Skip to content

Commit 9bfad4b

Browse files
reedlodenreedloden
committed
Sync with GitHub Security Advisories
* Add devise_token_auth/CVE-2019-16751, geminabox/CVE-2017-14506, geminabox/CVE-2017-14683, nokogiri/CVE-2019-13118, nokogiri/CVE-2021-3517, rubygems-update/CVE-2018-1000073, rubygems-update/CVE-2018-1000076 * Update CVSSv3 and GHSA IDs for other vulnerabilities
1 parent 0758aee commit 9bfad4b

15 files changed

+249
-16
lines changed

‎gems/devise_token_auth/CVE-2019-16751.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
gem: devise_token_auth
3+
cve: 2019-16751
4+
ghsa: mvqr-r76c-wm5f
5+
url: https://github.com/lynndylanhurley/devise_token_auth/issues/1332
6+
title: Devise Token Auth vulnerable to Cross-site Scripting
7+
date: 2022-05-24
8+
description: |
9+
An issue was discovered in Devise Token Auth through 1.1.2. The omniauth
10+
failure endpoint is vulnerable to Reflected Cross Site Scripting (XSS) through the
11+
message parameter. Unauthenticated attackers can craft a URL that executes a malicious
12+
JavaScript payload in the victim's browser. This affects the fallback_render method
13+
in the omniauth callbacks controller.
14+
cvss_v3: 6.1
15+
unaffected_versions:
16+
- "< 0.1.33"
17+
patched_versions:
18+
- ">= 1.1.3"

‎gems/geminabox/CVE-2017-14506.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
gem: geminabox
3+
cve: 2017-14506
4+
ghsa: 98hq-3qvg-pg78
5+
url: http://baraktawily.blogspot.co.il/2017/09/gem-in-box-xss-vulenrability-cve-2017.html
6+
title: Gem in a Box vulnerable to Cross-site Scripting
7+
date: 2022-05-13
8+
description: |
9+
geminabox (aka Gem in a Box) before 0.13.6 is vulnerable to Cross-site
10+
Scripting (XSS), as demonstrated by uploading a gem file that has a crafted gem.homepage
11+
value in its .gemspec file.
12+
cvss_v3: 5.4
13+
patched_versions:
14+
- ">= 0.13.6"
15+
related:
16+
url:
17+
- https://github.com/geminabox/geminabox/blob/master/CHANGELOG.md
18+
- https://github.com/geminabox/geminabox/commit/99aaae196c4fc6ae0df28e186ca1e493ae658e02

‎gems/geminabox/CVE-2017-14683.yml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
gem: geminabox
3+
cve: 2017-14683
4+
ghsa: qwv2-2x8g-g43g
5+
url: http://baraktawily.blogspot.co.il/2017/09/gem-in-box-xss-vulenrability-cve-2017.html
6+
title: Gem in a Box vulnerable to Cross-site Request Forgery
7+
date: 2022-05-13
8+
description: |
9+
geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated
10+
by an unintended gem upload.
11+
cvss_v3: 8.8
12+
patched_versions:
13+
- ">= 0.13.7"
14+
related:
15+
url:
16+
- https://github.com/geminabox/geminabox/blob/master/CHANGELOG.md
17+
- https://github.com/geminabox/geminabox/commit/a01c4e8b3403624109499dec75eb6ee30bd01a55

‎gems/grape/CVE-2018-3769.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,9 @@ description: |
1212
1313
Example:
1414
http://example.com/api/endpoint?format=%3Cscript%3Ealert(document.cookie)%3C/script%3E
15+
cvss_v3: 6.1
1516
patched_versions:
16-
- '>= 1.1.0'
17+
- ">= 1.1.0"
1718
related:
1819
url:
1920
- https://github.com/ruby-grape/grape/pull/1763

‎gems/nokogiri/CVE-2019-11068.yml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
---
22
gem: nokogiri
33
cve: 2019-11068
4-
date: 2019-04-22
4+
ghsa: qxcg-xjjg-66mj
55
url: https://github.com/sparklemotion/nokogiri/issues/1892
66
title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
7+
date: 2019-04-22
78
description: |
89
Nokogiri v1.10.3 has been released.
910
@@ -39,9 +40,9 @@ description: |
3940
Canonical rates this as "Priority: Medium".
4041
4142
Debian rates this as "NVD Severity: High (attack range: remote)".
43+
cvss_v3: 9.8
4244
patched_versions:
43-
- '>= 1.10.3'
44-
45+
- ">= 1.10.3"
4546
related:
4647
url:
4748
- https://groups.google.com/forum/#!msg/ruby-security-ann/_y80o1zZlOs/k4SDX6hoAAAJ

‎gems/nokogiri/CVE-2019-13118.yml

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
gem: nokogiri
3+
cve: 2019-13118
4+
ghsa: cf46-6xxh-pc75
5+
url: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069
6+
title: libxslt Type Confusion vulnerability that affects Nokogiri
7+
date: 2022-05-24
8+
description: |-
9+
In `numbers.c` in libxslt 1.1.33, a type holding grouping characters of an `xsl:number` instruction was too narrow and an invalid character/length combination could be passed to `xsltNumberFormatDecimal`, leading to a read of uninitialized stack data.
10+
11+
Nokogiri prior to version 1.10.5 used a vulnerable version of libxslt. Nokogiri 1.10.5 updated libxslt to version 1.1.34 to address this and other vulnerabilities in libxslt.
12+
cvss_v3: 7.5
13+
patched_versions:
14+
- ">= 1.10.5"
15+
related:
16+
url:
17+
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069
18+
- https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b
19+
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
20+
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
21+
- https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html
22+
- https://lists.fedoraproject.org/archives/list/[email protected]/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/
23+
- https://oss-fuzz.com/testcase-detail/5197371471822848
24+
- https://seclists.org/bugtraq/2019/Aug/21
25+
- https://seclists.org/bugtraq/2019/Aug/22
26+
- https://seclists.org/bugtraq/2019/Aug/23
27+
- https://seclists.org/bugtraq/2019/Aug/25
28+
- https://seclists.org/bugtraq/2019/Jul/35
29+
- https://seclists.org/bugtraq/2019/Jul/36
30+
- https://seclists.org/bugtraq/2019/Jul/37
31+
- https://seclists.org/bugtraq/2019/Jul/40
32+
- https://seclists.org/bugtraq/2019/Jul/41
33+
- https://seclists.org/bugtraq/2019/Jul/42
34+
- https://security.netapp.com/advisory/ntap-20190806-0004/
35+
- https://security.netapp.com/advisory/ntap-20200122-0003/
36+
- https://support.apple.com/kb/HT210346
37+
- https://support.apple.com/kb/HT210348
38+
- https://support.apple.com/kb/HT210351
39+
- https://support.apple.com/kb/HT210353
40+
- https://support.apple.com/kb/HT210356
41+
- https://support.apple.com/kb/HT210357
42+
- https://support.apple.com/kb/HT210358
43+
- https://usn.ubuntu.com/4164-1/
44+
- https://www.oracle.com/security-alerts/cpujan2020.html
45+
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html
46+
- http://seclists.org/fulldisclosure/2019/Aug/11
47+
- http://seclists.org/fulldisclosure/2019/Aug/13
48+
- http://seclists.org/fulldisclosure/2019/Aug/14
49+
- http://seclists.org/fulldisclosure/2019/Aug/15
50+
- http://seclists.org/fulldisclosure/2019/Jul/22
51+
- http://seclists.org/fulldisclosure/2019/Jul/23
52+
- http://seclists.org/fulldisclosure/2019/Jul/24
53+
- http://seclists.org/fulldisclosure/2019/Jul/26
54+
- http://seclists.org/fulldisclosure/2019/Jul/31
55+
- http://seclists.org/fulldisclosure/2019/Jul/37
56+
- http://seclists.org/fulldisclosure/2019/Jul/38
57+
- http://www.openwall.com/lists/oss-security/2019/11/17/2
58+
- https://github.com/sparklemotion/nokogiri/issues/1943
59+
- https://github.com/sparklemotion/nokogiri/commit/43a175339b47b8c604508813fc75b83f13cd173e
60+
- https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L796
61+
- https://github.com/sparklemotion/nokogiri/releases/tag/v1.10.5

‎gems/nokogiri/CVE-2021-3517.yml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
gem: nokogiri
3+
cve: 2021-3517
4+
ghsa: jw9f-hh49-cvp9
5+
url: https://bugzilla.redhat.com/show_bug.cgi?id=1954232
6+
title: Nokogiri contains libxml Out-of-bounds Write vulnerability
7+
date: 2022-05-24
8+
description: |-
9+
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
10+
11+
Nokogiri prior to version 1.11.4 used a vulnerable version of libxml2. Nokogiri 1.11.4 updated libxml2 to version 2.9.11 to address this and other vulnerabilities in libxml2.
12+
cvss_v3: 8.6
13+
patched_versions:
14+
- ">= 1.11.4"
15+
related:
16+
url:
17+
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
18+
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
19+
- https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html
20+
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
21+
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
22+
- https://security.gentoo.org/glsa/202107-05
23+
- https://security.netapp.com/advisory/ntap-20210625-0002/
24+
- https://security.netapp.com/advisory/ntap-20211022-0004/
25+
- https://www.oracle.com/security-alerts/cpuapr2022.html
26+
- https://www.oracle.com/security-alerts/cpujan2022.html
27+
- https://www.oracle.com/security-alerts/cpuoct2021.html
28+
- https://www.oracle.com/security-alerts/cpujul2022.html
29+
- https://github.com/sparklemotion/nokogiri/issues/2233
30+
- https://github.com/sparklemotion/nokogiri/issues/2274
31+
- https://github.com/sparklemotion/nokogiri/blob/7c19ef5cc6b7c5c36827dd5495f857c6877ec8cf/CHANGELOG.md?plain=1#L579
32+
- https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e

‎gems/rack/CVE-2023-27530.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
---
22
gem: rack
33
cve: 2023-27530
4+
ghsa: 3h57-hmj3-gj3p
45
url: https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388
56
title: Possible DoS Vulnerability in Multipart MIME parsing
67
date: 2023-03-03

‎gems/rubygems-update/CVE-2017-0899.yml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
gem: rubygems-update
33
library: rubygems
44
cve: 2017-0899
5+
ghsa: 7gcp-2gmq-w3xh
56
url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
67
title: RubyGems ANSI escape sequence vulnerability
78
date: 2017-08-29
@@ -10,7 +11,8 @@ description: |
1011
specifications that include terminal escape characters. Printing the gem
1112
specification would execute terminal escape sequences.
1213
cvss_v2: 7.5
14+
cvss_v3: 9.8
1315
patched_versions:
14-
- '>= 2.4.5.3'
15-
- '>= 2.5.2.1'
16-
- '>= 2.6.13'
16+
- ">= 2.4.5.3"
17+
- ">= 2.5.2.1"
18+
- ">= 2.6.13"

‎gems/rubygems-update/CVE-2017-0901.yml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
gem: rubygems-update
33
library: rubygems
44
cve: 2017-0901
5+
ghsa: pm9x-4392-2c2p
56
url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
67
title: RubyGems vulnerability in the gem installer that allowed a malicious gem to
78
overwrite arbitrary files
@@ -11,7 +12,8 @@ description: |
1112
allowing a maliciously crafted gem to potentially overwrite any file on the
1213
filesystem.
1314
cvss_v2: 6.4
15+
cvss_v3: 7.5
1416
patched_versions:
15-
- '>= 2.4.5.3'
16-
- '>= 2.5.2.1'
17-
- '>= 2.6.13'
17+
- ">= 2.4.5.3"
18+
- ">= 2.5.2.1"
19+
- ">= 2.6.13"

0 commit comments

Comments
 (0)