Skip to content

Commit cd032ae

Browse files
jasnowpostmodern
jasnow
authored and
postmodern
committed
17 GHSA=>RAD sync'ed files
1 parent de47931 commit cd032ae

File tree

17 files changed

+88
-56
lines changed

17 files changed

+88
-56
lines changed

‎gems/actionpack/CVE-2012-1099.yml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,17 @@ gem: actionpack
33
framework: rails
44
cve: 2012-1099
55
osvdb: 79727
6+
ghsa: 2xjj-5x6h-8vmf
67
url: https://nvd.nist.gov/vuln/detail/CVE-2012-1099
7-
title: "CVE-2012-1099 rubygem-actionpack: XSS in the 'select' helper"
8+
title: 'CVE-2012-1099 rubygem-actionpack: XSS in the "select" helper'
89
date: 2012-03-01
9-
description: Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb
10+
description: |
11+
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb
1012
in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and
1113
3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML
1214
via vectors involving certain generation of OPTION elements within SELECT elements.
1315
cvss_v2: 4.3
1416
patched_versions:
15-
- ~> 3.0.12
16-
- ~> 3.1.4
17-
- '>= 3.2.2'
17+
- "~> 3.0.12"
18+
- "~> 3.1.4"
19+
- ">= 3.2.2"

‎gems/actionpack/CVE-2012-3424.yml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,20 @@ gem: actionpack
33
framework: rails
44
cve: 2012-3424
55
osvdb: 84243
6+
ghsa: 92w9-2pqw-rhjj
67
url: https://nvd.nist.gov/vuln/detail/CVE-2012-3424
78
title: 'CVE-2012-3424 rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest'
89
date: 2012-07-26
9-
description: The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb
10+
description: |
11+
The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb
1012
in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts
1113
Digest Authentication strings to symbols, which allows remote attackers to cause
1214
a denial of service by leveraging access to an application that uses a with_http_digest
1315
helper method, as demonstrated by the authenticate_or_request_with_http_digest method.
1416
cvss_v2: 5.0
1517
unaffected_versions:
16-
- '>= 2.3.5, <= 2.3.14'
18+
- ">= 2.3.5, <= 2.3.14"
1719
patched_versions:
18-
- ~> 3.0.16
19-
- ~> 3.1.7
20-
- '>= 3.2.7'
20+
- "~> 3.0.16"
21+
- "~> 3.1.7"
22+
- ">= 3.2.7"

‎gems/actionpack/CVE-2012-3463.yml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,20 @@ gem: actionpack
33
framework: rails
44
cve: 2012-3463
55
osvdb: 84515
6+
ghsa: 98mf-8f57-64qf
67
url: https://nvd.nist.gov/vuln/detail/CVE-2012-3463
78
title: 'CVE-2012-3463 rubygem-actionpack: potential XSS vulnerability in select_tag
89
prompt'
910
date: 2012-08-09
10-
description: Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb
11+
description: |
12+
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb
1113
in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows
1214
remote attackers to inject arbitrary web script or HTML via the prompt field to
1315
the select_tag helper.
1416
cvss_v2: 4.3
1517
unaffected_versions:
16-
- ~> 2.3.0
18+
- "~> 2.3.0"
1719
patched_versions:
18-
- ~> 3.0.17
19-
- ~> 3.1.8
20-
- '>= 3.2.8'
20+
- "~> 3.0.17"
21+
- "~> 3.1.8"
22+
- ">= 3.2.8"

‎gems/actionpack/CVE-2012-3465.yml

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,17 @@ gem: actionpack
33
framework: rails
44
cve: 2012-3465
55
osvdb: 84513
6+
ghsa: 7g65-ghrg-hpf5
67
url: https://nvd.nist.gov/vuln/detail/CVE-2012-3465
78
title: 'CVE-2012-3465 rubygem-actionpack: XSS Vulnerability in strip_tags'
89
date: 2012-08-09
9-
description: Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb
10+
description: |
11+
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb
1012
in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and
1113
3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML
1214
via malformed HTML markup.
1315
cvss_v2: 4.3
1416
patched_versions:
15-
- ~> 3.0.17
16-
- ~> 3.1.8
17-
- '>= 3.2.8'
17+
- "~> 3.0.17"
18+
- "~> 3.1.8"
19+
- ">= 3.2.8"

‎gems/activerecord/CVE-2012-2661.yml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,21 @@ gem: activerecord
33
framework: rails
44
cve: 2012-2661
55
osvdb: 82403
6+
ghsa: fh39-v733-mxfr
67
url: https://nvd.nist.gov/vuln/detail/CVE-2012-2661
78
title: 'CVE-2012-2661 rubygem-activerecord: SQL injection when processing nested query
89
paramaters'
910
date: 2012-05-31
10-
description: The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x
11+
description: |
12+
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x
1113
before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of
1214
request data to a where method in an ActiveRecord class, which allows remote attackers
1315
to conduct certain SQL injection attacks via nested query parameters that leverage
1416
unintended recursion, a related issue to CVE-2012-2695.
1517
cvss_v2: 5.0
1618
unaffected_versions:
17-
- ~> 2.3.14
19+
- "~> 2.3.14"
1820
patched_versions:
19-
- ~> 3.0.13
20-
- ~> 3.1.5
21-
- '>= 3.2.4'
21+
- "~> 3.0.13"
22+
- "~> 3.1.5"
23+
- ">= 3.2.4"

‎gems/activerecord/CVE-2012-6496.yml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ gem: activerecord
33
framework: rails
44
cve: 2012-6496
55
osvdb: 88661
6+
ghsa: gh2w-j7cx-2664
67
url: https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM
78
title: Ruby on Rails find_by_* Methods Authlogic SQL Injection Bypass
89
date: 2012-12-22
@@ -12,6 +13,6 @@ description: |
1213
crafted requests can use the scope to inject arbitrary SQL.
1314
cvss_v2: 6.4
1415
patched_versions:
15-
- ~> 3.0.18
16-
- ~> 3.1.9
17-
- '>= 3.2.10'
16+
- "~> 3.0.18"
17+
- "~> 3.1.9"
18+
- ">= 3.2.10"

‎gems/activesupport/CVE-2012-1098.yml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,20 @@ gem: activesupport
33
framework: rails
44
cve: 2012-1098
55
osvdb: 79726
6+
ghsa: qv8p-v9qw-wc7g
67
url: https://nvd.nist.gov/vuln/detail/CVE-2012-1098
78
title: 'CVE-2012-1098 rubygem-activesupport: XSS in SafeBuffer#[] (unescaped safe
89
buffers can be marked as safe)'
910
date: 2012-03-01
10-
description: Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before
11+
description: |
12+
Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before
1113
3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject
1214
arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated
1315
through certain methods.
1416
cvss_v2: 4.3
1517
unaffected_versions:
16-
- < 3.0.0
18+
- "< 3.0.0"
1719
patched_versions:
18-
- ~> 3.0.12
19-
- ~> 3.1.4
20-
- '>= 3.2.2'
20+
- "~> 3.0.12"
21+
- "~> 3.1.4"
22+
- ">= 3.2.2"

‎gems/activesupport/CVE-2012-3464.yml

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,17 @@ gem: activesupport
33
framework: rails
44
cve: 2012-3464
55
osvdb: 84516
6+
ghsa: h835-75hw-pj89
67
url: https://nvd.nist.gov/vuln/detail/CVE-2012-3464
78
title: 'CVE-2012-3464 rubygem-actionpack: potential XSS vulnerability'
89
date: 2012-08-09
9-
description: Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb
10+
description: |
11+
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb
1012
in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might
1113
allow remote attackers to inject arbitrary web script or HTML via vectors involving
1214
a ' (quote) character.
1315
cvss_v2: 4.3
1416
patched_versions:
15-
- ~> 3.0.17
16-
- ~> 3.1.8
17-
- '>= 3.2.8'
17+
- "~> 3.0.17"
18+
- "~> 3.1.8"
19+
- ">= 3.2.8"

‎gems/authlogic/CVE-2012-6497.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
gem: authlogic
33
cve: 2012-6497
44
osvdb: 89064
5+
ghsa: rx7j-mw4c-76g9
56
url: https://nvd.nist.gov/vuln/detail/CVE-2012-6497
67
title: Ruby on Rails Authlogic Gem secret_token.rb Known secret_token Value Weakness
78
date: 2012-12-21
@@ -12,4 +13,4 @@ description: |
1213
secret_token.rb, a remote attacker to more easily conduct SQL injection
1314
attacks.
1415
patched_versions:
15-
- '>= 3.3.0'
16+
- ">= 3.3.0"

‎gems/ldap_fluff/CVE-2012-5604.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,15 @@
22
gem: ldap_fluff
33
cve: 2012-5604
44
osvdb: 90579
5+
ghsa: 9whh-582r-589h
56
url: https://nvd.nist.gov/vuln/detail/CVE-2012-5604
67
title: 'CVE-2012-5604 rubygem-ldap_fluff: CloudForms authentication bypass when handling
78
anonymous LDAP bind'
89
date: 2012-12-04
9-
description: The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when
10+
description: |
11+
The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when
1012
using Active Directory for authentication, allows remote attackers to bypass authentication
1113
via unspecified vectors.
1214
cvss_v2: 5.0
1315
patched_versions:
14-
- '>= 0.1.3'
16+
- ">= 0.1.3"

0 commit comments

Comments
 (0)