Skip to content

Commit d7918cf

Browse files
reedlodenreedloden
committed
Sync with GitHub Security Advisories
* Add CVE-2018-1000074, CVE-2018-1000075, CVE-2018-1000077, CVE-2018-1000078, CVE-2018-1000079 for rubygems-update * Metadata updates for pdf_info/CVE-2022-36231, rubygems-update/CVE-2015-3900, rubygems-update/CVE-2017-0899, rubygems-update/CVE-2017-0900, rubygems-update/CVE-2017-0901, rubygems-update/CVE-2017-0902
1 parent 4020af8 commit d7918cf

11 files changed

Lines changed: 203 additions & 12 deletions

‎gems/pdf_info/CVE-2022-36231.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ description: |
1010
a specially crafted payload may execute OS commands by using command chaining because
1111
during object initalization there is no validation performed and the user provided
1212
path is used.
13+
cvss_v3: 9.8
1314
related:
1415
url:
1516
- https://github.com/newspaperclub/pdf_info/issues/16

‎gems/rubygems-update/CVE-2015-3900.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ gem: rubygems-update
33
library: rubygems
44
cve: 2015-3900
55
osvdb: 122162
6+
ghsa: wp3j-rvfp-624h
67
url: https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007/?fid=6356
78
title: 'CVE-2015-3900 rubygems: DNS hijacking vulnerability in api_endpoint()'
89
date: 2015-05-14
@@ -15,6 +16,6 @@ description: RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before
1516
domain.
1617
cvss_v2: 5.0
1718
patched_versions:
18-
- ~> 2.0.16
19-
- ~> 2.2.4
20-
- '>= 2.4.7'
19+
- "~> 2.0.16"
20+
- "~> 2.2.4"
21+
- ">= 2.4.7"

‎gems/rubygems-update/CVE-2017-0899.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ gem: rubygems-update
33
library: rubygems
44
cve: 2017-0899
55
ghsa: 7gcp-2gmq-w3xh
6-
url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
6+
url: https://blog.rubygems.org/2017/08/27/2.6.13-released.html
77
title: RubyGems ANSI escape sequence vulnerability
88
date: 2017-08-29
99
description: |

‎gems/rubygems-update/CVE-2017-0900.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,17 @@
22
gem: rubygems-update
33
library: rubygems
44
cve: 2017-0900
5-
url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
5+
ghsa: p7f2-rr42-m9xm
6+
url: https://blog.rubygems.org/2017/08/27/2.6.13-released.html
67
title: RubyGems DoS vulnerability in the query command
78
date: 2017-08-29
89
description: |
910
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem
1011
specifications to cause a denial of service attack against RubyGems clients
1112
who have issued a `query` command.
1213
cvss_v2: 5.0
14+
cvss_v3: 7.5
1315
patched_versions:
14-
- '>= 2.4.5.3'
15-
- '>= 2.5.2.1'
16-
- '>= 2.6.13'
16+
- ">= 2.4.5.3"
17+
- ">= 2.5.2.1"
18+
- ">= 2.6.13"

‎gems/rubygems-update/CVE-2017-0901.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,8 @@ gem: rubygems-update
33
library: rubygems
44
cve: 2017-0901
55
ghsa: pm9x-4392-2c2p
6-
url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
7-
title: RubyGems vulnerability in the gem installer that allowed a malicious gem to
8-
overwrite arbitrary files
6+
url: https://blog.rubygems.org/2017/08/27/2.6.13-released.html
7+
title: RubyGems vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files
98
date: 2017-08-29
109
description: |
1110
RubyGems version 2.6.12 and earlier fails to validate specification names,

‎gems/rubygems-update/CVE-2017-0902.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ gem: rubygems-update
33
library: rubygems
44
cve: 2017-0902
55
ghsa: 73w7-6w9g-gc8w
6-
url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
6+
url: https://blog.rubygems.org/2017/08/27/2.6.13-released.html
77
title: RubyGems DNS request hijacking vulnerability
88
date: 2017-08-29
99
description: |

‎gems/rubygems-update/CVE-2018-1000074.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
gem: rubygems-update
3+
cve: 2018-1000074
4+
ghsa: qj2w-mw2r-pv39
5+
url: https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d
6+
title: RubyGems Deserialization of Untrusted Data vulnerability
7+
date: 2022-05-14
8+
description: |
9+
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
10+
2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and
11+
earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data
12+
vulnerability in owner command that can result in code execution. This attack requires
13+
the victim to run the `gem owner` command on a gem with a specially crafted YAML
14+
file. This vulnerability is fixed in 2.7.6.
15+
cvss_v3: 7.8
16+
patched_versions:
17+
- ">= 2.7.6"
18+
related:
19+
url:
20+
- https://access.redhat.com/errata/RHSA-2018:3729
21+
- https://access.redhat.com/errata/RHSA-2018:3730
22+
- https://access.redhat.com/errata/RHSA-2018:3731
23+
- https://access.redhat.com/errata/RHSA-2019:2028
24+
- https://access.redhat.com/errata/RHSA-2020:0542
25+
- https://access.redhat.com/errata/RHSA-2020:0591
26+
- https://access.redhat.com/errata/RHSA-2020:0663
27+
- https://lists.debian.org/debian-lts-announce/2018/04/msg00017.html
28+
- https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html
29+
- https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html
30+
- https://usn.ubuntu.com/3621-1/
31+
- https://usn.ubuntu.com/3621-2/
32+
- https://usn.ubuntu.com/3685-1/
33+
- https://www.debian.org/security/2018/dsa-4219
34+
- https://www.debian.org/security/2018/dsa-4259
35+
- http://blog.rubygems.org/2018/02/15/2.7.6-released.html
36+
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
37+
- https://github.com/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7
38+
- https://github.com/rubygems/rubygems/commit/5971b486d4dbb2bad5d3445b3801c456eb0ce183

‎gems/rubygems-update/CVE-2018-1000075.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
gem: rubygems-update
3+
cve: 2018-1000075
4+
ghsa: 74pv-v9gh-h25p
5+
url: https://github.com/rubygems/rubygems/commit/92e98bf8f810bd812f919120d4832df51bc25d83
6+
title: RubyGems Infinite Loop vulnerability
7+
date: 2022-05-13
8+
description: |
9+
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
10+
2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and
11+
earlier, prior to trunk revision 62422 contains a infinite loop caused by negative
12+
size vulnerability in ruby gem package tar header that can result in a negative
13+
size could cause an infinite loop.. This vulnerability appears to have been fixed
14+
in 2.7.6.
15+
cvss_v3: 7.5
16+
patched_versions:
17+
- ">= 2.7.6"
18+
related:
19+
url:
20+
- https://access.redhat.com/errata/RHSA-2018:3729
21+
- https://access.redhat.com/errata/RHSA-2018:3730
22+
- https://access.redhat.com/errata/RHSA-2018:3731
23+
- https://access.redhat.com/errata/RHSA-2019:2028
24+
- https://access.redhat.com/errata/RHSA-2020:0542
25+
- https://access.redhat.com/errata/RHSA-2020:0591
26+
- https://access.redhat.com/errata/RHSA-2020:0663
27+
- https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html
28+
- https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html
29+
- https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
30+
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
31+
- https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html
32+
- https://usn.ubuntu.com/3621-1/
33+
- https://www.debian.org/security/2018/dsa-4219
34+
- https://www.debian.org/security/2018/dsa-4259
35+
- http://blog.rubygems.org/2018/02/15/2.7.6-released.html
36+
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
37+
- https://github.com/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7
38+
- https://github.com/rubygems/rubygems/commit/5971b486d4dbb2bad5d3445b3801c456eb0ce183

‎gems/rubygems-update/CVE-2018-1000077.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
gem: rubygems-update
3+
cve: 2018-1000077
4+
ghsa: gv86-43rv-79m2
5+
url: https://github.com/rubygems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964
6+
title: RubyGems Improper Input Validation vulnerability
7+
date: 2022-05-14
8+
description: |
9+
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
10+
2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and
11+
earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability
12+
in ruby gems specification homepage attribute that can result in a malicious gem
13+
setting an invalid homepage URL. This vulnerability is fixed in 2.7.6.
14+
cvss_v3: 5.3
15+
patched_versions:
16+
- ">= 2.7.6"
17+
related:
18+
url:
19+
- https://access.redhat.com/errata/RHSA-2018:3729
20+
- https://access.redhat.com/errata/RHSA-2018:3730
21+
- https://access.redhat.com/errata/RHSA-2018:3731
22+
- https://access.redhat.com/errata/RHSA-2019:2028
23+
- https://access.redhat.com/errata/RHSA-2020:0542
24+
- https://access.redhat.com/errata/RHSA-2020:0591
25+
- https://access.redhat.com/errata/RHSA-2020:0663
26+
- https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html
27+
- https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html
28+
- https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
29+
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
30+
- https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html
31+
- https://usn.ubuntu.com/3621-1/
32+
- https://www.debian.org/security/2018/dsa-4219
33+
- https://www.debian.org/security/2018/dsa-4259
34+
- http://blog.rubygems.org/2018/02/15/2.7.6-released.html
35+
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
36+
- https://github.com/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7
37+
- https://github.com/rubygems/rubygems/commit/5971b486d4dbb2bad5d3445b3801c456eb0ce183

‎gems/rubygems-update/CVE-2018-1000078.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
gem: rubygems-update
3+
cve: 2018-1000078
4+
ghsa: 87qx-g5wg-mwmj
5+
url: https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb
6+
title: RubyGems Cross-site Scripting vulnerability
7+
date: 2022-05-14
8+
description: |
9+
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
10+
2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and
11+
earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability
12+
in gem server display of homepage attribute that can result in XSS. This attack
13+
requires the victim to browse to a malicious gem on a vulnerable gem server. This
14+
vulnerability is fixed in 2.7.6.
15+
cvss_v3: 6.1
16+
patched_versions:
17+
- ">= 2.7.6"
18+
related:
19+
url:
20+
- https://access.redhat.com/errata/RHSA-2018:3729
21+
- https://access.redhat.com/errata/RHSA-2018:3730
22+
- https://access.redhat.com/errata/RHSA-2018:3731
23+
- https://access.redhat.com/errata/RHSA-2019:2028
24+
- https://access.redhat.com/errata/RHSA-2020:0542
25+
- https://access.redhat.com/errata/RHSA-2020:0591
26+
- https://access.redhat.com/errata/RHSA-2020:0663
27+
- https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html
28+
- https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html
29+
- https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
30+
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
31+
- https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html
32+
- https://usn.ubuntu.com/3621-1/
33+
- https://www.debian.org/security/2018/dsa-4219
34+
- https://www.debian.org/security/2018/dsa-4259
35+
- http://blog.rubygems.org/2018/02/15/2.7.6-released.html
36+
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
37+
- https://github.com/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7
38+
- https://github.com/rubygems/rubygems/commit/5971b486d4dbb2bad5d3445b3801c456eb0ce183

0 commit comments

Comments
 (0)