Skip to content

Commit 77ae7ba

Browse files
jasnowjasnow
authored
Updating advisories with osvdb.org in "url:" field (#613)
1 parent 20f64e6 commit 77ae7ba

File tree

91 files changed

+1122
-467
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

91 files changed

+1122
-467
lines changed

‎gems/RedCloth/CVE-2012-6684.yml

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,27 @@
11
---
22
gem: RedCloth
33
cve: 2012-6684
4+
ghsa: r23g-3qw4-gfh2
45
osvdb: 115941
56
url: https://co3k.org/blog/redcloth-unfixed-xss-en
67
title: "CVE-2012-6684 rubygem-RedCloth: XSS vulnerability"
78
date: 2012-02-29
89
description: |
9-
'Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9
10-
for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML
11-
via a javascript: URI.'
10+
Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9
11+
for Ruby and earlier allows remote attackers to inject arbitrary
12+
web script or HTML via a javascript: URI.
1213
cvss_v2: 4.3
1314
patched_versions:
14-
- '>= 4.3.0'
15+
- ">= 4.3.0"
1516
related:
1617
url:
17-
- https://github.com/jgarber/redcloth/commit/2f6dab4d6aea5cee778d2f37a135637fe3f1573c
18+
- http://co3k.org/blog/redcloth-unfixed-xss-en
1819
- https://gist.github.com/co3k/75b3cb416c342aa1414c
20+
- https://github.com/jgarber/redcloth/commit/2f6dab4d6aea5cee778d2f37a135637fe3f1573c
21+
- https://github.com/jgarber/redcloth/commit/b24f03db023d1653d60dd33b28e09317cd77c6a0
1922
- https://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss
23+
- https://web.archive.org/web/20150128115714/http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss
24+
- https://nvd.nist.gov/vuln/detail/CVE-2012-6684
25+
- https://github.com/advisories/GHSA-r23g-3qw4-gfh2
26+
- http://seclists.org/fulldisclosure/2014/Dec/50
27+
- http://www.debian.org/security/2015/dsa-3168

‎gems/activerecord-jdbc-adapter/OSVDB-114854.yml

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
gem: activerecord-jdbc-adapter
33
platform: jruby
44
osvdb: 114854
5-
url: http://osvdb.org/show/osvdb/114854
5+
url: https://github.com/jruby/activerecord-jdbc-adapter/issues/322
66
title:
77
ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub()
88
Function SQL Injection
@@ -15,6 +15,13 @@ description: |
1515
manipulate SQL queries in the back-end database, allowing for the
1616
manipulation or disclosure of arbitrary data.
1717
unaffected_versions:
18-
- < 1.2.6
18+
- "< 1.2.6"
1919
patched_versions:
20-
- '>= 1.2.8'
20+
- ">= 1.2.8"
21+
related:
22+
url:
23+
- https://github.com/jruby/activerecord-jdbc-adapter/issues/322
24+
- https://github.com/jruby/activerecord-jdbc-adapter/blob/master/lib/arjdbc/jdbc/adapter.rb
25+
- https://security.snyk.io/vuln/SNYK-RUBY-ACTIVERECORDJDBCADAPTER-20076
26+
- https://my.diffend.io/gems/activerecord-jdbc-adapter/1.2.5/1.2.8
27+
- http://osvdb.org/show/osvdb/114854

‎gems/activerecord-oracle_enhanced-adapter/OSVDB-95376.yml

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
gem: activerecord-oracle_enhanced-adapter
33
osvdb: 95376
4-
url: http://osvdb.org/show/osvdb/95376
4+
url: https://www.versioneye.com/Ruby/activerecord-oracle_enhanced-adapter/1.1.6
55
title: Oracle "enhanced" ActiveRecord Gem for Ruby :limit / :offset SQL Injection
66
date: 2008-10-10
77
description: |
@@ -12,4 +12,9 @@ description: |
1212
queries in the back-end database, allowing for the manipulation or disclosure
1313
of arbitrary data.
1414
patched_versions:
15-
- '>= 1.1.8'
15+
- ">= 1.1.8"
16+
related:
17+
url:
18+
- https://www.versioneye.com/Ruby/activerecord-oracle_enhanced-adapter/1.1.6
19+
- https://security.snyk.io/vuln/SNYK-RUBY-ACTIVERECORDORACLEENHANCEDADAPTER-20006
20+
- http://osvdb.org/show/osvdb/95376

‎gems/activeresource/OSVDB-95749.yml

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
---
22
gem: activeresource
33
osvdb: 95749
4-
url: http://osvdb.org/show/osvdb/95749
5-
title: activeresource Gem for Ruby lib/active_resource/connection.rb request Function
6-
Multiple Variable Format String
4+
url: https://my.diffend.io/gems/activeresource/versions/2.1.0
5+
title: activeresource Gem for Ruby lib/active_resource/connection.rb
6+
request Function Multiple Variable Format String
77
date: 2008-08-15
88
description: |
99
activeresource contains a format string flaw in the request function of
@@ -13,4 +13,9 @@ description: |
1313
allow a remote attacker to cause a denial of service or potentially execute
1414
arbitrary code.
1515
patched_versions:
16-
- '>= 2.2.0'
16+
- ">= 2.2.0"
17+
related:
18+
url:
19+
- https://my.diffend.io/gems/activeresource/versions/2.1.0
20+
- https://security.snyk.io/vuln/SNYK-RUBY-ACTIVERESOURCE-20004
21+
- http://osvdb.org/show/osvdb/95749

‎gems/as/OSVDB-112683.yml

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
11
---
22
gem: as
33
osvdb: 112683
4-
url: http://osvdb.org/show/osvdb/112683
4+
url: https://security.snyk.io/vuln/SNYK-RUBY-AS-20195
55
title: as Gem for Ruby Process List Local Plaintext Credentials Disclosure
66
date: 2014-09-25
77
description: |
88
as Gem for Ruby contains a flaw that is due to the program displaying
99
credential information in plaintext in the process list. This may
1010
allow a local attacker to gain access to credential information.
11+
notes: "Never patched"
12+
related:
13+
url:
14+
- https://security.snyk.io/vuln/SNYK-RUBY-AS-20195
15+
- http://osvdb.org/show/osvdb/112683
16+
# FYI: rubygem.org Homepage is 404"

‎gems/auto_awesomplete/OSVDB-132800.yml

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,17 @@
11
---
22
gem: auto_awesomplete
33
osvdb: 132800
4-
url: https://github.com/Tab10id/auto_awesomplete/issues/2
4+
url: https://www.openwall.com/lists/oss-security/2016/01/11/2
55
title: auto_awesomplete Gem for Ruby allows arbitrary search execution
66
date: 2016-01-08
77
description: |
8-
auto_awesomplete Gem for Ruby contains a flaw that is triggered when handling the
9-
'params[:default_class_name]' option. This allows users to search any object
10-
of all given ActiveRecord classes.
8+
auto_awesomplete Gem for Ruby contains a flaw that is triggered
9+
when handling the 'params[:default_class_name]' option. This
10+
allows users to search any object of all given ActiveRecord classes.
11+
notes: "Never patched"
12+
related:
13+
url:
14+
- https://www.openwall.com/lists/oss-security/2016/01/11/2
15+
- https://github.com/Tab10id/auto_awesomplete/issues/2
16+
- https://github.com/rubysec/ruby-advisory-db/issues/224
17+
- https://github.com/rubysec/ruby-advisory-db/pull/227

‎gems/auto_select2/OSVDB-132800.yml

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,20 @@
11
---
22
gem: auto_select2
33
osvdb: 132800
4-
url: https://github.com/Loriowar/auto_select2/issues/4
4+
url: https://www.openwall.com/lists/oss-security/2016/01/11/2
55
title: auto_select2 Gem for Ruby allows arbitrary search execution
66
date: 2016-01-08
77
description: |
8-
auto_select2 Gem for Ruby contains a flaw that is triggered when handling the
9-
'params[:default_class_name]' option. This allows users to search any object
10-
of all given ActiveRecord classes.
8+
auto_select2 Gem for Ruby contains a flaw that is triggered
9+
when handling the 'params[:default_class_name]' option. This
10+
allows users to search any object of all given ActiveRecord classes.
1111
patched_versions:
12-
- '>= 0.5.0'
12+
- ">= 0.5.0"
13+
related:
14+
url:
15+
- https://www.openwall.com/lists/oss-security/2016/01/11/2
16+
- https://github.com/Loriowar/auto_select2/issues/4
17+
- https://github.com/bkocherov/auto_select2/commit/c283ba5b2ad828c3b7414565ae66cd0d86f5a5df
18+
- https://github.com/rubysec/ruby-advisory-db/issues/224
19+
- https://github.com/rubysec/ruby-advisory-db/pull/227
20+
- https://github.com/Tab10id/auto_awesomplete/issues/2

‎gems/backup_checksum/OSVDB-108570.yml

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,18 @@
11
---
22
gem: backup_checksum
33
osvdb: 108570
4-
url: http://osvdb.org/show/osvdb/108570
5-
title: backup_checksum Gem for Ruby /lib/backup/cli/utility.rb Metacharacter Handling
6-
Remote Command Execution
4+
url: https://www.openwall.com/lists/oss-security/2014/07/07/12
5+
title: backup_checksum Gem for Ruby /lib/backup/cli/utility.rb
6+
Metacharacter Handling Remote Command Execution
77
date: 2014-06-30
88
description: |
99
backup_checksum Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb
1010
that is triggered when handling metacharacters. This may allow a remote
1111
attacker to execute arbitrary commands.
12+
notes: "Never patched"
13+
related:
14+
url:
15+
- https://www.openwall.com/lists/oss-security/2014/07/07/12
16+
- https://my.diffend.io/gems/backup_checksum/3.0.23
17+
- https://github.com/backup/backup
18+
- http://osvdb.org/show/osvdb/108570

‎gems/bcrypt-ruby/OSVDB-62067.yml

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,24 @@ title: bcrypt-ruby Gem for Ruby incorrect encoding of non US-ASCII characters (J
77
only)
88
date: 2010-02-01
99
description: |
10+
In https://security.snyk.io/vuln/SNYK-RUBY-BCRYPT-20009, found
11+
"The advisory has been revoked - it doesn't affect any version of package bcrypt"
12+
1013
bcrypt-ruby Gem for Ruby suffered from a bug related to character
1114
encoding that substantially reduced the entropy of hashed passwords
1215
containing non US-ASCII characters. An incorrect encoding step
13-
transparently replaced such characters by '?' prior to hashing. In the
14-
worst case of a password consisting solely of non-US-ASCII characters,
15-
this would cause its hash to be equivalent to all other such passwords
16-
of the same length. This issue only affects the JRuby implementation.
16+
transparently replaced such characters by '?' prior to hashing.
17+
In the worst case of a password consisting solely of non-US-ASCII
18+
characters, this would cause its hash to be equivalent to all other
19+
such passwords of the same length.
20+
21+
This issue only affects the JRuby implementation.
1722
1823
This gem has been renamed. Please use "bcrypt" from now on.
1924
patched_versions:
20-
- '>= 2.1.4'
25+
- ">= 2.1.4"
26+
related:
27+
url:
28+
- https://github.com/jeremyh/jBCrypt
29+
- http://www.mindrot.org/files/jBCrypt/internat.adv
30+
- https://github.com/bcrypt-ruby/bcrypt-ruby/blob/master/ext/jruby/bcrypt_jruby/BCrypt.java

‎gems/bcrypt/OSVDB-62067.yml

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,22 @@ title: bcrypt-ruby Gem for Ruby incorrect encoding of non US-ASCII characters (J
77
only)
88
date: 2010-02-01
99
description: |
10+
In https://security.snyk.io/vuln/SNYK-RUBY-BCRYPT-20009, found
11+
"The advisory has been revoked - it doesn't affect any version of package bcrypt"
12+
1013
bcrypt-ruby Gem for Ruby suffered from a bug related to character
1114
encoding that substantially reduced the entropy of hashed passwords
1215
containing non US-ASCII characters. An incorrect encoding step
13-
transparently replaced such characters by '?' prior to hashing. In the
14-
worst case of a password consisting solely of non-US-ASCII characters,
15-
this would cause its hash to be equivalent to all other such passwords
16-
of the same length. This issue only affects the JRuby implementation.
16+
transparently replaced such characters by '?' prior to hashing.
17+
In the worst case of a password consisting solely of non-US-ASCII
18+
characters, this would cause its hash to be equivalent to all other
19+
such passwords of the same length.
20+
21+
This issue only affects the JRuby implementation.
1722
patched_versions:
18-
- '>= 2.1.4'
23+
- ">= 2.1.4"
24+
related:
25+
url:
26+
- https://github.com/jeremyh/jBCrypt
27+
- http://www.mindrot.org/files/jBCrypt/internat.adv
28+
- https://github.com/bcrypt-ruby/bcrypt-ruby/blob/master/ext/jruby/bcrypt_jruby/BCrypt.java

0 commit comments

Comments
 (0)