deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-cmcx-xhr8-3w9p
Package: user_agent_parser (RUBYGEMS)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-20: Improper Input Validation, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 2.6.0
Patched in: 2.6.0

Summary: Denial of Service in uap-core when processing crafted User-Agent strings

Details:
### Impact

Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

### Patches

Please update uap-core to &amp;amp;gt;= v0.7.3

Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.

### Details

Each vulnerable regular expression reported here contains 3 overlapping capture groups. Backtracking has approximately cubic time complexity with respect to the length of the user-agent string.

#### Regex 1:

```
\bSmartWatch *\( *([^;]+) *; *([^;]+) *;
```

is vulnerable in portion ` *([^;]+) *` and can be attacked with

```python
&amp;amp;quot;SmartWatch(&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```
e.g.
```
SmartWatch(                                   z
```


#### Regex 2:

```
; *([^;/]+) Build[/ ]Huawei(MT1-U06|[A-Z]+\d+[^\);]+)[^\);]*\)
```

is vulnerable in portion `\d+[^\);]+[^\);]*` and can be attacked with

```python
&amp;amp;quot;;A Build HuaweiA&amp;amp;quot; + (&amp;amp;quot;4&amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```


#### Regex 3:

```
(HbbTV)/[0-9]+\.[0-9]+\.[0-9]+ \([^;]*; *(LG)E *; *([^;]*) *;[^;]*;[^;]*;\)
```

is vulnerable in portion ` *([^;]*) *` and can be attacked with

```python
&amp;amp;quot;HbbTV/0.0.0 (;LGE;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```

#### Regex 4:

```
(HbbTV)/[0-9]+\.[0-9]+\.[0-9]+ \([^;]*; *(?:CUS:([^;]*)|([^;]+)) *; *([^;]*) *;.*;
```

is vulnerable in portions ` *(?:CUS:([^;]*)|([^;]+)) *` and ` *([^;]*) *` and can be attacked with

```python
&amp;amp;quot;HbbTV/0.0.0 (;CUS:;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
&amp;amp;quot;HbbTV/0.0.0 (;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
&amp;amp;quot;HbbTV/0.0.0 (;z;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```

Reported by Ben Caller @bcaller
GitHub Security Advisory: GHSA-6w4m-2xhg-2658
Package: sha3 (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: < 1.0.5
Patched in: 1.0.5

Summary: Buffer overflow in sponge queue functions

Details:
### Impact

The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more.

### Patches

Yes, see commit [fdc6fef0](https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc[PII_REDACTED]5e08e340a).

### Workarounds

The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether.

### References

See [issue #105](https://github.com/XKCP/XKCP/issues/105) for more details.
GitHub Security Advisory: GHSA-65g2-x53q-cmf6
Package: kitchen-terraform (RUBYGEMS)
Severity: LOW (CVSS 3.2)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 7.0.0, < 7.0.1
Patched in: 7.0.1

Summary: Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform

Details:
### Summary

Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values, including sensitive values, to be printed at the `info` logging level during the `kitchen converge` action. Prior to v7.0.0, the output values were printed at the `debug` level to avoid writing sensitive values to the terminal by default.

### Original Report

@brettcurtis:
> Hopefully, I'm not doing something stupid here, but I'm seeing sensitive outputs printed in the kitchen output. You can check this action for an example: https://github.com/osinfra-io/terraform-google-project/actions/runs/[PII_REDACTED]/jobs/[PII_REDACTED]#step:5:215
>
> It's not really a sensitive value just used it as an example.
GitHub Security Advisory: GHSA-cqf3-vpx7-rxhw
Package: pay (RUBYGEMS)
Severity: HIGH (CVSS 7.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 6.3.2
Patched in: 6.3.2

Summary: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Pay

Details:
### Impact
A payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality.

### Patches
This has been patched in version 6.3.2 and above.

Pay will now sanitize the `back` parameter and only permit relative paths.
GitHub Security Advisory: GHSA-48wp-p9qv-4j64
Package: commonmarker (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.23.9
Patched in: 0.23.9

Summary: Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of service

Details:
## Impact

Several quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm) library may lead to unbounded resource exhaustion and subsequent denial of service.

The following vulnerabilities were addressed:

* [CVE-2023-24824](https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh)
* [CVE-2023-26485](https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5)

For more information, consult the release notes for version [`0.23.0.gfm.10`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.10) and [`0.23.0.gfm.11`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.11).

## Mitigation

Users are advised to upgrade to commonmarker version [`0.23.9`](https://rubygems.org/gems/commonmarker/versions/0.23.9).
GitHub Security Advisory: GHSA-pxvg-2qj5-37jq
Package: nokogiri (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 1.14.3
Patched in: 1.14.3

Summary: Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs

Details:
### Summary

Nokogiri v1.14.3 upgrades the packaged version of its dependency libxml2 to [v2.10.4](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4) from v2.10.3.

libxml2 v2.10.4 addresses the following known vulnerabilities:

- [CVE-2023-29469](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469): Hashing of empty dict strings isn't deterministic
- [CVE-2023-28484](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484): Fix null deref in xmlSchemaFixupComplexType
- Schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK

Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.14.3`, and only if the _packaged_ libraries are being used. If you've overridden defaults at installation time to use _system_ libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` release announcements.


### Mitigation

Upgrade to Nokogiri `>= 1.14.3`.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link Nokogiri against external libraries libxml2 `>= 2.10.4` which will also address these same issues.


### Impact

No public information has yet been published about the security-related issues other than the upstream commits. Examination of those changesets indicate that the more serious issues relate to libxml2 dereferencing NULL pointers and potentially segfaulting while parsing untrusted inputs.

The commits can be examined at:

- [[CVE-2023-29469] Hashing of empty dict strings isn't deterministic (09a2dd45) · Commits · GNOME / libxml2 · GitLab](https://gitlab.gnome.org/GNOME/libxml2/-/commit/09a2dd453007f9c[PII_REDACTED]acdd73747c22d64)
- [[CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType (647e072e) · Commits · GNOME / libxml2 · GitLab](https://gitlab.gnome.org/GNOME/libxml2/-/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f)
- [schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK (4c6922f7) · Commits · GNOME / libxml2 · GitLab](https://gitlab.gnome.org/GNOME/libxml2/-/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6)
GitHub Security Advisory: GHSA-hv5j-3h9f-99c2
Package: uri (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 0.10.0.1
Patched in: 0.10.0.1

Summary: Ruby URI component ReDoS issue

Details:
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
GitHub Security Advisory: GHSA-hv5j-3h9f-99c2
Package: uri (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: = 0.10.1
Patched in: 0.10.2

Summary: Ruby URI component ReDoS issue

Details:
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
GitHub Security Advisory: GHSA-hv5j-3h9f-99c2
Package: uri (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: = 0.11.0
Patched in: 0.11.1

Summary: Ruby URI component ReDoS issue

Details:
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
GitHub Security Advisory: GHSA-hv5j-3h9f-99c2
Package: uri (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: = 0.12.0
Patched in: 0.12.1

Summary: Ruby URI component ReDoS issue

Details:
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
GitHub Security Advisory: GHSA-fg7x-g82r-94qc
Package: time (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 0.1.1
Patched in: 0.1.1

Summary: Ruby Time component ReDoS issue

Details:
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
GitHub Security Advisory: GHSA-fg7x-g82r-94qc
Package: time (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 0.2.0, < 0.2.2
Patched in: 0.2.2

Summary: Ruby Time component ReDoS issue

Details:
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
GitHub Security Advisory: GHSA-m875-3xf6-mf78
Package: unpoly-rails (RUBYGEMS)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2.7.2.2
Patched in: 2.7.2.2

Summary: unpoly-rails Denial of Service vulnerability

Details:
There is a possible Denial of Service (DoS) vulnerability in the unpoly-rails gem that implements the [Unpoly server protocol](https://unpoly.com/up.protocol) for Rails applications.

### Impact

This issues affects Rails applications that operate as an upstream of a load balancer's that uses [passive health checks](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#passive-health-checks).

The [unpoly-rails](https://github.com/unpoly/unpoly-rails/) gem echoes the request URL as an `X-Up-Location` response header. By making a request with exceedingly long URLs (paths or query string), an attacker can cause unpoly-rails to write a exceedingly large response header.

If the response header is too large to be parsed by a load balancer downstream of the Rails application, it may cause the load balancer to remove the upstream from a load balancing group. This causes that application instance to become unavailable until a configured timeout is reached or until an active healthcheck succeeds.


### Patches

The fixed release 2.7.2.2+ is available via RubyGems and GitHub.


### Workarounds

If you cannot upgrade to a fixed release, several workarounds are available:

- Configure your load balancer to use active health checks, e.g. by periodically requesting a route with a known response that indicates healthiness.
- Configure your load balancer so the [maximum size of response headers](https://makandracards.com/operations/537537-nginx-proxy-buffer-tuning) is at least twice the [maximum size of a URL](https://tryhexadecimal.com/guides/http/414-request-uri-too-long).
- Instead of changing your server configuration you may also configure your Rails application to delete redundant `X-Up-Location` headers set by unpoly-rails:
  
  ```ruby
  class ApplicationController < ActionController::Base
  
    after_action :remove_redundant_up_location_header
    
    private
    
    def remove_redundant_up_location_header
      if request.original_url == response.headers['X-Up-Location']
        response.headers.delete('X-Up-Location')
      end
    end
  
  end
  ```
GitHub Security Advisory: GHSA-w9vv-fvw8-j6q3
Package: codders-dataset (RUBYGEMS)
Severity: HIGH (CVSS 7.8)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 1.3.2.1
Patched in: unpatched

Summary: codders-dataset Process Table Local Plaintext Credential Disclosure

Details:
`lib/dataset/database/mysql.rb` and `lib/dataset/database/postgresql.rb` in the codders-dataset gem 1.3.2.1 for Ruby both place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
GitHub Security Advisory: GHSA-qfwq-chf4-jvwg
Package: karo (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: <= 2.5.2
Patched in: unpatched

Summary: karo Metacharacter Handling Remote Command Execution

Details:
The karo gem through 2.5.2 for Ruby allows Remote command injection via the host field.

A flaw in `db.rb` is triggered when handling metacharacters. This may allow a remote attacker to execute arbitrary commands.

In particular lines 76 and 95 (as of `2014-06-01`) pass unsanitized user supplied input to the command line. 

```
73-      host = "{@configuration["user"]}@{@configuration["host"]}"
74-      cmd  = "ssh #{host} cat {server_db_config_file}"
75-
76:      server_db_config_output = `{cmd}`
79-
--
89- def drop_and_create_local_database(local_db_config)
90-      command = case local_db_config["adapter"]
91-      when "mysql2"
93-      when "postgresql"
95-          dropdb -h #{local_db_config["host"]} -U #{local_db_config["username"]} --if-exists #{local_db_config["database"]}
```

If this gem is used in the context of a rails application malicious input could lead to remote command injection. As of version 2.5.2 the affected code lines have not changed.
GitHub Security Advisory: GHSA-34r7-q49f-h37c
Package: uglifier (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-670: Always-Incorrect Control Flow Implementation, CWE-1254: Incorrect Comparison Logic Granularity
Vulnerable versions: < 2.7.2
Patched in: 2.7.2

Summary: Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js

Details:
Versions of `uglify-js` prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.

## Recommendation

Upgrade UglifyJS to version >= 2.4.24.
GitHub Security Advisory: GHSA-qr28-7j6p-9hmv
Package: mapbox-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, < 2.1.7
Patched in: 2.1.7

Summary: Content Injection via TileJSON attribute in mapbox.js

Details:
Versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 of `mapbox.js` are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.

If `L.mapbox.map` or `L.mapbox.tileLayer` are used to load untrusted TileJSON content from a non-Mapbox URL, it is possible for a malicious user with control over the TileJSON content to inject script content into the "attribution" value of the TileJSON which will be executed in the context of the page using Mapbox.js.



## Recommendation

Version 2.x: Update to version 2.1.7 or later.
Version 1.x: Update to version 1.6.5 or later.
GitHub Security Advisory: GHSA-qr28-7j6p-9hmv
Package: mapbox-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.0.0, < 1.6.5
Patched in: 1.6.5

Summary: Content Injection via TileJSON attribute in mapbox.js

Details:
Versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 of `mapbox.js` are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.

If `L.mapbox.map` or `L.mapbox.tileLayer` are used to load untrusted TileJSON content from a non-Mapbox URL, it is possible for a malicious user with control over the TileJSON content to inject script content into the "attribution" value of the TileJSON which will be executed in the context of the page using Mapbox.js.



## Recommendation

Version 2.x: Update to version 2.1.7 or later.
Version 1.x: Update to version 1.6.5 or later.
GitHub Security Advisory: GHSA-q69p-5h74-w36f
Package: mapbox-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, < 2.2.4
Patched in: 2.2.4

Summary: Content Injection via TileJSON Name in mapbox.js

Details:
Versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 of `mapbox.js` are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.

If `L.mapbox.map` or `L.mapbox.shareControl` are used in a manner that gives users control of the TileJSON content, it is possible to inject script content into the name value of the TileJSON. After clicking on the share control, the malicious code will execute in the context of the page using Mapbox.js.



## Recommendation

Version 1.x: Update to version 1.6.6 or later.
Version 2.x: Update to version 2.2.4 or later.
GitHub Security Advisory: GHSA-q69p-5h74-w36f
Package: mapbox-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.0.0, < 1.6.6
Patched in: 1.6.6

Summary: Content Injection via TileJSON Name in mapbox.js

Details:
Versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 of `mapbox.js` are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.

If `L.mapbox.map` or `L.mapbox.shareControl` are used in a manner that gives users control of the TileJSON content, it is possible to inject script content into the name value of the TileJSON. After clicking on the share control, the malicious code will execute in the context of the page using Mapbox.js.



## Recommendation

Version 1.x: Update to version 1.6.6 or later.
Version 2.x: Update to version 2.2.4 or later.
GitHub Security Advisory: GHSA-49jx-9cmc-xjxm
Package: bundler (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 1.7.0
Patched in: 1.7.0

Summary: Bundler may install gems from a different source than expected

Details:
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.
GitHub Security Advisory: GHSA-8mw8-j583-vqfg
Package: passenger (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 4.0.0.rc4
Patched in: 4.0.0.rc4

Summary: RubyGems passenger gem allows remote attackers to delete files

Details:
RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process. 

Affects both open source and Enterprise versions (4.0.0.beta1, 4.0.0.beta2).
GitHub Security Advisory: GHSA-w6pv-c757-6rgr
Package: apollo_upload_server (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
Vulnerable versions: < 2.1.0
Patched in: 2.1.0

Summary: apollo_upload_server has Denial of Service vulnerability

Details:
A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE version 11.11 and above allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.
GitHub Security Advisory: GHSA-vpqv-mqvc-pcx2
Package: twitter-bootstrap-rails (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.2.0
Patched in: 3.2.0

Summary: Reflective Cross-site Scripting Vulnerability in twitter-bootstrap-rails

Details:
The twitter-bootstrap-rails Gem for Rails contains a flaw that enables a
reflected cross-site scripting (XSS) attack. This flaw exists because the
bootstrap_flash helper method does not validate input when handling flash
messages before returning it to users. This may allow a context-dependent
attacker to create a specially crafted request that would execute arbitrary
script code in a user's browser session within the trust relationship between
their browser and the server.
GitHub Security Advisory: GHSA-pj73-v5mw-pm9j
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 6.1.7.3
Patched in: 6.1.7.3

Summary: Possible XSS Security Vulnerability in SafeBuffer#bytesplice

Details:
There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
This vulnerability has been assigned the CVE identifier CVE-2023-28120.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3

# Impact

ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized.
When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.

Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation.
Users on older versions of Ruby are likely unaffected.

All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.

# Workarounds

Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.