TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-hjg4-8q5f-x6fm
Summary: Information Disclosure / Unintended Method Execution in Action Pack
Aliases: CVE-2021-22885
Severity: HIGH
CWE: CWE-200, CWE-209
Published: 2021-05-05T19:49:02Z

Impact
------
There is a possible information disclosure / unintended method execution
vulnerability in Action Pack when using the `redirect_to` or `polymorphic_url`
helper with untrusted user input.

Vulnerable code will look like this.

```
redirect_to(params[:some_param])
```

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
To work around this problem, it is recommended to use an allow list for valid
parameters passed from the user.  For example,

```
private def check(param)
  case param
  when "valid"
    param
  else
    "/"
  end
end

def index
  redirect_to(check(params[:some_param]))
end
```

Or force the user input to be cast to a string like this,

```
def index
  redirect_to(params[:some_param].to_s)
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 5-2-information-disclosure.patch - Patch for 5.2 series
* 6-0-information-disclosure.patch - Patch for 6.0 series
* 6-1-information-disclosure.patch - Patch for 6.1 series

Please note that only the 5.2, 6.0, and 6.1 series are supported at present. Users
of earlier unsupported releases are advised to upgrade as soon as possible as we
cannot guarantee the continued availability of security fixes for unsupported
releases.

Credits
-------

Thanks to Benoit Côté-Jodoin from Shopify for reporting this.
Vulnerability: GHSA-rgr4-9jh5-j4j6
Summary: Moderate severity vulnerability that affects rack
Aliases: CVE-2015-3225
Severity: MODERATE
Published: 2017-10-24T18:33:36Z

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
Vulnerability: GHSA-pr3r-4wrp-r2pv
Summary: ActiveRecord in Ruby on Rails allows database-query bypass
Aliases: CVE-2016-6317
Severity: HIGH
CWE: CWE-284, CWE-476
Published: 2017-10-24T18:33:35Z

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
Vulnerability: GHSA-px3r-jm9g-c8w8
Summary: Moderate severity vulnerability that affects rails-html-sanitizer
Aliases: CVE-2018-3741
Severity: MODERATE
CWE: CWE-79
Published: 2018-04-26T15:41:10Z

There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately.
Vulnerability: GHSA-fg9w-g6m4-557j
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2009-3086
Severity: MODERATE
CWE: CWE-200
Published: 2017-10-24T18:33:38Z

A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.
Vulnerability: GHSA-crjr-9rc5-ghw8
Summary: Inefficient Regular Expression Complexity in Nokogiri
Aliases: CVE-2022-24836
Severity: HIGH
CWE: CWE-1333, CWE-400
Published: 2022-04-11T21:18:06Z

## Summary

Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.


## Mitigation

Upgrade to Nokogiri `>= 1.13.4`.


## Severity

The Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).


## References

[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html) Inefficient Regular Expression Complexity


## Credit

This vulnerability was reported by HackerOne user ooooooo_q (ななおく).
Vulnerability: GHSA-4xjh-m3qx-49wc
Summary: Jekyll allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "_config.yml" file
Aliases: CVE-2018-17567
Severity: HIGH
CWE: CWE-59
Published: 2018-09-28T19:29:07Z

Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "_config.yml" file.
Vulnerability: GHSA-94hm-8q65-rmxm
Summary: High severity vulnerability that affects omniauth-saml
Aliases: CVE-2017-11430
Severity: HIGH
CWE: CWE-287
Published: 2019-07-05T21:11:43Z

OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Vulnerability: GHSA-w64w-qqph-5gxm
Summary: HTTP Smuggling via Transfer-Encoding Header in Puma
Aliases: CVE-2020-11077
Severity: MODERATE
CWE: CWE-444
Published: 2020-05-22T14:55:09Z

### Impact
This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4.

A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. 

If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.

### Patches

The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
Vulnerability: GHSA-hgpp-pp89-4fgf
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2012-2660
Severity: MODERATE
Published: 2017-10-24T18:33:38Z

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2694.
Vulnerability: GHSA-5f9h-9pjv-v6j7
Summary: Directory traversal in Rack::Directory app bundled with Rack
Aliases: CVE-2020-8161
Severity: MODERATE
CWE: CWE-548
Published: 2020-07-06T21:31:02Z

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.
Vulnerability: GHSA-r23g-3qw4-gfh2
Summary: Moderate severity vulnerability that affects redcloth
Aliases: CVE-2012-6684
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI.
Vulnerability: GHSA-92w9-2pqw-rhjj
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2012-3424
Severity: MODERATE
CWE: CWE-287
Published: 2017-10-24T18:33:38Z

The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as demonstrated by the authenticate_or_request_with_http_digest method.
Vulnerability: GHSA-pcqq-5962-hvcw
Summary: Denial of Service in uap-core when processing crafted User-Agent strings
Severity: HIGH
Published: 2020-03-10T18:02:49Z

### Impact
Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

### Patches
Please update `uap-ruby` to &gt;= v2.6.0

### For more information
https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p

Reported in `uap-core` by Ben Caller @bcaller
Vulnerability: GHSA-6h5q-96hp-9jgm
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2013-6415
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.
Vulnerability: GHSA-g98m-96g9-wfjq
Summary: Insecure path handling in Bundler
Aliases: CVE-2019-3881
Severity: HIGH
CWE: CWE-427, CWE-552
Published: 2021-05-10T14:53:59Z

Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.
Vulnerability: GHSA-hqf9-rc9j-5fmj
Summary: Moderate severity vulnerability that affects activerecord
Aliases: CVE-2014-0080
Severity: MODERATE
CWE: CWE-89
Published: 2017-10-24T18:33:36Z

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.
Vulnerability: GHSA-q44r-f2hm-v76v
Summary: Moderate severity vulnerability that affects puppet
Aliases: CVE-2012-3867
Severity: MODERATE
Published: 2017-10-24T18:33:37Z

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.
Vulnerability: GHSA-h77x-m5q8-c29h
Summary: Moderate severity vulnerability that affects rack
Aliases: CVE-2012-6109
Severity: MODERATE
CWE: CWE-835
Published: 2017-10-24T18:33:37Z

lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
Vulnerability: GHSA-7cgp-c3g7-qvrw
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2014-0082
Severity: MODERATE
CWE: CWE-20
Published: 2017-10-24T18:33:36Z

actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.
Vulnerability: GHSA-mpxf-gcw2-pw5q
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2013-6414
Severity: MODERATE
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.
Vulnerability: GHSA-vp9c-fpxx-744v
Summary: Validation bypass vulnerability
Severity: LOW
Published: 2020-09-23T17:19:55Z

Back in min June a security vulnerability was reported to the team, the reason for the slow response was due to ownership of some packages
was locked and we wanted to be sure to update all packages before any disclosure was released.

The issue is deemed being a Low severity vulnerability.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

C# 3.0.2  
D 3.0.1  
Dart 3.0.3  
Elixir 3.0.0  
Go 3.0.1  
Java 3.3.0  
JavaScript 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
PHP 3.0.2  
Perl 3.0.0  
Python 3.0.2  
Ruby 3.0.1  
Rust 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

### Credits

Niklas Sköldmark (Medborgarskolan)
Vulnerability: GHSA-wfwm-chj7-w59r
Summary: Moderate severity vulnerability that affects ox
Aliases: CVE-2017-16229
Severity: MODERATE
CWE: CWE-125
Published: 2018-03-05T18:29:32Z

In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the read_from_str function in sax_buf.c when a crafted input is supplied to sax_parse.
Vulnerability: GHSA-7rr7-rcjw-56vj
Summary: High severity vulnerability that affects activestorage
Aliases: CVE-2018-16477
Severity: MODERATE
CWE: CWE-200
Published: 2018-12-05T17:17:02Z

A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path.
Vulnerability: GHSA-653m-r33x-39ff
Summary: Moderate severity vulnerability that affects geminabox
Aliases: CVE-2017-16792
Severity: MODERATE
CWE: CWE-79
Published: 2017-11-29T23:20:14Z

Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb.
Vulnerability: GHSA-qxmr-qxh6-2cc9
Summary: ReDos vulnerability on guest checkout email validation
Aliases: CVE-2021-43805
Severity: HIGH
CWE: CWE-1333
Published: 2021-12-07T22:01:47Z

### Impact
Denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest order's email was subject to exponential backtracking through a fragment like `a.a.`.

Before the patch, it can be reproduced in the console like this:

```ruby
irb(main)> Spree::EmailValidator::EMAIL_REGEXP.match "a@a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.@"
processing time: 54.293660s
=> nil
```

To reproduce in the browser, fill in the "Customer Email" field with that fake email address during a guest checkout. Before that, you should open the browser dev tools and change the `type` attribute for that field from `email` to `text`. After entering a fake address and pressing the "Save & Continue" button, the browser will take a long term to perform the request before showing an error message for the invalid address. Eventually, making the email string even longer could lead to the exhaustion of server resources.


### Patches
Versions 3.1.4, 3.0.4, and 2.11.13 have been patched to use a different regular expression.

There's an improbable chance that some orders in your system end up having associated an email address that is no longer valid. We've added a task to check precisely that:

```bash
bin/rails solidus:check_orders_with_invalid_email
```

The above will print information for every affected order if any.

### Workarounds

If a prompt upgrade is not an option, please, add the following to `config/application.rb`:

```ruby
config.after_initialize do
  Spree::EmailValidator.send(:remove_const, :EMAIL_REGEXP)
  Spree::EmailValidator::EMAIL_REGEXP = URI::MailTo::EMAIL_REGEXP
end
```

### References

- https://en.wikipedia.org/wiki/ReDoS
- https://snyk.io/blog/redos-and-catastrophic-backtracking/

### For more information
If you have any questions or comments about this advisory:
* Open an [issue](https://github.com/solidusio/solidus/issues) or a [discussion](https://github.com/solidusio/solidus/discussions) in Solidus.
* Email us at [security@solidus.io](mailto:security@soliidus.io)
* Contact the core team on [Slack](http://slack.solidus.io/)
Vulnerability: GHSA-x27v-x225-gq8g
Summary: Server-Side Request Forgery in Recurly
Aliases: CVE-2017-0905
Severity: CRITICAL
CWE: CWE-918
Published: 2017-12-06T16:43:00Z

The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource#find" method that could result in compromise of API keys or other critical resources.
Vulnerability: GHSA-49pj-69vf-c689
Summary: Incorrect Default Permissions in netaddr
Aliases: CVE-2019-17383
Severity: CRITICAL
CWE: CWE-276
Published: 2019-10-14T21:43:19Z

The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.
Vulnerability: GHSA-2j9c-9vmv-7m39
Summary: Missing anchor in Rack-Cors allows malicious third party site to perform CORS request
Aliases: CVE-2017-11173
Severity: HIGH
Published: 2018-07-31T18:18:39Z

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.
Vulnerability: GHSA-rg32-m3hf-772v
Summary: Deserialization of Untrusted Data in Slanger
Aliases: CVE-2019-1010306
Severity: CRITICAL
CWE: CWE-502
Published: 2019-07-16T00:41:40Z

Slanger 0.6.0 is affected by Remote Code Execution (RCE). The impact is A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is Message handler & request validator. The attack vector is Remote unauthenticated. The fixed version is after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3.
Vulnerability: GHSA-pf8f-w267-mq2h
Summary: The rack-cors rubygem may allow directory traveral
Aliases: CVE-2019-18978
Severity: MODERATE
CWE: CWE-22
Published: 2019-11-15T20:26:59Z

An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
Vulnerability: GHSA-4p8f-mmfj-r45g
Summary: Cross-site scripting in fat_free_crm
Aliases: CVE-2018-20975
Severity: MODERATE
CWE: CWE-79
Published: 2019-08-21T16:15:04Z

Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.
Vulnerability: GHSA-48w2-rm65-62xx
Summary: Inconsistent Interpretation of HTTP Requests in puma
Aliases: CVE-2021-41136
Severity: LOW
CWE: CWE-444
Published: 2021-10-12T17:53:00Z

### Impact

Prior to `puma` version 5.5.0, using `puma` with a proxy which forwards LF characters as line endings could allow HTTP request smuggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client.

This behavior (forwarding LF characters as line endings) is very uncommon amongst proxy servers, so we have graded the impact here as "low". Puma is only aware of a single proxy server which has this behavior.

If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.

### Patches

This vulnerability was patched in Puma 5.5.1 and 4.3.9.

### Workarounds

This vulnerability only affects Puma installations without any proxy in front.

Use a proxy which does not forward LF characters as line endings.

Proxies which do not forward LF characters as line endings:

* Nginx
* Apache (>2.4.25)
* Haproxy
* Caddy
* Traefik

### Possible Breakage

If you are [dealing with legacy clients that want to send `LF` as a line ending](https://stackoverflow.com/questions/43574428/have-apache-accept-lf-vs-crlf-in-request-headers) in an HTTP header, this will cause those clients to receive a `400` error.

### References

* [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
Vulnerability: GHSA-35mm-cc6r-8fjp
Summary: Cross-site scripting in actionpack
Aliases: CVE-2020-8264
Severity: MODERATE
CWE: CWE-79
Published: 2021-04-07T20:58:47Z

In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
Vulnerability: GHSA-2hxv-mx8x-mcj9
Summary: Spina vulnerable to a cross-site request forgery (CSRF) vulnerability
Aliases: CVE-2015-4619
Severity: HIGH
CWE: CWE-352
Published: 2018-08-28T22:34:22Z

Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.
Vulnerability: GHSA-46j2-xjgp-jrfm
Summary: Information disclosure issue in Active Resource
Aliases: CVE-2020-8151
Severity: HIGH
CWE: CWE-863, CWE-200
Published: 2020-05-21T21:09:38Z

There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requests to access data in an unexpected way and possibly leak information.
Vulnerability: GHSA-pcm6-g2qp-9gw8
Summary: Cap-Strap gem for Ruby places credentials on the useradd command line
Aliases: CVE-2014-4992
Severity: HIGH
CWE: CWE-200
Published: 2018-03-16T01:13:46Z

lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive information by listing the process.
Vulnerability: GHSA-q27f-v3r6-9v77
Summary: Improper Certificate Validation in EM-HTTP-Request
Aliases: CVE-2020-13482
Severity: HIGH
CWE: CWE-295
Published: 2021-05-24T18:13:13Z

EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
Vulnerability: GHSA-wjx2-7hqq-8h7m
Summary: rails_admin ruby gem XSS vulnerability
Aliases: CVE-2020-36190
Severity: MODERATE
CWE: CWE-79
Published: 2021-01-14T19:17:16Z

RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms.
Vulnerability: GHSA-jc8m-cxhj-668x
Summary: Improper Restriction of Excessive Authentication Attempts in Sorcery
Aliases: CVE-2020-11052
Severity: HIGH
CWE: CWE-307
Published: 2020-05-07T21:16:46Z

### Impact
Brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will prevent a brute force attack for the defined lockout period, but once expired protection will not be re-enabled until a user or malicious actor logs in successfully. This does not affect users that do not use the built-in brute force protection submodule, nor users that use permanent account lockout.

### Patches
Patched as of version `0.15.0`.

### Workarounds
Currently no workarounds, other than monkey patching the authenticate method provided by Sorcery or upgrading to version `0.15.0`.
Vulnerability: GHSA-j838-vfpq-fmf2
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2013-1857
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a &#x3a; sequence.
Vulnerability: GHSA-9v3m-8fp8-mj99
Summary: Cross-Site Scripting in bootstrap
Aliases: CVE-2019-8331
Severity: MODERATE
CWE: CWE-79
Published: 2019-02-22T20:54:47Z

Versions of `bootstrap` prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The  `data-template` attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.


## Recommendation

For `bootstrap` 4.x upgrade to 4.3.1 or later.
For `bootstrap` 3.x upgrade to 3.4.1 or later.
Vulnerability: GHSA-67j6-xv27-w6ww
Summary: Moderate severity vulnerability that affects web-console
Aliases: CVE-2015-3224
Severity: MODERATE
CWE: CWE-284
Published: 2017-10-24T18:33:36Z

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
Vulnerability: GHSA-3vfw-7rcp-3xgm
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2011-3187
Severity: MODERATE
CWE: CWE-20
Published: 2017-10-24T18:33:38Z

The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
Vulnerability: GHSA-8gg6-3r63-25m8
Summary: High severity vulnerability that affects git-fastclone
Aliases: CVE-2015-8968
Severity: HIGH
CWE: CWE-77
Published: 2018-08-15T20:03:37Z

git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.
Vulnerability: GHSA-mqm2-cgpr-p4m6
Summary: Unintended read access in kramdown gem
Aliases: CVE-2020-14001
Severity: CRITICAL
CWE: CWE-862
Published: 2020-08-07T22:27:41Z

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.
Vulnerability: GHSA-4whc-pp4x-9pf3
Summary: Moderate severity vulnerability that affects jquery-rails and jquery-ujs
Aliases: CVE-2015-1840
Severity: MODERATE
CWE: CWE-200
Published: 2017-10-24T18:33:36Z

jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
Vulnerability: GHSA-6h88-qjpv-p32m
Summary: OpenSSL gem for Ruby using inadequate encryption strength
Aliases: CVE-2016-7798
Severity: HIGH
CWE: CWE-326
Published: 2017-10-24T18:33:35Z

The OpenSSL gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.
Vulnerability: GHSA-w749-p3v6-hccq
Summary: Possible code injection vulnerability in Rails / Active Storage
Aliases: CVE-2022-21831
Severity: HIGH
CWE: CWE-94
Published: 2022-03-08T21:25:54Z

The Active Storage module of Rails starting with version 5.2.0 are possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or arguments.  Additionally, a strict ImageMagick security policy will help mitigate this issue.
Vulnerability: GHSA-gr44-7grc-37vq
Summary: Moderate severity vulnerability that affects activerecord
Aliases: CVE-2013-0276
Severity: MODERATE
Published: 2017-10-24T18:33:37Z

ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.
Vulnerability: GHSA-h6rj-8r3c-9gpj
Summary: bson is vulnerable to denial of service due to incorrect regex validation
Aliases: CVE-2015-4412
Severity: CRITICAL
CWE: CWE-400
Published: 2018-03-05T19:43:21Z

BSON injection vulnerability in the legal function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service (resource consumption) or inject arbitrary data via a crafted string.
Vulnerability: GHSA-8xfw-5q82-3652
Summary: Authentication Bypass by CSRF Weakness
Severity: CRITICAL
CWE: CWE-352
Published: 2021-11-18T20:15:23Z

### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.1 users should update to spree_auth_devise 4.1.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
Vulnerability: GHSA-h8hx-2c5r-32cf
Summary: Cross-Site Request Forgery (CSRF) in trestle-auth
Aliases: CVE-2021-29435
Severity: HIGH
CWE: CWE-352
Published: 2021-04-13T17:01:50Z

### Impact
A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials.

### Patches
The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [trestle-auth](https://github.com/TrestleAdmin/trestle-auth/issues)
* Email the maintainer at [sam@sampohlenz.com](mailto:sam@sampohlenz.com)
Vulnerability: GHSA-86g5-2wh3-gc9j
Summary: Critical severity vulnerability that affects actionview
Aliases: CVE-2019-5418
Severity: HIGH
CWE: CWE-22
Published: 2019-03-13T17:26:59Z

# File Content Disclosure in Action View

Impact 
------ 
There is a possible file content disclosure vulnerability in Action View. 
Specially crafted accept headers in combination with calls to `render file:` 
can cause arbitrary files on the target server to be rendered, disclosing the 
file contents. 

The impact is limited to calls to `render` which render file contents without 
a specified accept format.  Impacted code in a controller looks something like 
this: 

``` 
class UserController < ApplicationController 
  def index 
    render file: "#{Rails.root}/some/file" 
  end 
end 
``` 

Rendering templates as opposed to files is not impacted by this vulnerability. 

All users running an affected release should either upgrade or use one of the 
workarounds immediately. 

Releases 
-------- 
The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are 
available at the normal locations. 

Workarounds 
----------- 
This vulnerability can be mitigated by specifying a format for file rendering, 
like this: 

``` 
class UserController < ApplicationController 
  def index 
    render file: "#{Rails.root}/some/file", formats: [:html] 
  end 
end 
``` 

In summary, impacted calls to `render` look like this: 

``` 
render file: "#{Rails.root}/some/file" 
``` 

The vulnerability can be mitigated by changing to this: 

``` 
render file: "#{Rails.root}/some/file", formats: [:html] 
``` 

Other calls to `render` are not impacted. 

Alternatively, the following monkey patch can be applied in an initializer: 

``` 
$ cat config/initializers/formats_filter.rb 
# frozen_string_literal: true 

ActionDispatch::Request.prepend(Module.new do 
  def formats 
    super().select do |format| 
      format.symbol || format.ref == "*/*" 
    end 
  end 
end) 
``` 

Credits 
------- 
Thanks to John Hawthorn <john@hawthorn.email> of GitHub
Vulnerability: GHSA-w542-cpp9-r3g7
Summary: CSRF in Field Test
Aliases: CVE-2020-16252
Severity: MODERATE
CWE: CWE-352
Published: 2020-08-05T14:53:34Z

The Field Test dashboard is vulnerable to cross-site request forgery (CSRF) with non-session based authentication methods in versions v0.2.0 through v0.3.2.

## Impact
The Field Test dashboard is vulnerable to CSRF with non-session based authentication methods, like basic authentication. Session-based authentication methods (like Devise's default authentication) are not affected.

A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, a single endpoint is affected, which allows for changing the variant assigned to a user.

All users running an affected release should upgrade immediately.

## Technical Details
Field Test uses the `protect_from_forgery` method from Rails to prevent CSRF. However, this defaults to `:null_session`, which has no effect on non-session based authentication methods. This has been changed to `protect_from_forgery with: :exception`.
Vulnerability: GHSA-4vf4-qmvg-mh7h
Summary: Cookie prefix spoofing in CGI
Aliases: CVE-2021-41819
Severity: HIGH
CWE: CWE-565
Published: 2022-01-21T23:22:17Z

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
Vulnerability: GHSA-hwhf-64mh-r662
Summary: ReDoS vulnerability in parser_apache2
Aliases: CVE-2021-41186
Severity: MODERATE
CWE: CWE-400
Published: 2021-11-01T19:16:31Z

### Impact
parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack.

### Patches
v1.14.2

### Workarounds
Either of the following:

* Don't use parser_apache2 for parsing logs which cannot guarantee generated by Apache.
* Put patched version of parser_apache2.rb into /etc/fluent/plugin  directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).

### References
* [CVE-2021-41186](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41186)
* [GHSA-hwhf-64mh-r662](https://github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662)
* [GHSL-2021-102](https://securitylab.github.com/advisories/GHSL-2021-102-fluent-fluentd/)
* https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#v1142
Vulnerability: GHSA-6x85-j5j2-27jx
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2014-0130
Severity: MODERATE
CWE: CWE-22
Published: 2017-10-24T18:33:36Z

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
Vulnerability: GHSA-wpw7-wxjm-cw8r
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2013-6417
Severity: MODERATE
Published: 2017-10-24T18:33:36Z

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
Vulnerability: GHSA-6wpv-cj6x-v3jw
Summary: Moderate severity vulnerability that affects http
Aliases: CVE-2015-1828
Severity: MODERATE
CWE: CWE-200
Published: 2018-03-13T16:15:57Z

The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
Vulnerability: GHSA-p4c6-77gc-694x
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2007-6077
Severity: MODERATE
CWE: CWE-362
Published: 2017-10-24T18:33:38Z

The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks.  NOTE: this is due to an incomplete fix for CVE-2007-5380.
Vulnerability: GHSA-3pxh-h8hw-mj8w
Summary: Moderate severity vulnerability that affects rack
Aliases: CVE-2013-0183
Severity: MODERATE
CWE: CWE-119
Published: 2017-10-24T18:33:37Z

multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.
Vulnerability: GHSA-m42h-mh85-4qgc
Summary: Moderate severity vulnerability that affects railties
Aliases: CVE-2019-5420
Severity: CRITICAL
CWE: CWE-330, CWE-77
Published: 2019-03-13T17:28:35Z

# Possible Remote Code Execution Exploit in Rails Development Mode

Impact 
------ 
With some knowledge of a target application it is possible for an attacker to 
guess the automatically generated development mode secret token.  This secret 
token can be used in combination with other Rails internals to escalate to a 
remote code execution exploit. 

All users running an affected release should either upgrade or use one of the 
workarounds immediately. 

Releases 
-------- 
The 6.0.0.beta3 and 5.2.2.1 releases are available at the normal locations. 

Workarounds 
----------- 
This issue can be mitigated by specifying a secret key in development mode. 
In "config/environments/development.rb" add this: 

```
  config.secret_key_base = SecureRandom.hex(64) 
```

Please note that only the 5.2.x, 5.1.x, 5.0.x, and 4.2.x series are supported 
at present. Users of earlier unsupported releases are advised to upgrade as 
soon as possible as we cannot guarantee the continued availability of security 
fixes for unsupported releases. 

Credits 
------- 
Thanks to ooooooo_q
Vulnerability: GHSA-vqcq-mrmw-mcmg
Summary: Rubyzip gem contains a Directory Traversal vulnerability in zip file component
Aliases: CVE-2018-1000544
Severity: CRITICAL
CWE: CWE-59, CWE-434
Published: 2018-09-06T03:27:18Z

rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem..

This is similar to CVE-2017-5946 which was patched in 1.2.1 but the fix in that case was incomplete.
Vulnerability: GHSA-q759-hwvc-m3jg
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2013-1855
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.
Vulnerability: GHSA-cm9w-c4rj-r2cf
Summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component
Aliases: CVE-2022-24722
Severity: HIGH
CWE: CWE-79
Published: 2022-03-02T22:24:05Z

This is an XSS vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display.

Versions 2.29.1 and 2.49.1 have been released and fully mitigate the vulnerability.

Avoid passing user input to the `translate` function, or sanitize the inputs before passing them.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [github/view_component](http://github.com/github/view_component) project
Vulnerability: GHSA-78rc-8c29-p45g
Summary: High severity vulnerability that affects actionpack
Aliases: CVE-2016-2098
Severity: HIGH
CWE: CWE-20
Published: 2017-10-24T18:33:35Z

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
Vulnerability: GHSA-p673-hjf2-pwfr
Summary: High severity vulnerability that affects command_wrap
Aliases: CVE-2013-1875
Severity: HIGH
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

command_wrap.rb in the command_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename.
Vulnerability: GHSA-5cqm-crxm-6qpv
Summary: Buffer overrun vulnerability in CGI
Aliases: CVE-2021-41816
Severity: CRITICAL
CWE: CWE-190
Published: 2021-12-14T21:36:20Z

A security vulnerability that causes buffer overflow when you pass a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows. Please update the cgi gem to version 0.3.1, 0.2,1, and 0.1,1 or later. You can use gem update cgi to update it. If you are using bundler, please add gem "cgi", ">= 0.3.1" to your Gemfile.  Alternatively, please update Ruby to 2.7.5 or 3.0.3. This issue has been introduced since Ruby 2.7, so the cgi version bundled with Ruby 2.6 is not vulnerable.
Vulnerability: GHSA-7359-3c6r-hfc2
Summary: Improper Certificate Validation in oauth ruby gem
Aliases: CVE-2016-11086
Severity: HIGH
CWE: CWE-295
Published: 2021-04-22T16:22:15Z

lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.
Vulnerability: GHSA-2p5p-m353-833w
Summary: Sort order SQL injection in Administrate
Aliases: CVE-2020-5257
Severity: HIGH
CWE: CWE-943
Published: 2020-03-13T21:05:44Z

In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard,
the direction parameter was not validated before being interpolated into the SQL query.
This could present a SQL injection if the attacker were able to modify the `direction` parameter and bypass ActiveRecord SQL protections.

Whilst this does have a high-impact, to exploit this you need access to the Administrate dashboards, which we would expect to be behind authentication.

This is patched in wersion 0.13.0.
Vulnerability: GHSA-gqvf-892r-vjm5
Summary: Improper Certificate Validation in Puppet
Aliases: CVE-2020-7942
Severity: MODERATE
CWE: CWE-295
Published: 2021-04-13T15:42:19Z

Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior.