catastrophic backtracking, when on a
21+
version of Ruby below 3.2.0. This can cause the process to use large amounts
22+
of CPU and memory, leading to a possible DoS vulnerability All users running
23+
an affected release should either upgrade or use one of the workarounds
24+
immediately.
25+
26+
# Workarounds
27+
28+
We recommend that all users upgrade to one of the FIXED versions. In the
29+
meantime, users can mitigate this vulnerability by using a load balancer or
30+
other device to filter out malicious If-None-Match headers before they reach
31+
the application.
32+
33+
Users on Ruby 3.2.0 or greater are not affected by this vulnerability.
34+
patched_versions:
35+
- "~> 6.1.7, >= 6.1.7.1"
36+
- ">= 7.0.4.1"

‎gems/actionpack/CVE-2023-22797.yml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
gem: actionpack
3+
cve: 2023-22797
4+
ghsa: 9445-4cr6-336r
5+
url: https://github.com/rails/rails/releases/tag/v7.0.4.1
6+
title: Open Redirect Vulnerability in Action Pack
7+
date: 2023-01-18
8+
description: |-
9+
There is a vulnerability in Action Controller’s redirect_to. This
10+
vulnerability has been assigned the CVE identifier CVE-2023-22797.
11+
12+
Versions Affected: >= 7.0.0
13+
Not affected: < 7.0.0
14+
Fixed Versions: 7.0.4.1
15+
16+
# Impact
17+
18+
There is a possible open redirect when using the redirect_to helper with
19+
untrusted user input.
20+
21+
Vulnerable code will look like this:
22+
```
23+
redirect_to(params[:some_param])
24+
```
25+
26+
Rails 7.0 introduced protection against open redirects from calling
27+
redirect_to with untrusted user input. In prior versions the developer was
28+
fully responsible for only providing trusted input. However the check
29+
introduced could be bypassed by a carefully crafted URL.
30+
31+
All users running an affected release should either upgrade or use one of
32+
the workarounds immediately.
33+
34+
# Workarounds
35+
36+
There are no feasible workarounds for this issue.
37+
unaffected_versions:
38+
- "< 7.0.0"
39+
patched_versions:
40+
- ">= 7.0.4.1"

‎gems/activerecord/CVE-2022-44566.yml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
gem: activerecord
3+
cve: 2022-44566
4+
ghsa: 579w-22j4-4749
5+
url: https://github.com/rails/rails/releases/tag/v7.0.4.1
6+
title: Denial of Service Vulnerability in ActiveRecord’s PostgreSQL adapter
7+
date: 2023-01-18
8+
description: |
9+
There is a potential denial of service vulnerability present in
10+
ActiveRecord’s PostgreSQL adapter.
11+
12+
This has been assigned the CVE identifier CVE-2022-44566.
13+
14+
Versions Affected: All.
15+
Not affected: None.
16+
Fixed Versions: 7.0.4.1, 6.1.7.1
17+
18+
# Impact
19+
20+
In ActiveRecord <7.0.4.1 and <6.1.7.1, when a value outside the range for a
21+
64bit signed integer is provided to the PostgreSQL connection adapter, it
22+
will treat the target column type as numeric. Comparing integer values
23+
against numeric values can result in a slow sequential scan resulting in
24+
potential Denial of Service.
25+
26+
# Workarounds
27+
28+
Ensure that user supplied input which is provided to ActiveRecord clauses do
29+
not contain integers wider than a signed 64bit representation or floats.
30+
patched_versions:
31+
- "~> 6.1.7, >= 6.1.7.1"
32+
- ">= 7.0.4.1"

‎gems/activerecord/CVE-2023-22794.yml

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
gem: activerecord
3+
cve: 2023-22794
4+
ghsa: hq7p-j377-6v63
5+
url: https://github.com/rails/rails/releases/tag/v7.0.4.1
6+
title: SQL Injection Vulnerability via ActiveRecord comments
7+
date: 2023-01-18
8+
description: |-
9+
There is a possible vulnerability in ActiveRecord related to the
10+
sanitization of comments. This vulnerability has been assigned the CVE
11+
identifier CVE-2023-22794.
12+
13+
Versions Affected: >= 6.0.0
14+
Not affected: < 6.0.0
15+
Fixed Versions: 6.0.6.1, 6.1.7.1, 7.0.4.1
16+
17+
# Impact
18+
19+
Previously the implementation of escaping for comments was insufficient for
20+
21+
If malicious user input is passed to either the annotate query method, the
22+
optimizer_hints query method, or through the QueryLogs interface which
23+
automatically adds annotations, it may be sent to the database with
24+
insufficient sanitization and be able to inject SQL outside of the comment.
25+
26+
In most cases these interfaces won’t be used with user input and users
27+
should avoid doing so.
28+
29+
Example vulnerable code:
30+
```
31+
Post.where(id: 1).annotate("#{params[:user_input]}")
32+
33+
Post.where(id: 1).optimizer_hints("#{params[:user_input]}")
34+
```
35+
36+
Example vulnerable QueryLogs configuration (the default configuration is not
37+
vulnerable):
38+
```
39+
config.active_record.query_log_tags = [
40+
{
41+
something: -> { <some value including user input> }
42+
}
43+
]
44+
```
45+
All users running an affected release should either upgrade or use one of the
46+
workarounds immediately.
47+
48+
# Workarounds
49+
50+
Avoid passing user input to annotate and avoid using QueryLogs configuration
51+
which can include user input.
52+
unaffected_versions:
53+
- "< 6.0.0"
54+
patched_versions:
55+
- "~> 6.0.6, >= 6.0.6.1"
56+
- "~> 6.1.7, >= 6.1.7.1"
57+
- ">= 7.0.4.1"
58+
related:
59+
url:
60+
- https://github.com/rails/rails/commit/d7aba06953f9fa789c411676b941d20df8ef73de

‎gems/activesupport/CVE-2023-22796.yml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
gem: activesupport
3+
cve: 2023-22796
4+
ghsa: j6gc-792m-qgm2
5+
url: https://github.com/rails/rails/releases/tag/v7.0.4.1
6+
title: ReDoS based DoS vulnerability in Active Support’s underscore
7+
date: 2023-01-18
8+
description: |-
9+
There is a possible regular expression based DoS vulnerability in Active
10+
Support. This vulnerability has been assigned the CVE identifier
11+
CVE-2023-22796.
12+
13+
Versions Affected: All
14+
Not affected: None
15+
Fixed Versions: 6.1.7.1, 7.0.4.1
16+
17+
# Impact
18+
19+
A specially crafted string passed to the underscore method can cause the
20+
regular expression engine to enter a state of catastrophic backtracking.
21+
This can cause the process to use large amounts of CPU and memory, leading
22+
to a possible DoS vulnerability.
23+
24+
This affects String#underscore, ActiveSupport::Inflector.underscore,
25+
String#titleize, and any other methods using these.
26+
27+
All users running an affected release should either upgrade or use one of the
28+
workarounds immediately.
29+
30+
# Workarounds
31+
32+
There are no feasible workarounds for this issue.
33+
34+
Users on Ruby 3.2.0 or greater may be able to reduce the impact by
35+
configuring Regexp.timeout.
36+
patched_versions:
37+
- "~> 6.1.7, >= 6.1.7.1"
38+
- ">= 7.0.4.1"

‎gems/curupira/CVE-2015-10053.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
gem: curupira
3+
cve: 2015-10053
4+
ghsa: 85gf-wr67-f83w
5+
url: https://github.com/prodigasistemas/curupira/commit/93a9a77896bb66c949acb8e64bceafc74bc8c271
6+
title: curupira is vulnerable to SQL injection
7+
date: 2023-01-16
8+
description: |
9+
A vulnerability classified as critical has been found in prodigasistemas
10+
curupira up to 0.1.3. Affected is an unknown function of the file
11+
app/controllers/curupira/passwords_controller.rb.
12+
The manipulation leads to sql injection. Upgrading to version 0.1.4 is able
13+
to address this issue. The name of the patch is
14+
93a9a77896bb66c949acb8e64bceafc74bc8c271. It is recommended to upgrade the
15+
affected component. VDB-218394 is the identifier assigned to this
16+
vulnerability.
17+
patched_versions:
18+
- ">= 0.1.4"
19+
related:
20+
url:
21+
- https://github.com/prodigasistemas/curupira/releases/tag/v0.1.4
22+
- https://vuldb.com/?id.218394

‎gems/globalid/CVE-2023-22799.yml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
gem: globalid
3+
cve: 2023-22799
4+
ghsa: 23c2-gwp5-pxw9
5+
url: https://github.com/rails/globalid/releases/tag/v1.0.1
6+
title: ReDoS based DoS vulnerability in GlobalID
7+
date: 2023-01-18
8+
description: |
9+
There is a ReDoS based DoS vulnerability in the GlobalID gem. This
10+
vulnerability has been assigned the CVE identifier CVE-2023-22799.
11+
12+
Versions Affected: >= 0.2.1
13+
Not affected: < 0.2.1
14+
Fixed Versions: 1.0.1
15+
16+
# Impact
17+
18+
There is a possible DoS vulnerability in the model name parsing section
19+
of the GlobalID gem. Carefully crafted input can cause the regular
20+
expression engine to take an unexpected amount of time. All users running
21+
an affected release should either upgrade or use one of the workarounds
22+
immediately.
23+
24+
# Workarounds
25+
26+
There are no feasible workarounds for this issue.
27+
unaffected_versions:
28+
- "< 0.2.1"
29+
patched_versions:
30+
- ">= 1.0.1"

‎gems/rack/CVE-2022-44570.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
gem: rack
3+
cve: 2022-44570
4+
ghsa: 65f5-mfpf-vfhj
5+
url: https://github.com/rack/rack/releases/tag/v3.0.4.1
6+
title: Denial of service via header parsing in Rack
7+
date: 2023-01-18
8+
description: |
9+
There is a possible denial of service vulnerability in the Range header
10+
parsing component of Rack. This vulnerability has been assigned the CVE
11+
identifier CVE-2022-44570.
12+
13+
Versions Affected: >= 1.5.0
14+
Not affected: None.
15+
Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.2, 3.0.4.1
16+
17+
# Impact
18+
19+
Carefully crafted input can cause the Range header parsing component in Rack
20+
to take an unexpected amount of time, possibly resulting in a denial of
21+
service attack vector. Any applications that deal with Range requests (such
22+
as streaming applications, or applications that serve files) may be impacted.
23+
24+
# Workarounds
25+
26+
There are no feasible workarounds for this issue.
27+
patched_versions:
28+
- "~> 2.0.9, >= 2.0.9.2"
29+
- "~> 2.1.4, >= 2.1.4.2"
30+
- "~> 2.2.6, >= 2.2.6.2"
31+
- ">= 3.0.4.1"

‎gems/rack/CVE-2022-44571.yml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
gem: rack
3+
cve: 2022-44571
4+
ghsa: 93pm-5p5f-3ghx
5+
url: https://github.com/rack/rack/releases/tag/v3.0.4.1
6+
title: Denial of Service Vulnerability in Rack Content-Disposition parsing
7+
date: 2023-01-18
8+
description: |
9+
There is a denial of service vulnerability in the Content-Disposition parsing
10+
component of Rack. This vulnerability has been assigned the CVE identifier
11+
CVE-2022-44571.
12+
13+
Versions Affected: >= 2.0.0
14+
Not affected: None.
15+
Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1
16+
17+
# Impact
18+
19+
Carefully crafted input can cause Content-Disposition header parsing in Rack
20+
to take an unexpected amount of time, possibly resulting in a denial of
21+
service attack vector. This header is used typically used in multipart
22+
parsing. Any applications that parse multipart posts using Rack (virtually
23+
all Rails applications) are impacted.
24+
25+
# Workarounds
26+
27+
There are no feasible workarounds for this issue.
28+
patched_versions:
29+
- "~> 2.0.9, >= 2.0.9.2"
30+
- "~> 2.1.4, >= 2.1.4.2"
31+
- "~> 2.2.6, >= 2.2.6.1"
32+
- ">= 3.0.4.1"

0 commit comments

Comments
 (0)