Skip to content

Commit be7eb3c

Browse files
jasnowjasnow
authored
[GHSA sync] added ghsa, cvss_v3, and switch to double quotes (#569)
1 parent ce57ed6 commit be7eb3c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+153
-99
lines changed

‎gems/VladTheEnterprising/CVE-2014-4995.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
gem: VladTheEnterprising
33
cve: 2014-4995
44
osvdb: 108728
5+
ghsa: 86cf-g34f-7462
56
url: https://nvd.nist.gov/vuln/detail/CVE-2014-4995
67
title: VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} Symlink Multiple
78
Impact
@@ -12,3 +13,4 @@ description: |
1213
a symlink attack against the /tmp/my.cnf.#{target_host} file they can
1314
overwrite arbitrary files, gain access to the MySQL root password,
1415
or inject arbitrary commands.
16+
cvss_v3: 7.0

‎gems/VladTheEnterprising/CVE-2014-4996.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
gem: VladTheEnterprising
33
cve: 2014-4996
44
osvdb: 108728
5+
ghsa: x4vj-279x-qwf2
56
url: https://nvd.nist.gov/vuln/detail/CVE-2014-4996
67
title: VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} Symlink Multiple
78
Impact
@@ -12,3 +13,4 @@ description: |
1213
a symlink attack against the /tmp/my.cnf.#{target_host} file they can
1314
overwrite arbitrary files, gain access to the MySQL root password,
1415
or inject arbitrary commands.
16+
cvss_v3: 5.5

‎gems/actionpack/CVE-2014-0082.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ gem: actionpack
33
framework: rails
44
cve: 2014-0082
55
osvdb: 103440
6+
ghsa: 7cgp-c3g7-qvrw
67
url: https://nvd.nist.gov/vuln/detail/CVE-2014-0082
78
title: 'CVE-2014-0082 rubygem-actionpack: Action View string handling denial of service'
89
date: 2014-02-18
@@ -12,6 +13,6 @@ description: actionpack/lib/action_view/template/text.rb in Action View in Ruby
1213
of service (memory consumption) by including these strings in headers.
1314
cvss_v2: 5.0
1415
unaffected_versions:
15-
- '>= 4.0.0'
16+
- ">= 4.0.0"
1617
patched_versions:
17-
- '>= 3.2.17'
18+
- ">= 3.2.17"

‎gems/actionpack/CVE-2014-0130.yml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
gem: actionpack
33
framework: rails
44
cve: 2014-0130
5+
ghsa: 6x85-j5j2-27jx
56
url: https://groups.google.com/forum/#!topic/rubyonrails-security/NkKc7vTW70o
67
title: Directory Traversal Vulnerability With Certain Route Configurations
78
date: 2014-05-06
@@ -15,6 +16,6 @@ description: |
1516
rails application server.
1617
cvss_v2: 4.3
1718
patched_versions:
18-
- ~> 3.2.18
19-
- ~> 4.0.5
20-
- '>= 4.1.1'
19+
- "~> 3.2.18"
20+
- "~> 4.0.5"
21+
- ">= 4.1.1"

‎gems/actionpack/CVE-2014-7818.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
gem: actionpack
33
framework: rails
44
cve: 2014-7818
5+
ghsa: 29gr-w57f-rpfw
56
url: https://groups.google.com/forum/#!topic/rubyonrails-security/dCp7duBiQgo
67
title: Arbitrary file existence disclosure in Action Pack
78
date: 2014-10-30
@@ -12,10 +13,9 @@ description: |
1213
exists.
1314
cvss_v2: 4.3
1415
unaffected_versions:
15-
- < 3.0.0
16-
16+
- "< 3.0.0"
1717
patched_versions:
18-
- ~> 3.2.20
19-
- ~> 4.0.11
20-
- ~> 4.1.7
21-
- '>= 4.2.0.beta3'
18+
- "~> 3.2.20"
19+
- "~> 4.0.11"
20+
- "~> 4.1.7"
21+
- ">= 4.2.0.beta3"

‎gems/actionpack/CVE-2014-7829.yml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
gem: actionpack
33
framework: rails
44
cve: 2014-7829
5+
ghsa: h56m-vwxc-3qpw
56
url: https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRCGk
67
title: Arbitrary file existence disclosure in Action Pack
78
date: 2014-11-17
@@ -13,11 +14,10 @@ description: |
1314
specially crafted string is slightly different.
1415
cvss_v2: 5.0
1516
unaffected_versions:
16-
- < 3.0.0
17-
17+
- "< 3.0.0"
1818
patched_versions:
19-
- ~> 3.2.21
20-
- ~> 4.0.11.1
21-
- ~> 4.0.12
22-
- ~> 4.1.7.1
23-
- '>= 4.1.8'
19+
- "~> 3.2.21"
20+
- "~> 4.0.11.1"
21+
- "~> 4.0.12"
22+
- "~> 4.1.7.1"
23+
- ">= 4.1.8"

‎gems/activerecord/CVE-2014-0080.yml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ gem: activerecord
33
framework: rails
44
cve: 2014-0080
55
osvdb: 103438
6+
ghsa: hqf9-rc9j-5fmj
67
url: https://nvd.nist.gov/vuln/detail/CVE-2014-0080
78
title: 'CVE-2014-0080 rubygem-activerecord: PostgreSQL array data injection vulnerability'
89
date: 2014-02-18
@@ -12,8 +13,8 @@ description: SQL injection vulnerability in activerecord/lib/active_record/conne
1213
involving \ (backslash) characters that are not properly handled in operations on
1314
array columns.
1415
unaffected_versions:
15-
- < 3.2.0
16-
- ~> 3.2.0
16+
- "< 3.2.0"
17+
- "~> 3.2.0"
1718
patched_versions:
18-
- ~> 4.0.3
19-
- '>= 4.1.0.beta2'
19+
- "~> 4.0.3"
20+
- ">= 4.1.0.beta2"

‎gems/activerecord/CVE-2014-3482.yml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ gem: activerecord
33
framework: rails
44
cve: 2014-3482
55
osvdb: 108664
6+
ghsa: mhwp-qhpc-h3jm
67
url: https://nvd.nist.gov/vuln/detail/CVE-2014-3482
7-
title: "CVE-2014-3482 rubygem-activerecord: SQL injection vulnerability in 'bitstring'\
8-
\ quoting"
8+
title: 'CVE-2014-3482 rubygem-activerecord: SQL injection vulnerability in ''bitstring''
9+
quoting'
910
date: 2014-07-02
1011
description: SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb
1112
in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before
@@ -15,6 +16,6 @@ description: SQL injection vulnerability in activerecord/lib/active_record/conne
1516
attacker could possibly use this flaw to conduct an SQL injection attack against
1617
applications using Active Record.
1718
unaffected_versions:
18-
- '>= 4.0.0'
19+
- ">= 4.0.0"
1920
patched_versions:
20-
- ~> 3.2.19
21+
- "~> 3.2.19"

‎gems/activerecord/CVE-2014-3483.yml

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,20 @@ gem: activerecord
33
framework: rails
44
cve: 2014-3483
55
osvdb: 108665
6+
ghsa: r8fh-hq2p-7qhq
67
url: https://nvd.nist.gov/vuln/detail/CVE-2014-3483
7-
title: "CVE-2014-3483 rubygem-activerecord: SQL injection vulnerability in 'range'\
8-
\ quoting"
8+
title: 'CVE-2014-3483 rubygem-activerecord: SQL injection vulnerability in ''range'' quoting'
99
date: 2014-07-02
10-
description: SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb
10+
description: |
11+
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb
1112
in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and
1213
4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by
1314
leveraging improper range quoting. It was discovered that Active Record did not
1415
properly quote values of the range type attributes when using the PostgreSQL database
1516
adapter. A remote attacker could possibly use this flaw to conduct an SQL injection
1617
attack against applications using Active Record.
1718
unaffected_versions:
18-
- < 4.0.0
19+
- "< 4.0.0"
1920
patched_versions:
20-
- ~> 4.0.7
21-
- '>= 4.1.3'
21+
- "~> 4.0.7"
22+
- ">= 4.1.3"

‎gems/activerecord/CVE-2014-3514.yml

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,17 @@
22
gem: activerecord
33
framework: rails
44
cve: 2014-3514
5+
ghsa: 9rf5-jm6f-2fmm
56
url: https://groups.google.com/forum/#!msg/rubyonrails-security/M4chq5Sb540/CC1Fh0Y_NWwJ
67
title: Data Injection Vulnerability in Active Record
78
date: 2014-08-18
8-
description: >-
9-
The create_with functionality in Active Record was implemented
10-
incorrectly and completely bypasses the strong parameters
11-
protection. Applications which pass user-controlled values to
12-
create_with could allow attackers to set arbitrary attributes on
13-
models.
9+
description: The create_with functionality in Active Record was implemented incorrectly
10+
and completely bypasses the strong parameters protection. Applications which pass
11+
user-controlled values to create_with could allow attackers to set arbitrary attributes
12+
on models.
1413
cvss_v2: 8.7
1514
unaffected_versions:
16-
- < 4.0.0
17-
15+
- "< 4.0.0"
1816
patched_versions:
19-
- ~> 4.0.9
20-
- '>= 4.1.5'
17+
- "~> 4.0.9"
18+
- ">= 4.1.5"

0 commit comments

Comments
 (0)