Skip to content

Commit b4155ec

Browse files
reedlodenreedloden
committed
Add a bunch of old submissions that never were added
1 parent b51605e commit b4155ec

10 files changed

Lines changed: 209 additions & 0 deletions

File tree

‎gems/geminabox/CVE-2017-16792.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
gem: geminabox
3+
cve: 2017-16792
4+
date: 2017-11-10
5+
url: https://github.com/geminabox/geminabox/blob/master/CHANGELOG.md#01310-2017-11-13
6+
title: Stored XSS in "geminabox" via injection in Gemspec "homepage" value
7+
description: |
8+
Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem
9+
in a Box) allows attackers to inject arbitrary web script via a crafted
10+
JavaScript URL in the "homepage" value of a ".gemspec" file.
11+
12+
A ".gemspec" file must be created with a JavaScript URL in the homepage
13+
value. This can be used to build a gem for upload to the Geminabox server,
14+
in order to achieve stored XSS via the gem hyperlink.
15+
16+
patched_versions:
17+
- ">= 0.13.10"
18+
related:
19+
url:
20+
- https://github.com/geminabox/geminabox/commit/f8429a9e364658459add170e4ebc7a5d3b4759e7
21+
- https://github.com/geminabox/geminabox/commit/e7e0b16147677e9029f0b55eff6bc6dda52398d4

‎gems/gemirro/CVE-2017-16833.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
gem: gemirro
3+
cve: 2017-16833
4+
date: 2017-07-11
5+
url: https://github.com/PierreRambaud/gemirro/commit/9659f9b7ce15a723da8e361bd41b9203b19c97de
6+
title: Stored XSS in "gemirro" via injection in Gemspec "homepage" value
7+
description: |
8+
Stored cross-site scripting (XSS) vulnerability in Gemirro allows
9+
attackers to inject arbitrary web script via a crafted JavaScript URL
10+
in the "homepage" value of a ".gemspec" file.
11+
12+
A ".gemspec" file must be created with a JavaScript URL in the homepage
13+
value. This can be used to build a gem for upload to the Gemirro server,
14+
in order to achieve stored XSS via the author name hyperlink.
15+
16+
patched_versions:
17+
- ">= 0.15.0"
18+
related:
19+
url:
20+
- https://github.com/PierreRambaud/gemirro/commit/8acfb9ce9774128d535e2795d583242bb86d6ea8
21+
- https://github.com/PierreRambaud/gemirro/commit/8fa709b121b7e18fceda308917d0fb68dc1479c3
22+
- https://rubygems.org/gems/gemirro/versions/0.15.0

‎gems/json-jwt/CVE-2018-3768.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
gem: json-jwt
3+
cve: 2018-3768
4+
date: 2018-04-30
5+
url: https://github.com/nov/json-jwt/pull/62
6+
title: Auth tag forgery vulnerability with AES-GCM encrypted JWT
7+
description: |
8+
Ruby's OpenSSL bindings do not check the length of the supplied
9+
authentication tag when decrypting an authenticated encryption mode
10+
such as AES-GCM, leaving this up to the authors of a gem/app to
11+
implement for properly validating the message.
12+
13+
json-jwt was not checking for the authentication tag length, meaning
14+
that with a one byte tag the JWT would be considered not tampered
15+
with. This means that with an average of 128 (max 256) attempts an
16+
attacker can forge a valid signature.
17+
18+
unaffected_versions:
19+
- "< 0.5.1"
20+
patched_versions:
21+
- ">= 1.9.4"

‎gems/net-ldap/CVE-2017-17718.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
gem: net-ldap
3+
cve: 2017-17718
4+
date: 2017-12-17
5+
url: https://github.com/ruby-ldap/ruby-net-ldap/issues/258
6+
title: No validation of hostname certificate in net-ldap
7+
description: |
8+
The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL
9+
Certificate Validation. The LDAP server's certificate was not verified
10+
to match the host it was supposed to be connecting to.
11+
12+
patched_versions:
13+
- ">= 0.16.0"
14+
related:
15+
url:
16+
- https://github.com/ruby-ldap/ruby-net-ldap/pull/279
17+
- https://github.com/ruby-ldap/ruby-net-ldap/commit/e4c46a223a19feda78393a793711353aa1febdcd

‎gems/nokogiri/CVE-2018-8048.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
gem: nokogiri
3+
cve: 2018-8048
4+
date: 2018-03-29
5+
url: https://github.com/sparklemotion/nokogiri/pull/1746
6+
title: Revert libxml2 behavior in Nokogiri gem that could cause XSS
7+
description: |
8+
[MRI] Behavior in libxml2 has been reverted which caused
9+
CVE-2018-8048 (loofah gem), CVE-2018-3740 (sanitize gem), and
10+
CVE-2018-3741 (rails-html-sanitizer gem). The commit in question is
11+
here:
12+
13+
https://github.com/GNOME/libxml2/commit/960f0e2
14+
15+
and more information is available about this commit and its impact
16+
here:
17+
18+
https://github.com/flavorjones/loofah/issues/144
19+
20+
This release simply reverts the libxml2 commit in question to protect
21+
users of Nokogiri's vendored libraries from similar vulnerabilities.
22+
23+
If you're offended by what happened here, I'd kindly ask that you
24+
comment on the upstream bug report here:
25+
26+
https://bugzilla.gnome.org/show_bug.cgi?id=769760
27+
28+
patched_versions:
29+
- ">= 1.8.3"
30+
related:
31+
cve:
32+
- 2018-3740
33+
- 2018-3741
34+
url:
35+
- https://github.com/GNOME/libxml2/commit/960f0e2
36+
- https://bugzilla.gnome.org/show_bug.cgi?id=769760

‎gems/rack-cors/CVE-2017-11173.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
gem: rack-cors
3+
cve: 2017-11173
4+
date: 2015-07-13
5+
url: https://github.com/cyu/rack-cors/issues/86
6+
title: rack-cors Gem Missing Anchor permits unauthorized CORS requests
7+
description: |
8+
Missing anchor in generated regex for rack-cors before 0.4.1
9+
allows a malicious third-party site to perform CORS requests.
10+
If the configuration were intended to allow only the trusted
11+
example.com domain name and not the malicious example.net domain name,
12+
then example.com.example.net (as well as example.com-example.net) would
13+
be inadvertently allowed.
14+
15+
cvss_v2: 6.8
16+
patched_versions:
17+
- ">= 0.4.1"
18+
related:
19+
url:
20+
- https://github.com/cyu/rack-cors/issues/86
21+
- http://seclists.org/fulldisclosure/2017/Jul/22

‎gems/rails_admin/CVE-2016-10522.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
gem: rails_admin
3+
cve: 2016-10522
4+
date: 2016-12-21
5+
url: https://www.sourceclear.com/blog/Rails_admin-Vulnerability-Disclosure/
6+
title: CSRF vulnerability in rails_admin
7+
description: |
8+
The rails_admin gem is vulnerable to cross-site request forgery (CSRF) attacks.
9+
Due to a bug, non-GET methods were not validating CSRF tokens and, as a result,
10+
an attacker could hypothetically gain access to the application administrative
11+
endpoints exposed by the gem.
12+
13+
cvss_v2: 5.5
14+
unaffected_versions:
15+
- "< 1.0.0"
16+
patched_versions:
17+
- ">= 1.1.1"
18+
related:
19+
url:
20+
- https://www.sourceclear.com/registry/security/cross-site-request-forgery-csrf-/ruby/sid-3173
21+
- https://github.com/sferik/rails_admin/commit/b13e879eb93b661204e9fb5e55f7afa4f397537a

‎gems/ruby-grape/CVE-2018-3769.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
gem: ruby-grape
3+
cve: 2018-3769
4+
date: 2018-05-23
5+
url: https://github.com/ruby-grape/grape/issues/1762
6+
title: ruby-grape Gem has XSS via "format" parameter
7+
description: |
8+
When request on API contains the "format" parameter in GET, the input
9+
value of this parameter is rendered as the web-server responds with
10+
text/html header.
11+
12+
Example:
13+
http://example.com/api/endpoint?format=%3Cscript%3Ealert(document.cookie)%3C/script%3E
14+
15+
patched_versions:
16+
- ">= 1.0.3"
17+
related:
18+
url:
19+
- https://github.com/ruby-grape/grape/pull/1763
20+
- https://github.com/ruby-grape/grape/commit/6876b71efc7b03f7ce1be3f075eaa4e7e6de19af

‎gems/thor/CVE-2016-10545.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
gem: thor
3+
cve: 2016-10545
4+
date: 2016-01-08
5+
url: https://github.com/erikhuda/thor/issues/514
6+
title: Command injection in Thor Gem
7+
description: |
8+
`open-uri`'s open used in Thor::Actions#get allows executing system
9+
commands. Documentation does not warn that source parameter is
10+
vulnerable to malicious input.
11+
12+
related:
13+
url:
14+
- https://sakurity.com/blog/2015/02/28/openuri.html

‎libraries/rubygems/CVE-2017-0903.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
library: rubygems
3+
cve: 2017-0903
4+
url: https://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
5+
title: Unsafe Object Deserialization Vulnerability in RubyGems
6+
date: 2017-10-09
7+
description: |
8+
There is a possible unsafe object deserialization vulnerability in RubyGems.
9+
It is possible for YAML deserialization of gem specifications to bypass class
10+
white lists. Specially crafted serialized objects can possibly be used to
11+
escalate to remote code execution.
12+
cvss_v2: 7.5
13+
unaffected_versions:
14+
- "< 2.0.0"
15+
patched_versions:
16+
- ">= 2.6.14"

0 commit comments

Comments
 (0)