Skip to content

Commit d9f10b2

Browse files
jasnowjasnow
authored
23 modified files from github_advisory_sync.rb script (#581)
23 GHSA=>RAD sync'ed files
1 parent cd032ae commit d9f10b2

23 files changed

+104
-69
lines changed

‎gems/actionmailer/CVE-2013-4389.yml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,17 @@
22
gem: actionmailer
33
cve: 2013-4389
44
osvdb: 98629
5+
ghsa: rg5m-3fqp-6px8
56
url: https://nvd.nist.gov/vuln/detail/CVE-2013-4389
67
title: 'CVE-2013-4389 rubygem-actionmailer: email address processing DoS'
78
date: 2013-10-16
8-
description: Multiple format string vulnerabilities in log_subscriber.rb files in
9+
description: |
10+
Multiple format string vulnerabilities in log_subscriber.rb files in
911
the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15
1012
allow remote attackers to cause a denial of service via a crafted e-mail address
1113
that is improperly handled during construction of a log message.
1214
cvss_v2: 4.3
1315
unaffected_versions:
14-
- ~> 2.3.2
16+
- "~> 2.3.2"
1517
patched_versions:
16-
- '>= 3.2.15'
18+
- ">= 3.2.15"

‎gems/actionpack/CVE-2013-0156.yml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,21 @@ gem: actionpack
33
framework: rails
44
cve: 2013-0156
55
osvdb: 89026
6+
ghsa: jmgw-6vjg-jjwg
67
url: https://nvd.nist.gov/vuln/detail/CVE-2013-0156
78
title: 'CVE-2013-0156 rubygem-activesupport: Multiple vulnerabilities in parameter
89
parsing in ActionPack'
910
date: 2013-01-08
10-
description: active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15,
11+
description: |
12+
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15,
1113
3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly
1214
restrict casts of string values, which allows remote attackers to conduct object-injection
1315
attacks and execute arbitrary code, or cause a denial of service (memory and CPU
1416
consumption) involving nested XML entity references, by leveraging Action Pack support
1517
for (1) YAML type conversion or (2) Symbol type conversion.
1618
cvss_v2: 10.0
1719
patched_versions:
18-
- ~> 2.3.15
19-
- ~> 3.0.19
20-
- ~> 3.1.10
21-
- '>= 3.2.11'
20+
- "~> 2.3.15"
21+
- "~> 3.0.19"
22+
- "~> 3.1.10"
23+
- ">= 3.2.11"

‎gems/actionpack/CVE-2013-1855.yml

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,12 @@ gem: actionpack
33
framework: rails
44
cve: 2013-1855
55
osvdb: 91452
6+
ghsa: q759-hwvc-m3jg
67
url: https://nvd.nist.gov/vuln/detail/CVE-2013-1855
78
title: 'CVE-2013-1855 rubygem-actionpack: css_sanitization: XSS vulnerability in sanitize_css'
89
date: 2013-03-19
9-
description: The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb
10+
description: |
11+
The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb
1012
in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before
1113
3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters,
1214
which makes it easier for remote attackers to conduct cross-site scripting (XSS)
@@ -15,6 +17,6 @@ description: The sanitize_css method in lib/action_controller/vendor/html-scanne
1517
XSS attacks against users of an application using Action Pack.
1618
cvss_v2: 4.3
1719
patched_versions:
18-
- ~> 2.3.18
19-
- ~> 3.1.12
20-
- '>= 3.2.13'
20+
- "~> 2.3.18"
21+
- "~> 3.1.12"
22+
- ">= 3.2.13"

‎gems/actionpack/CVE-2013-1857.yml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ gem: actionpack
33
framework: rails
44
cve: 2013-1857
55
osvdb: 91454
6+
ghsa: j838-vfpq-fmf2
67
url: https://nvd.nist.gov/vuln/detail/CVE-2013-1857
78
title: 'CVE-2013-1857 rubygem-actionpack: sanitize_protocol: XSS Vulnerability in
89
the helper of Ruby on Rails'
@@ -17,6 +18,6 @@ description: 'The sanitize helper in lib/action_controller/vendor/html-scanner/h
1718
Pack.'
1819
cvss_v2: 4.3
1920
patched_versions:
20-
- ~> 2.3.18
21-
- ~> 3.1.12
22-
- '>= 3.2.13'
21+
- "~> 2.3.18"
22+
- "~> 3.1.12"
23+
- ">= 3.2.13"

‎gems/actionpack/CVE-2013-4491.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ gem: actionpack
33
framework: rails
44
cve: 2013-4491
55
osvdb: 100528
6+
ghsa: 699m-mcjm-9cw8
67
url: https://groups.google.com/forum/#!topic/ruby-security-ann/pLrh6DUw998
78
title: Reflective XSS Vulnerability in Ruby on Rails
89
date: 2013-12-03
@@ -15,5 +16,5 @@ description: |
1516
been assigned the identifier CVE-2013-4492.
1617
cvss_v2: 4.3
1718
patched_versions:
18-
- ~> 3.2.16
19-
- '>= 4.0.2'
19+
- "~> 3.2.16"
20+
- ">= 4.0.2"

‎gems/actionpack/CVE-2013-6414.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ gem: actionpack
33
framework: rails
44
cve: 2013-6414
55
osvdb: 100525
6+
ghsa: mpxf-gcw2-pw5q
67
url: https://groups.google.com/forum/#!topic/ruby-security-ann/A-ebV4WxzKg
78
title: Denial of Service Vulnerability in Action View
89
date: 2013-12-03
@@ -11,8 +12,7 @@ description: |
1112
Action View.
1213
cvss_v2: 5.0
1314
unaffected_versions:
14-
- ~> 2.3.0
15-
15+
- "~> 2.3.0"
1616
patched_versions:
17-
- ~> 3.2.16
18-
- '>= 4.0.2'
17+
- "~> 3.2.16"
18+
- ">= 4.0.2"

‎gems/actionpack/CVE-2013-6415.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ gem: actionpack
33
framework: rails
44
cve: 2013-6415
55
osvdb: 100524
6+
ghsa: 6h5q-96hp-9jgm
67
url: https://groups.google.com/forum/#!topic/ruby-security-ann/9WiRn2nhfq0
78
title: XSS Vulnerability in number_to_currency
89
date: 2013-12-03
@@ -13,5 +14,5 @@ description: |
1314
which pass user controlled data as the unit parameter are vulnerable to an XSS attack.
1415
cvss_v2: 4.3
1516
patched_versions:
16-
- ~> 3.2.16
17-
- '>= 4.0.2'
17+
- "~> 3.2.16"
18+
- ">= 4.0.2"

‎gems/actionpack/CVE-2013-6416.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ gem: actionpack
33
framework: rails
44
cve: 2013-6416
55
osvdb: 100526
6+
ghsa: w37c-q653-qg95
67
url: https://groups.google.com/forum/#!topic/ruby-security-ann/5ZI1-H5OoIM
78
title: XSS Vulnerability in simple_format helper
89
date: 2013-12-03
@@ -16,9 +17,8 @@ description: |
1617
attributes will be vulnerable to an XSS attack.
1718
cvss_v2: 4.3
1819
unaffected_versions:
19-
- ~> 2.3.0
20-
- ~> 3.1.0
21-
- ~> 3.2.0
22-
20+
- "~> 2.3.0"
21+
- "~> 3.1.0"
22+
- "~> 3.2.0"
2323
patched_versions:
24-
- '>= 4.0.2'
24+
- ">= 4.0.2"

‎gems/actionpack/CVE-2013-6417.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ gem: actionpack
33
framework: rails
44
cve: 2013-6417
55
osvdb: 100527
6+
ghsa: wpw7-wxjm-cw8r
67
url: https://groups.google.com/forum/#!topic/ruby-security-ann/niK4drpSHT4
78
title: Incomplete fix to CVE-2013-0155 (Unsafe Query Generation Risk)
89
date: 2013-12-03
@@ -17,5 +18,5 @@ description: |
1718
vulnerability.
1819
cvss_v2: 6.4
1920
patched_versions:
20-
- ~> 3.2.16
21-
- '>= 4.0.2'
21+
- "~> 3.2.16"
22+
- ">= 4.0.2"

‎gems/activerecord/CVE-2013-0155.yml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,21 @@ gem: activerecord
33
framework: rails
44
cve: 2013-0155
55
osvdb: 89025
6+
ghsa: gppp-5xc5-wfpx
67
url: https://nvd.nist.gov/vuln/detail/CVE-2013-0155
78
title: 'CVE-2013-0155 rubygem-actionpack, rubygem-activerecord: Unsafe Query Generation
89
Risk in Ruby on Rails'
910
date: 2013-01-08
10-
description: Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before
11+
description: |
12+
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before
1113
3.2.11 does not properly consider differences in parameter handling between the
1214
Active Record component and the JSON implementation, which allows remote attackers
1315
to bypass intended database-query restrictions and perform NULL checks or trigger
1416
missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]"
1517
values, a related issue to CVE-2012-2660 and CVE-2012-2694.
1618
cvss_v2: 10.0
1719
patched_versions:
18-
- ~> 2.3.16
19-
- ~> 3.0.19
20-
- ~> 3.1.10
21-
- '>= 3.2.11'
20+
- "~> 2.3.16"
21+
- "~> 3.0.19"
22+
- "~> 3.1.10"
23+
- ">= 3.2.11"

0 commit comments

Comments
 (0)