Skip to content

Commit eca814c

Browse files
jasnowpostmodern
jasnow
authored and
postmodern
committed
GHSA modifies + local syntax fixes
1 parent 0aa65a3 commit eca814c

16 files changed

+70
-51
lines changed

‎gems/actionpack/CVE-2014-0081.yml

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ gem: actionpack
33
framework: rails
44
cve: 2014-0081
55
osvdb: 103439
6+
ghsa: m46p-ggm5-5j83
67
url: https://nvd.nist.gov/vuln/detail/CVE-2014-0081
7-
title: 'CVE-2014-0081 rubygem-actionpack: number_to_currency, number_to_percentage
8-
and number_to_human XSS vulnerability'
8+
title: "CVE-2014-0081 rubygem-actionpack: number_to_currency,
9+
number_to_percentage and number_to_human XSS vulnerability"
910
date: 2014-02-18
1011
description: |
1112
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb
@@ -15,6 +16,6 @@ description: |
1516
or (c) number_to_human helper.
1617
cvss_v2: 4.3
1718
patched_versions:
18-
- ~> 3.2.17
19-
- ~> 4.0.3
20-
- '>= 4.1.0.beta2'
19+
- "~> 3.2.17"
20+
- "~> 4.0.3"
21+
- ">= 4.1.0.beta2"

‎gems/actionpack/CVE-2016-0752.yml

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,10 @@
22
gem: actionpack
33
framework: rails
44
cve: 2016-0752
5-
date: 2016-01-25
5+
ghsa: xrr4-p6fq-hjg7
66
url: https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00
77
title: Possible Information Leak Vulnerability in Action View
8+
date: 2016-01-25
89
description: |
910
There is a possible directory traversal and information leak vulnerability in
1011
Action View. This vulnerability has been assigned the CVE identifier
@@ -83,11 +84,12 @@ description: |
8384
Credits
8485
-------
8586
Thanks John Poulin for reporting this!
87+
cvss_v3: 7.5
8688
unaffected_versions:
87-
- '>= 4.1.0'
89+
- ">= 4.1.0"
8890
patched_versions:
89-
- '>= 5.0.0.beta1.1'
90-
- ~> 4.2.5, >= 4.2.5.1
91-
- ~> 4.1.14, >= 4.1.14.1
92-
- ~> 3.2.22.1
93-
notes: Newer versions are affected, but tracked in the actionview gem.
91+
- ">= 5.0.0.beta1.1"
92+
- "~> 4.2.5, >= 4.2.5.1"
93+
- "~> 4.1.14, >= 4.1.14.1"
94+
- "~> 3.2.22.1"
95+
notes: "Newer versions are affected, but tracked in the actionview gem."

‎gems/actionpack/CVE-2016-2097.yml

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,10 @@
22
gem: actionpack
33
framework: rails
44
cve: 2016-2097
5-
date: 2016-02-29
5+
ghsa: vx9j-46rh-fqr8
66
url: https://groups.google.com/forum/#!topic/rubyonrails-security/ddY6HgqB2z4
77
title: Possible Information Leak Vulnerability in Action View
8+
date: 2016-02-29
89
description: |
910
1011
There is a possible directory traversal and information leak vulnerability
@@ -78,10 +79,11 @@ description: |
7879
-------
7980
Thanks to both Jyoti Singh and Tobias Kraze from makandra for reporting this
8081
and working with us in the patch!
82+
cvss_v3: 5.3
8183
unaffected_versions:
82-
- '>= 4.1.0'
84+
- ">= 4.1.0"
8385
patched_versions:
84-
- ~> 3.2.22.2
85-
- ~> 4.1.14
86-
- '>= 4.1.14.2'
87-
notes: Newer versions are affected, but tracked in the actionview gem.
86+
- "~> 3.2.22.2"
87+
- "~> 4.1.14"
88+
- ">= 4.1.14.2"
89+
notes: "Newer versions are affected, but tracked in the actionview gem."

‎gems/actionpack/CVE-2016-6316.yml

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,10 @@
22
gem: actionpack
33
framework: rails
44
cve: 2016-6316
5-
date: 2016-08-11
5+
ghsa: pc3m-v286-2jwj
66
url: https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk
77
title: Possible XSS Vulnerability in Action View
8+
date: 2016-08-11
89
description: |
910
There is a possible XSS vulnerability in Action View. Text declared as "HTML
1011
safe" will not have quotes escaped when used as attribute values in tag
@@ -43,11 +44,12 @@ description: |
4344
4445
content_tag(:div, "hi", title: escape_quotes(sanitize(user_input)))
4546
```
47+
cvss_v3: 6.1
4648
unaffected_versions:
47-
- < 3.0.0
48-
- '>= 4.1.0'
49+
- "< 3.0.0"
50+
- ">= 4.1.0"
4951
patched_versions:
50-
- ~> 3.2.22.3
51-
- ~> 4.2.7.1
52-
- '>= 5.0.0.1'
53-
notes: Newer versions are affected, but tracked in the actionview gem.
52+
- "~> 3.2.22.3"
53+
- "~> 4.2.7.1"
54+
- ">= 5.0.0.1"
55+
notes: "Newer versions are affected, but tracked in the actionview gem."

‎gems/actionview/CVE-2023-23913.yml

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
gem: actionview
33
framework: rails
44
cve: 2023-23913
5+
ghsa: xp5h-f8jf-rc8q
56
url: https://discuss.rubyonrails.org/t/cve-2023-23913-dom-based-cross-site-scripting-in-rails-ujs-for-contenteditable-html-elements/82468
6-
title: DOM Based Cross-site Scripting in rails-ujs for
7-
contenteditable HTML Elements
7+
title: DOM Based Cross-site Scripting in rails-ujs for contenteditable HTML Elements
88
date: 2023-03-13
99
description: |
1010
NOTE: rails-ujs is part of Rails/actionview since 5.1.0.
@@ -56,7 +56,6 @@ description: |
5656
* rails-ujs-data-method-contenteditable-6-1.patch (8.5 KB)
5757
* rails-ujs-data-method-contenteditable-7-0.patch (8.5 KB)
5858
* rails-ujs-data-method-contenteditable-main.patch (8.9 KB)
59-
6059
cvss_v3: 7.5
6160
unaffected_versions:
6261
- "< 5.1.0"

‎gems/echor/CVE-2014-1834.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
gem: echor
33
cve: 2014-1834
44
osvdb: 102129
5+
ghsa: 8936-cgj4-phr2
56
url: https://nvd.nist.gov/vuln/detail/CVE-2014-1834
67
title: echor Gem for Ruby backplane.rb perform_request Function Arbitrary Command
78
Execution
@@ -11,3 +12,4 @@ description: |
1112
function that is triggered when a semi-colon (;) is injected into a username
1213
or password. This may allow a context-dependent attacker to inject arbitrary
1314
commands if the gem is used in a rails application.
15+
cvss_v3: 7.8

‎gems/echor/CVE-2014-1835.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,12 @@
22
gem: echor
33
cve: 2014-1835
44
osvdb: 102130
5+
ghsa: j4gx-p3x5-m987
56
url: https://nvd.nist.gov/vuln/detail/CVE-2014-1835
67
title: echor Gem for Ruby Process Listing Local Plaintext Credential Disclosure
78
date: 2014-01-14
89
description: |
910
echor Gem for Ruby contains a flaw that is due to the program exposing
1011
credential information in the system process listing. This may allow a local
1112
attacker to gain access to plaintext credential information.
13+
cvss_v3: 7.8

‎gems/kredis/CVE-2023-27531.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
gem: kredis
33
framework: rails
44
cve: 2023-27531
5+
ghsa: h2wm-p2vg-6pw4
56
url: https://discuss.rubyonrails.org/t/cve-2023-27531-possible-deserialization-of-untrusted-data-vulnerability-in-kredis-json/82467#post_1
67
title: Possible Deserialization of Untrusted Data Vulnerability in Kredis JSON
78
date: 2023-03-13
@@ -36,7 +37,6 @@ description: |
3637
3738
Credits
3839
Thank you ooooooo_k 7 for reporting this!
39-
4040
patched_versions:
4141
- ">= 1.3.0.1"
4242
related:

‎gems/nokogiri/CVE-2013-6460.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,15 @@ gem: nokogiri
33
platform: jruby
44
cve: 2013-6460
55
osvdb: 101179
6+
ghsa: 62qp-3fxm-9wxf
67
url: https://nvd.nist.gov/vuln/detail/CVE-2013-6460
78
title: "CVE-2013-6460 rubygem-nokogiri: DoS while parsing XML documents"
89
date: 2013-12-14
910
description: |
1011
Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing
1112
XML documents
1213
cvss_v2: 4.3
14+
cvss_v3: 6.5
1315
patched_versions:
14-
- ~> 1.5.11
15-
- '>= 1.6.1'
16+
- "~> 1.5.11"
17+
- ">= 1.6.1"

‎gems/nokogiri/CVE-2013-6461.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,14 @@
22
gem: nokogiri
33
cve: 2013-6461
44
osvdb: 101458
5+
ghsa: jmhh-w7xp-wg39
56
url: https://nvd.nist.gov/vuln/detail/CVE-2013-6461
67
title: "CVE-2013-6461 rubygem-nokogiri: DoS while parsing XML entities"
78
date: 2013-12-14
89
description: |
910
Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing
1011
to apply limits
12+
cvss_v3: 6.5
1113
patched_versions:
12-
- ~> 1.5.11
13-
- '>= 1.6.1'
14+
- "~> 1.5.11"
15+
- ">= 1.6.1"

0 commit comments

Comments
 (0)