Sync with GitHub Security Advisories

* Add CVE-2021-39880 for apollo_upload_server
* Metadata updates for activesupport/CVE-2023-28120, rack/CVE-2023-27530, rack/CVE-2023-27539

Author: reedloden

gems/activesupport/CVE-2023-28120.yml

@@ -2,6 +2,7 @@
 gem: activesupport
 framework: rails
 cve: 2023-28120
+ghsa: pj73-v5mw-pm9j
 url: https://discuss.rubyonrails.org/t/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice/82469
 title: Possible XSS Security Vulnerability in SafeBuffer#bytesplice
 date: 2023-03-13

gems/apollo_upload_server/CVE-2021-39880.yml

@@ -0,0 +1,23 @@
+---
+gem: apollo_upload_server
+cve: 2021-39880
+ghsa: w6pv-c757-6rgr
+url: https://hackerone.com/reports/1181284
+title: apollo_upload_server has Denial of Service vulnerability
+date: 2022-05-24
+description: |
+  A Denial Of Service vulnerability in the apollo_upload_server Ruby gem
+  in GitLab CE/EE version 11.11 and above allows an attacker to deny access to all
+  users via specially crafted requests to the apollo_upload_server middleware.
+cvss_v3: 6.5
+patched_versions:
+- ">= 2.1.0"
+related:
+  url:
+  - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39880.json
+  - https://gitlab.com/gitlab-org/gitlab/-/issues/330561
+  - https://github.com/jetruby/apollo_upload_server-ruby/pull/44
+  - https://github.com/jetruby/apollo_upload_server-ruby/commit/b0582c1a3e458eee3c994fb38278bd0221f20486
+  - https://github.com/jetruby/apollo_upload_server-ruby/releases/tag/2.1.0
+  - https://gitlab.com/gitlab-org/gitlab/-/issues/330561#note_642879964
+  - https://vuldb.com/?id.183842

gems/rack/CVE-2023-27530.yml

@@ -17,6 +17,7 @@ description: |
 
   # Workarounds
   A proxy can be configured to limit the POST body size which will mitigate this issue.
+cvss_v3: 7.5
 patched_versions:
 - "~> 2.0.9, >= 2.0.9.3"
 - "~> 2.1.4, >= 2.1.4.3"

gems/rack/CVE-2023-27539.yml

@@ -1,6 +1,7 @@
 ---
 gem: rack
 cve: 2023-27539
+ghsa: c6qg-cjj8-47qp
 url: https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466
 title: Possible Denial of Service Vulnerability in Rack’s header parsing
 date: 2023-03-13
@@ -14,7 +15,6 @@ description: |
 
   # Workarounds
   Setting Regexp.timeout in Ruby 3.2 is a possible workaround.
-
 patched_versions:
 - "~> 2.0, >= 2.2.6.4"
 - ">= 3.0.6.1"