TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-g8ww-46x2-2p65
Summary: Denial of Service in Action Dispatch
Aliases: CVE-2021-22902
Severity: HIGH
CWE: CWE-400
Published: 2021-05-05T19:48:21Z

Impact
------
There is a possible Denial of Service vulnerability in Action Dispatch.
Carefully crafted Accept headers can cause the mime type parser in Action
Dispatch to do catastrophic backtracking in the regular expression engine.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
The following monkey patch placed in an initializer can be used to work around
the issue.

```ruby
module Mime
  class Type
    MIME_REGEXP = /\A(?:\*\/\*|#{MIME_NAME}\/(?:\*|#{MIME_NAME})(?>\s*#{MIME_PARAMETER}\s*)*)\z/
  end
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 6-0-Prevent-catastrophic-backtracking-during-mime-parsin.patch - Patch for 6.0 series
* 6-1-Prevent-catastrophic-backtracking-during-mime-parsin.patch - Patch for 6.1 series

Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at
present. Users of earlier unsupported releases are advised to upgrade as soon
as possible as we cannot guarantee the continued availability of security
fixes for unsupported releases.

Credits
-------

Thanks to Security Curious <security...@pm.me> for reporting this!
Vulnerability: GHSA-f93j-hmcr-jcwh
Summary: Data Injection Vulnerability in moped Rubygem
Aliases: CVE-2015-4410
Severity: HIGH
CWE: CWE-20
Published: 2020-08-19T16:45:49Z

The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.
Vulnerability: GHSA-7fqj-cg79-f2pv
Summary: High severity vulnerability that affects thumbshooter
Aliases: CVE-2013-1898
Severity: HIGH
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Vulnerability: GHSA-r9c2-cr39-c8g6
Summary: Moderate severity vulnerability that affects rails-html-sanitizer
Aliases: CVE-2015-7579
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.
Vulnerability: GHSA-jg4m-q6w8-vrjp
Summary: High severity vulnerability that affects rgpg
Aliases: CVE-2013-4203
Severity: HIGH
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

The self.run_gpg function in lib/rgpg/gpg_helper.rb in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
Vulnerability: GHSA-73rf-6mrf-759q
Summary: Moderate severity vulnerability that affects devise
Aliases: CVE-2019-5421
Severity: MODERATE
CWE: CWE-367
Published: 2019-03-19T18:03:25Z

Devise ruby gem before 4.6.0 when the `lockable` module is used is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to `increment_failed_attempts` within the `Devise::Models::Lockable` class not being concurrency safe.
Vulnerability: GHSA-f2c9-5jqw-3xh3
Summary: Cross-Site Scripting in Qiita::Markdown
Aliases: CVE-2021-28796
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-02T17:23:39Z

Increments Qiita::Markdown before 0.33.0 allows XSS in transformers.
Vulnerability: GHSA-wmjf-jpjj-9f3j
Summary: Low severity vulnerability that affects rubocop
Aliases: CVE-2017-8418
Severity: LOW
CWE: CWE-668
Published: 2017-11-15T20:39:47Z

RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other users.
Vulnerability: GHSA-69p6-wvmq-27gg
Summary: Command injection in ruby-git
Aliases: CVE-2022-25648
Severity: CRITICAL
CWE: CWE-88
Published: 2022-04-20T00:00:33Z

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Vulnerability: GHSA-694m-jhr9-pf77
Summary: High severity vulnerability that affects doorkeeper
Aliases: CVE-2018-1000211
Severity: HIGH
CWE: CWE-732
Published: 2018-08-13T20:46:41Z

Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.
Vulnerability: GHSA-h5g2-38x9-4gv3
Summary: High severity vulnerability that affects archive-tar-minitar and minitar
Aliases: CVE-2016-10173
Severity: HIGH
CWE: CWE-22
Published: 2017-10-24T18:33:35Z

Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.
Vulnerability: GHSA-v222-6mr4-qj29
Summary: Command Injection vulnerability in asciidoctor-include-ext
Aliases: CVE-2022-24803
Severity: CRITICAL
CWE: CWE-78
Published: 2022-03-31T23:27:15Z

### Impact

Applications using [Asciidoctor (Ruby)](https://github.com/asciidoctor/asciidoctor) with [asciidoctor-include-ext](https://github.com/jirutka/asciidoctor-include-ext) (prior to version 0.4.0), which render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. ~~This attack is possible even when `allow-uri-read` is disabled!~~ (EDIT: it’s not)


### Patches

The vulnerability has been fixed in commit c7ea001 (and further improved in cbaccf3), which is included in version [0.4.0](https://rubygems.org/gems/asciidoctor-include-ext/versions/0.4.0).

### Workarounds

```rb
require 'asciidoctor/include_ext'

class Asciidoctor::IncludeExt::IncludeProcessor
  # Overrides superclass private method to mitigate Command Injection
  # vulnerability in asciidoctor-include-ext <0.4.0.
  def target_uri?(target)
    target.downcase.start_with?('http://', 'https://') \
      && URI.parse(target).is_a?(URI::HTTP)
  rescue URI::InvalidURIError
    false
  end
end
```

### References

* https://sakurity.com/blog/2015/02/28/openuri.html

### Credits

This vulnerability was discovered by Joern Schneeweisz from the GitLab Security Research Team.


### For more information

See commit message c7ea001.

If you have any questions or comments about this advisory open an issue in [jirutka/asciidoctor-include-ext](https://github.com/jirutka/asciidoctor-include-ext/issues/).
Vulnerability: GHSA-vvff-6wrr-4g7q
Summary: Missing Authentication for Critical Function in Foreman Ansible
Aliases: CVE-2021-3589
Severity: CRITICAL
CWE: CWE-306
Published: 2022-03-24T00:00:17Z

An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Vulnerability: GHSA-85rf-xh54-whp3
Summary: Malicious URL drafting attack against iodines static file server may allow path traversal
Severity: LOW
CWE: CWE-22
Published: 2019-10-07T16:52:13Z

### Impact

A path traversal vulnerability was detected in iodine's static file service. This vulnerability effects any application running iodine's static file server on an effected iodine version.

Malicious URL drafting may cause the static file server to attempt a response containing data from files that shouldn't be normally accessible from the public folder.

### Patches

The vulnerability was patched in version 0.7.34. Please upgrade to the latest version.

### Workarounds

A possible workaround would be to disable the static file service and it's `X-Sendfile` support, sending static files using nginx or a source code solution (sending the data dynamically).

However, it would be better to upgrade iodine to the latest version, as it also contains non-security related fixes.

### For more information
If you have any questions or comments about this advisory:
* Email [Boaz Segev](https://github.com/boazsegev)
Vulnerability: GHSA-g45g-g52h-39rg
Summary: Cross-site Scripting in Chartkick
Aliases: CVE-2019-12732
Severity: MODERATE
CWE: CWE-79
Published: 2019-06-07T20:56:42Z

The Chartkick gem through 3.1.0 for Ruby allows XSS.
Vulnerability: GHSA-8hc4-xxm3-5ppp
Summary: Regular Expression Denial-of-Service
Aliases: CVE-2021-22880
Severity: HIGH
CWE: CWE-400
Published: 2021-03-02T03:44:14Z

The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
Vulnerability: GHSA-65cv-r6x7-79hv
Summary: Possible XSS vulnerability in ActionView
Aliases: CVE-2020-5267
Severity: MODERATE
CWE: CWE-80
Published: 2020-03-19T17:30:29Z

There is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers.  Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks.

### Impact

There is a possible XSS vulnerability in the `j` and `escape_javascript` methods in ActionView.  These methods are used for escaping JavaScript string literals.  Impacted code will look something like this:

```erb
<script>let a = `<%= j unknown_input %>`</script>
```

or

```erb
<script>let a = `<%= escape_javascript unknown_input %>`</script>
```

### Releases

The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.

### Workarounds

For those that can't upgrade, the following monkey patch may be used:

```ruby
ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
  {
    "`" => "\\`",
    "$" => "\\$"
  }
)

module ActionView::Helpers::JavaScriptHelper
  alias :old_ej :escape_javascript
  alias :old_j :j

  def escape_javascript(javascript)
    javascript = javascript.to_s
    if javascript.empty?
      result = ""
    else
      result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)
    end
    javascript.html_safe? ? result.html_safe : result
  end

  alias :j :escape_javascript
end
```

### Patches

To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* [5-2-js-helper-xss.patch](https://gist.github.com/tenderlove/c042ff49f0347c37e99183a6502accc6#file-5-2-js-helper-xss-patch) - Patch for 5.2 series
* [6-0-js-helper-xss.patch](https://gist.github.com/tenderlove/c042ff49f0347c37e99183a6502accc6#file-6-0-js-helper-xss-patch) - Patch for 6.0 series

Please note that only the 5.2 and 6.0 series are supported at present. Users
of earlier unsupported releases are advised to upgrade as soon as possible as we
cannot guarantee the continued availability of security fixes for unsupported
releases.

### Credits

Thanks to Jesse Campos from Chef Secure
Vulnerability: GHSA-v2r9-c84j-v7xm
Summary: Moderate severity vulnerability that affects rdoc
Aliases: CVE-2013-0256
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
Vulnerability: GHSA-3mvg-rrrw-m7ph
Summary: Ability to change order address without triggering address validations in solidus
Aliases: CVE-2020-15109
Severity: MODERATE
CWE: CWE-20, CWE-862
Published: 2020-08-04T22:17:57Z

### Impact

This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment.

All stores with at least two shipping zones and different costs of shipment per zone are impacted. 

E.g.
1. Store admin configured the store so that there are two zones in US:
-  East Cost Zone - Shipping Method cost: $1
- West Cost Zone - Shipping Method cost: $10

The attacker user can know that shipping to NY is less expensive than to LA just by testing different addresses in checkout.

2. The attacker user enters any NY shipping address in the address step
3. The attacker user chooses the $1 delivery option
4. The attacker user crafts a request with their real LA address, similar to:

```
// POST #checkout/update:

{
  state: 'payment',
  order: {
    ship_address_attributes: {
      city: 'Los Angeles',
      ...
    }
  }
}
```
5. The attacker user proceeds with checking out with a new address and the $1 shipment costs.

Another scenario where this could be dangerous is:

> You cannot ship products in some zones and you are relying on Solidus Shipping Method building only to filter out unwanted zones. Malicious users can enter an allowed zone's address and change back to an unwanted one in the payment step by crafting a request with some proper ship_address_attributes.

This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted.

### Patches

A PR has been attached to fix the security concern for each of all the Solidus supported versions following the rules of the [Solidus Security Policy](https://solidus.io/security).

### Workarounds

When it's not possible to upgrade to a supported patched version, please use this gist to patch the store:

https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d
Vulnerability: GHSA-92v7-pq4h-58j5
Summary: Moderate severity vulnerability that affects facter, hiera, mcollective-client, and puppet
Aliases: CVE-2014-3248
Severity: MODERATE
Published: 2017-10-24T18:33:36Z

Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.
Vulnerability: GHSA-x2fr-v8wf-8wwv
Summary: High severity vulnerability that affects ruby-saml
Aliases: CVE-2017-11428
Severity: HIGH
CWE: CWE-287
Published: 2019-07-05T21:11:35Z

OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Vulnerability: GHSA-9c2j-593q-3g82
Summary: Moderate severity vulnerability that affects activesupport
Aliases: CVE-2013-1856
Severity: MODERATE
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.
Vulnerability: GHSA-4jm3-pfpf-h54p
Summary: espeak-ruby allows arbitrary command execution
Aliases: CVE-2016-10193
Severity: CRITICAL
CWE: CWE-284
Published: 2017-10-24T18:33:35Z

The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or bytes_wav method in lib/espeak/speech.rb.
Vulnerability: GHSA-9rf5-jm6f-2fmm
Summary: High severity vulnerability that affects activerecord
Aliases: CVE-2014-3514
Severity: HIGH
Published: 2017-10-24T18:33:36Z

activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
Vulnerability: GHSA-6qvp-r6r3-9p7h
Summary: Moderate severity vulnerability that affects nokogiri
Aliases: CVE-2018-14404
Severity: HIGH
CWE: CWE-476
Published: 2019-01-17T14:05:03Z

A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
Vulnerability: GHSA-wwmf-6p58-6vj2
Summary: High severity vulnerability that affects rwiki
Aliases: CVE-2006-2582
Severity: HIGH
Published: 2017-10-24T18:33:38Z

The editing form in RWiki 2.1.0pre1 through 2.1.0 allows remote attackers to execute arbitrary Ruby code via unknown attack vectors.
Vulnerability: GHSA-ffpv-c4hm-3x6v
Summary: actionpack is vulnerable to denial of service via a crafted HTTP Accept header
Aliases: CVE-2016-0751
Severity: HIGH
Published: 2017-10-24T18:33:35Z

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
Vulnerability: GHSA-c5r5-7pfh-6qg6
Summary: OS command injection in BibTeX-Ruby
Aliases: CVE-2019-10780
Severity: CRITICAL
CWE: CWE-78
Published: 2020-02-14T23:10:01Z

BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open.
Vulnerability: GHSA-h835-75hw-pj89
Summary: Moderate severity vulnerability that affects activesupport
Aliases: CVE-2012-3464
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.
Vulnerability: GHSA-7xx3-m584-x994
Summary: A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack
Aliases: CVE-2019-16770
Severity: MODERATE
CWE: CWE-770
Published: 2019-12-05T19:26:37Z

## Keepalive thread overload/DoS

### Impact

A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack.

If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.

### Patches

This vulnerability is patched in Puma 4.3.1 and 3.12.2.

### Workarounds

Reverse proxies in front of Puma could be configured to always allow less than X keepalive connections to a Puma cluster or process, where X is the number of threads configured in Puma's thread pool.

### For more information

If you have any questions or comments about this advisory:

* Open an issue at [puma](github.com/puma/puma).
Vulnerability: GHSA-qg54-694p-wgpp
Summary: Regular expression denial of service vulnerability (ReDoS) in date
Aliases: CVE-2021-41817
Severity: MODERATE
CWE: CWE-1333
Published: 2021-11-16T00:32:30Z

Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular expression denial of service. Applications and libraries that apply such methods to untrusted input may be affected.

The fix limits the input length up to 128 bytes by default instead of changing the regexps. This is because Date gem uses many Regexps and it is possible that there are still undiscovered vulnerable Regexps. For compatibility, it is allowed to remove the limitation by explicitly passing limit keywords as nil like Date.parse(str, limit: nil), but note that it may take a long time to parse.

Please update the date gem to version 3.2.1, 3.1.2, 3.0.2, and 2.0.1, or later. You can use gem update date to update it. If you are using bundler, please add gem "date", ">= 3.2.1" to your Gemfile. If you import `date` from the standard library rather than as a gem you should update your Ruby install to `3.0.3`, `2.7.5`, `2.6.9` or later.

Users unable to upgrade may consider using `Date.strptime` instead with a predefined date format
```ruby
Date.strptime('2001-02-20', '%Y-%m-%d')
```
Vulnerability: GHSA-xxr8-833v-c7wc
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2011-4319
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring.
Vulnerability: GHSA-m3q7-rj8g-m457
Summary: Moderate severity vulnerability that affects ember-source
Aliases: CVE-2015-7565
Severity: MODERATE
CWE: CWE-79
Published: 2018-08-28T22:33:24Z

Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.
Vulnerability: GHSA-mx9f-w8qq-q5jf
Summary: Low severity vulnerability that affects rest-client
Aliases: CVE-2015-3448
Severity: LOW
CWE: CWE-200
Published: 2017-10-24T18:33:36Z

REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log.
Vulnerability: GHSA-xm34-v85h-9pg2
Summary: Authentication Bypass by CSRF Weakness
Aliases: CVE-2021-41274
Severity: CRITICAL
CWE: CWE-352
Published: 2021-11-18T20:09:32Z

### Impact
CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of  `solidus_auth_devise` are affected if `protect_from_forgery` method is both: 
- Executed whether as:
  - A `before_action` callback (the default)
  - A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find).
- Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

### Patches
Users should promptly update to `solidus_auth_devise` version `2.5.4`.

### Workarounds
A couple of options:

- If possible, change your strategy to `:exception`:
  ```ruby
  class ApplicationController < ActionController::Base
    protect_from_forgery with: :exception
  end
  ```

- Add the following to `config/application.rb` to at least run the `:exception` strategy on the affected controller:
  ```ruby
  config.after_initialize do
    Spree::UsersController.protect_from_forgery with: :exception
  end
  ```

- We've also released new Solidus versions monkey patching `solidus_auth_devise` with the quick fix. Those versions are `v3.1.3`, `v.3.0.3` & `v2.11.12`. See [GHSA-5629-8855-gf4g](https://github.com/solidusio/solidus/security/advisories/GHSA-5629-8855-gf4g) for details.

### References
- [CSRF on the Rails guides](https://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf)
- [Solidus security](https://solidus.io/security/)

### Thanks
We'd like to thank [vampire000](https://hackerone.com/vampire000) for reporting this issue.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [solidus_auth_devise](https://github.com/solidusio/solidus_auth_devise/issues) or a discussion in [solidus](https://github.com/solidusio/solidus/discussions)
* Email us at [security@solidus.io](mailto:security@soliidus.io)
* Contact the core team on [Slack](http://slack.solidus.io/)
Vulnerability: GHSA-4c4w-3q45-hp9j
Summary: Aescrypt does not sufficiently use random values
Aliases: CVE-2013-7463
Severity: HIGH
CWE: CWE-330
Published: 2017-10-24T18:33:36Z

The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack.
Vulnerability: GHSA-6c8p-qphv-668v
Summary: Moderate severity vulnerability that affects ruby-openid
Aliases: CVE-2013-1812
Severity: MODERATE
Published: 2017-10-24T18:33:37Z

The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.
Vulnerability: GHSA-q2qw-rmrh-vv42
Summary: Moderate severity vulnerability that affects activejob
Aliases: CVE-2018-16476
Severity: HIGH
CWE: CWE-284, CWE-502
Published: 2018-12-05T17:24:27Z

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have.
Vulnerability: GHSA-78j3-7wpm-qhvp
Summary: Critical severity vulnerability that affects kelredd-pruview
Aliases: CVE-2013-1947
Severity: CRITICAL
CWE: CWE-78
Published: 2017-10-24T18:33:37Z

kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.
Vulnerability: GHSA-8cr8-4vfw-mr7h
Summary: Round-trip instability in REXML
Aliases: CVE-2021-28965
Severity: HIGH
CWE: CWE-115, CWE-611
Published: 2021-04-30T17:30:37Z

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
Vulnerability: GHSA-w7q9-xr2x-wh7x
Summary: Moderate severity vulnerability that affects delayed_job_web
Aliases: CVE-2017-12097
Severity: MODERATE
CWE: CWE-79
Published: 2018-03-05T19:06:00Z

An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.
Vulnerability: GHSA-g982-9r8g-6qxw
Summary: Ciborg gem for Ruby allows local users to write files and gain privileges via Symlink
Aliases: CVE-2014-5003
Severity: MODERATE
CWE: CWE-20
Published: 2018-07-23T19:50:15Z

chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary files and gain privileges via a symlink attack on /tmp/perlbrew-installer.
Vulnerability: GHSA-7553-jr98-vx47
Summary: libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation
Aliases: CVE-2020-7595
Severity: HIGH
CWE: CWE-835
Published: 2020-02-24T19:12:36Z

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
The Nokogiri RubyGem has patched its vendored copy of libxml2 in order to prevent this issue from affecting nokogiri.
Vulnerability: GHSA-vmfh-c547-v45h
Summary: Remote code execution in ruby-jss
Aliases: CVE-2021-33575
Severity: CRITICAL
Published: 2021-10-06T17:48:27Z

The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing.
Vulnerability: GHSA-5jjv-x4fq-qjwp
Summary: Possible timing attack in derivation_endpoint
Aliases: CVE-2020-15237
Severity: MODERATE
CWE: CWE-208, CWE-203
Published: 2020-10-05T15:48:34Z

### Impact

When using the `derivation_endpoint` plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL.

### Patches

The problem has been fixed by comparing sent and calculated signature in constant time, using `Rack::Utils.secure_compare`. Users using the `derivation_endpoint` plugin are urged to upgrade to Shrine 3.3.0 or greater.

### Workarounds

Users of older Shrine versions can apply the following monkey-patch after loading the `derivation_endpoint` plugin:

```rb
class Shrine
  class UrlSigner
    def verify_signature(string, signature)
      if signature.nil?
        fail InvalidSignature, "missing \"signature\" param"
      elsif !Rack::Utils.secure_compare(signature, generate_signature(string))
        fail InvalidSignature, "provided signature does not match the calculated signature"
      end
    end
  end
end
```

### References

You can read more about timing attacks [here](https://en.wikipedia.org/wiki/Timing_attack).
Vulnerability: GHSA-72rj-36qc-47g7
Summary: Information Disclosure
Aliases: CVE-2021-31671
Severity: HIGH
CWE: CWE-319
Published: 2021-04-27T15:54:52Z

pgsync before 0.6.7 is affected by Information Disclosure of sensitive information. Syncing the schema with the --schema-first and --schema-only options is mishandled. For example, the sslmode connection parameter may be lost, which means that SSL would not be used.
Vulnerability: GHSA-q4g7-jrxv-67r9
Summary: Silent Configuration Failure in Puppet Agent
Aliases: CVE-2021-27025
Severity: MODERATE
Published: 2021-12-02T17:54:25Z

A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.
Vulnerability: GHSA-gx5g-xcxj-cx2w
Summary: Critical severity vulnerability that affects smart_proxy_dynflow
Aliases: CVE-2018-14643
Severity: CRITICAL
CWE: CWE-287
Published: 2018-10-08T23:18:13Z

An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.
Vulnerability: GHSA-f7f4-5w9j-23p2
Summary: festivaltts4r allows arbitrary command execution
Aliases: CVE-2016-10194
Severity: CRITICAL
CWE: CWE-77
Published: 2017-10-24T18:33:35Z

The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to_speech or (2) to_mp3 method in lib/festivaltts4r/festival4r.rb.
Vulnerability: GHSA-7mvr-5x2g-wfc8
Summary: Moderate severity vulnerability that affects bootstrap
Aliases: CVE-2018-14042
Severity: MODERATE
CWE: CWE-79
Published: 2018-09-13T15:50:32Z

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.  This is similar to CVE-2018-14041.
Vulnerability: GHSA-3h4r-pjv6-cph9
Summary: Escape sequence injection in RubyGems
Aliases: CVE-2019-8323
Severity: HIGH
CWE: CWE-74
Published: 2019-06-20T16:05:57Z

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.
Vulnerability: GHSA-543v-gj2c-r3ch
Summary: Moderate severity vulnerability that affects activemodel
Aliases: CVE-2016-0753
Severity: MODERATE
CWE: CWE-20
Published: 2017-10-24T18:33:35Z

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.
Vulnerability: GHSA-33vf-4xgg-9r58
Summary: HTTP Response Splitting (Early Hints) in Puma
Aliases: CVE-2020-5249
Severity: MODERATE
CWE: CWE-113
Published: 2020-03-03T23:33:16Z

### Impact
If an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as [HTTP Response Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)

While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS).

This is related to [CVE-2020-5247](https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v), which fixed this vulnerability but only for regular responses.

### Patches
This has been fixed in 4.3.3 and 3.12.4.

### Workarounds
Users can not allow untrusted/user input in the Early Hints response header.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [puma](https://github.com/puma/puma)
* Email us a project maintainer. [Email addresses are listed in our Code of Conduct](https://github.com/puma/puma/blob/master/CODE_OF_CONDUCT.md#enforcement).
Vulnerability: GHSA-p463-639r-q9g9
Summary: High severity vulnerability that affects dragonfly
Aliases: CVE-2013-1756
Severity: HIGH
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
Vulnerability: GHSA-rqp5-pg7w-832p
Summary: Code Injection in datagrid
Aliases: CVE-2019-14281
Severity: CRITICAL
CWE: CWE-94
Published: 2019-07-31T04:21:27Z

The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Vulnerability: GHSA-cr3x-7m39-c6jq
Summary: Potential remote code execution of user-provided local names in ActionView
Aliases: CVE-2020-8163
Severity: MODERATE
CWE: CWE-94
Published: 2020-07-07T16:34:27Z

The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
Vulnerability: GHSA-grh7-935j-hg6w
Summary: Cross-site Scripting in Sidekiq
Aliases: CVE-2021-30151
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-06T17:47:17Z

Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.
Vulnerability: GHSA-2p82-v77v-mppr
Summary: Airbrake
Aliases: CVE-2019-16060
Severity: CRITICAL
CWE: CWE-200
Published: 2019-09-11T23:05:57Z

The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 (also, 4.2.2 and earlier are unaffected).
Vulnerability: GHSA-fp4w-jxhp-m23p
Summary: Dependency Confusion in Bundler
Aliases: CVE-2020-36327
Severity: HIGH
Published: 2021-05-24T18:12:33Z

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.17 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application.
Vulnerability: GHSA-574q-fxfj-wv6h
Summary: High severity vulnerability that affects puppet
Aliases: CVE-2013-1655
Severity: HIGH
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
Vulnerability: GHSA-gx8x-g87m-h5q6
Summary: Denial of Service (DoS) in Nokogiri on JRuby
Severity: HIGH
CWE: CWE-400
Published: 2022-04-11T21:38:11Z

## Summary

Nokogiri `v1.13.4` updates the vendored `org.cyberneko.html` library to `1.9.22.noko2` which addresses [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv). That CVE is rated 7.5 (High Severity).

See [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) for more information.

Please note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.


## Mitigation

Upgrade to Nokogiri `>= 1.13.4`.


## Impact

### [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) in nekohtml

- **Severity**: High 7.5
- **Type**: [CWE-400](https://cwe.mitre.org/data/definitions/400.html) Uncontrolled Resource Consumption
- **Description**: The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup.
- **See also**: [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv)
Vulnerability: GHSA-rmj8-8hhh-gv5h
Summary: Information Exposure when using Puma with Rails
Aliases: CVE-2022-23634
Severity: HIGH
CWE: CWE-200
Published: 2022-02-11T21:33:23Z

### Impact
Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly.

From Rails:

> Under certain circumstances response bodies will not be closed, for example a bug in a webserver[1] or a bug in a Rack middleware. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with ActiveSupport::CurrentAttributes.

The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage.

### Patches
This problem is fixed in Puma versions 5.6.2 and 4.3.11.

This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

See: 
https://github.com/advisories/GHSA-wh98-p28r-vrc9 
for details about the rails vulnerability

Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.

### Workarounds

Upgrade to Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

The [Rails CVE](https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email&utm_source=footer&pli=1) includes a middleware that can be used instead.

### References

* Rails CVE: [CVE-2022-23633](https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email&utm_source=footer&pli=1)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
Vulnerability: GHSA-8jhx-9gf4-hhf5
Summary: Improper Access Control in consul
Aliases: CVE-2019-16377
Severity: CRITICAL
CWE: CWE-284
Published: 2019-09-27T20:01:00Z

The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.
Vulnerability: GHSA-c9c5-9fpr-m882
Summary: Moderate severity vulnerability that affects sentry-raven
Aliases: CVE-2014-9490
Severity: MODERATE
Published: 2017-10-24T18:33:36Z

The numtok function in lib/raven/okjson.rb in the raven-ruby gem before 0.12.2 for Ruby allows remote attackers to cause a denial of service via a large exponent value in a scientific number.
Vulnerability: GHSA-93j5-g845-9wqp
Summary: Unsafe HTTP Redirect in Puppet Agent and Puppet Server
Aliases: CVE-2021-27023
Severity: MODERATE
Published: 2021-12-02T17:52:45Z

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
Vulnerability: GHSA-5x32-c9mf-49cc
Summary: Directory traversal in RubyGems
Aliases: CVE-2019-8320
Severity: HIGH
CWE: CWE-22
Published: 2019-06-20T16:06:15Z

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.
Vulnerability: GHSA-cfjv-5498-mph5
Summary: XSS in Action View
Aliases: CVE-2020-15169
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-11T15:19:57Z

There is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks.

### Impact

When an HTML-unsafe string is passed as the default for a missing translation key [named `html` or ending in `_html`](https://guides.rubyonrails.org/i18n.html#using-safe-html-translations), the default string is incorrectly marked as HTML-safe and not escaped. Vulnerable code may look like the following examples:

```erb
<%# The welcome_html translation is not defined for the current locale: %>
<%= t("welcome_html", default: untrusted_user_controlled_string) %>

<%# Neither the title.html translation nor the missing.html translation is defined for the current locale: %>
<%= t("title.html", default: [:"missing.html", untrusted_user_controlled_string]) %>
```

### Patches

Patched Rails versions, 6.0.3.3 and 5.2.4.4, are available from the normal locations.

The patches have also been applied to the `master`, `6-0-stable`, and `5-2-stable` branches on GitHub. If you track any of these branches, you should update to the latest.

To aid users who aren’t able to upgrade immediately, we’ve provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* [5-2-translate-helper-xss.patch](https://gist.github.com/georgeclaghorn/a466e103922ee81f24c32c9034089442#file-5-2-translate-helper-xss-patch) — patch for the 5.2 release series
* [6-0-translate-helper-xss.patch](https://gist.github.com/georgeclaghorn/a466e103922ee81f24c32c9034089442#file-6-0-translate-helper-xss-patch) — patch for the 6.0 release series

Please note that only the 5.2 and 6.0 release series are currently supported. Users of earlier, unsupported releases are advised to update as soon as possible, as we cannot provide security fixes for unsupported releases.

### Workarounds

Impacted users who can’t upgrade to a patched Rails version can avoid this issue by manually escaping default translations with the `html_escape` helper (aliased as `h`):

```erb
<%= t("welcome_html", default: h(untrusted_user_controlled_string)) %>
```
Vulnerability: GHSA-94cq-7ccq-cmcm
Summary: lynx doesn't properly sanitize user input and exposes database password to unauthorized users
Aliases: CVE-2014-5002
Severity: HIGH
Published: 2018-01-24T17:10:45Z

The lynx gem 0.2.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.
Vulnerability: GHSA-rg5m-3fqp-6px8
Summary: Moderate severity vulnerability that affects actionmailer
Aliases: CVE-2013-4389
Severity: MODERATE
CWE: CWE-134
Published: 2017-10-24T18:33:37Z

Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
Vulnerability: GHSA-cpjc-p7fc-j9xh
Summary: Moderate severity vulnerability that affects mail
Aliases: CVE-2011-0739
Severity: MODERATE
CWE: CWE-20
Published: 2017-10-24T18:33:38Z

The deliver function in the sendmail delivery agent (lib/mail/network/delivery_methods/sendmail.rb) in Ruby Mail gem 2.2.14 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address.
Vulnerability: GHSA-3jqw-vv45-mjhh
Summary: XSS/Script injection vulnerability in matestack
Aliases: CVE-2020-5241
Severity: HIGH
CWE: CWE-80
Published: 2020-02-12T23:37:46Z

matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection.

This vulnerability is patched in version 0.7.4.
Vulnerability: GHSA-v6gp-9mmm-c6p5
Summary: Out-of-bounds Write in zlib affects Nokogiri
Severity: HIGH
CWE: CWE-787
Published: 2022-04-11T21:21:28Z

## Summary

Nokogiri v1.13.4 updates the vendored zlib from 1.2.11 to 1.2.12, which addresses [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032). That CVE is scored as CVSS 7.4 "High" on the NVD record as of 2022-04-05.

Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.13.4`, and only if the packaged version of `zlib` is being used. Please see [this document](https://nokogiri.org/LICENSE-DEPENDENCIES.html#default-platform-release-ruby) for a complete description of which platform gems vendor `zlib`. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's `zlib` release announcements. 

## Mitigation

Upgrade to Nokogiri `>= v1.13.4`.

## Impact

### [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032) in zlib

- **Severity**: High
- **Type**: [CWE-787](https://cwe.mitre.org/data/definitions/787.html) Out of bounds write
- **Description**: zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
Vulnerability: GHSA-vv4c-g6q7-p3q7
Summary: Moderate severity vulnerability that affects doorkeeper-openid_connect
Aliases: CVE-2019-9837
Severity: MODERATE
CWE: CWE-601
Published: 2019-03-25T16:15:54Z

Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow.
Vulnerability: GHSA-573x-jhqh-jg36
Summary: Moderate severity vulnerability that affects chloride
Aliases: CVE-2018-6517
Severity: HIGH
CWE: CWE-295
Published: 2019-03-25T16:16:27Z

Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file without confirmation. In version 0.3.0 this is updated so that the user's known_hosts file is not updated by chloride.
Vulnerability: GHSA-229r-pqp6-8w6g
Summary: High severity vulnerability that affects sprout
Aliases: CVE-2013-6421
Severity: HIGH
CWE: CWE-94
Published: 2017-10-24T18:33:36Z

The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.