Updated advisory posts against rubysec/ruby-advisory-db@cb566ac

Author: jasnow

advisories/_posts/2025-03-12-CVE-2025-27407.md

@@ -0,0 +1,49 @@
+---
+layout: advisory
+title: 'CVE-2025-27407 (graphql): graphql allows remote code execution when loading
+  a crafted GraphQL schema'
+comments: false
+categories:
+- graphql
+advisory:
+  gem: graphql
+  cve: 2025-27407
+  ghsa: q92j-grw3-h492
+  url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q92j-grw3-h492
+  title: graphql allows remote code execution when loading a crafted GraphQL schema
+  date: 2025-03-12
+  description: |
+    Loading a malicious schema definition in
+    `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`)
+    can result in remote code execution. Any system which loads a schema
+    by JSON from an untrusted source is vulnerable, including those that
+    use [GraphQL::Client](https://github.com/github-community-projects/graphql-client)
+    to load external schemas via GraphQL introspection.
+  cvss_v3: 9.1
+  unaffected_versions:
+  - "< 1.11.5"
+  patched_versions:
+  - "~> 1.11.11"
+  - "~> 1.12.25"
+  - "~> 1.13.24"
+  - "~> 2.0.32"
+  - "~> 2.1.15"
+  - "~> 2.2.17"
+  - "~> 2.3.21"
+  - ">= 2.4.13"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-27407
+    - https://github.com/github-community-projects/graphql-client
+    - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q92j-grw3-h492
+    - https://github.com/rmosolgo/graphql-ruby/commit/e58676c70aa695e3052ba1fbc787efee4ba7d67e
+    - https://github.com/rmosolgo/graphql-ruby/commit/28233b16c0eb9d0fb7808f4980e061dc7507c4cd
+    - https://github.com/rmosolgo/graphql-ruby/commit/2d2f4ed1f79472f8eed29c864b039649e1de238f
+    - https://github.com/rmosolgo/graphql-ruby/commit/5c5a7b9a9bdce143be048074aea50edb7bb747be
+    - https://github.com/rmosolgo/graphql-ruby/commit/6eca16b9fa553aa957099a30dbde64ddcdac52ca
+    - https://github.com/rmosolgo/graphql-ruby/commit/d0963289e0dab4ea893bbecf12bb7d89294957bb
+    - https://github.com/rmosolgo/graphql-ruby/commit/d1117ae0361d9ed67e0795b07f5c3e98e62f3c7c
+    - https://github.com/rmosolgo/graphql-ruby/commit/e3b33ace05391da2871c75ab4d3b66e29133b367
+    - https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released
+    - https://github.com/advisories/GHSA-q92j-grw3-h492
+---

advisories/_posts/2025-03-12-CVE-2025-27788.md

@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2025-27788 (json): Out-of-bounds Read in Ruby JSON Parser'
+comments: false
+categories:
+- json
+advisory:
+  gem: json
+  cve: 2025-27788
+  ghsa: 9m3q-rhmv-5q44
+  url: https://github.com/ruby/json/security/advisories/GHSA-9m3q-rhmv-5q44
+  title: Out-of-bounds Read in Ruby JSON Parser
+  date: 2025-03-12
+  description: |
+    ### Impact
+
+    A specially crafted document could cause an out of bound read,
+    most likely resulting in a crash.
+
+    Versions 2.10.0 and 2.10.1 are impacted. Older versions are not.
+
+    ### Patches
+
+    Version 2.10.2 fixes the problem.
+
+    ### Workarounds
+
+    None.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 2.10.0"
+  patched_versions:
+  - ">= 2.10.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-27788
+    - https://github.com/ruby/json/security/advisories/GHSA-9m3q-rhmv-5q44
+    - https://github.com/ruby/json/releases/tag/v2.10.2
+    - https://github.com/ruby/json/commit/c56db31f800d5d508389793e69682f99749dbadf
+    - https://github.com/advisories/GHSA-9m3q-rhmv-5q44
+---