deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-q28m-8xjw-8vr5
Package: puma (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 5.0.0, <= 5.3.0
Patched in: 5.3.1

Summary: Puma's Keepalive Connections Causing Denial Of Service

Details:
This vulnerability is related to [CVE-2019-16770](https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994).

### Impact

The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster.

A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections.

### Patches

This problem has been fixed in `puma` 4.3.8 and 5.3.1.

### Workarounds

Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without a reverse proxy, such as `nginx` or `apache`, because you will open yourself to slow client attacks (e.g. [slowloris](https://en.wikipedia.org/wiki/Slowloris_(computer_security))).

The fix is very small. [A git patch is available here](https://gist.github.com/nateberkopec/4b3ea5676c0d70cbb37c82d54be25837) for those using [unsupported versions](https://github.com/puma/puma/security/policy#supported-versions) of Puma.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma).
* To report problems with this fix or to report another vulnerability, see [our security policy.](https://github.com/puma/puma/security/policy)

### Acknowledgements

Thank you to @MSP-Greg, @wjordan and @evanphx for their review on this issue. 

Thank you to @ioquatix for providing a modified fork of `wrk` which made debugging this issue much easier.
GitHub Security Advisory: GHSA-q28m-8xjw-8vr5
Package: puma (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 4.3.7
Patched in: 4.3.8

Summary: Puma's Keepalive Connections Causing Denial Of Service

Details:
This vulnerability is related to [CVE-2019-16770](https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994).

### Impact

The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster.

A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections.

### Patches

This problem has been fixed in `puma` 4.3.8 and 5.3.1.

### Workarounds

Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without a reverse proxy, such as `nginx` or `apache`, because you will open yourself to slow client attacks (e.g. [slowloris](https://en.wikipedia.org/wiki/Slowloris_(computer_security))).

The fix is very small. [A git patch is available here](https://gist.github.com/nateberkopec/4b3ea5676c0d70cbb37c82d54be25837) for those using [unsupported versions](https://github.com/puma/puma/security/policy#supported-versions) of Puma.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma).
* To report problems with this fix or to report another vulnerability, see [our security policy.](https://github.com/puma/puma/security/policy)

### Acknowledgements

Thank you to @MSP-Greg, @wjordan and @evanphx for their review on this issue. 

Thank you to @ioquatix for providing a modified fork of `wrk` which made debugging this issue much easier.
GitHub Security Advisory: GHSA-x3v4-pxvm-63j8
Package: reel (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: <= 0.6.1
Patched in: unpatched

Summary: HTTP Request Smuggling in reel

Details:
reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TECL smuggling attacks. Note, This project is deprecated, and is not maintained any more.
GitHub Security Advisory: GHSA-3892-2r52-p65m
Package: goliath (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: <= 1.0.6
Patched in: unpatched

Summary: HTTP Request Smuggling in goliath

Details:
goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks.
GitHub Security Advisory: GHSA-46f2-3v63-3xrp
Package: tmpdir (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 0.1.2
Patched in: 0.1.2

Summary: Tempfile on Windows path traversal vulnerability

Details:
There is an unintentional directory creation vulnerability in `tmpdir` library bundled with Ruby on Windows. And there is also an unintentional file creation vulnerability in tempfile library bundled with Ruby on Windows, because it uses tmpdir internally.
GitHub Security Advisory: GHSA-hjg4-8q5f-x6fm
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 2.0.0, <= 5.2.4.5
Patched in: 5.2.4.6

Summary: Action Pack contains Information Disclosure / Unintended Method Execution vulnerability

Details:
Impact
------
There is a possible information disclosure / unintended method execution vulnerability in Action Pack when using the `redirect_to` or `polymorphic_url` helper with untrusted user input.

Vulnerable code will look like this.

```
redirect_to(params[:some_param])
```

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
To work around this problem, it is recommended to use an allow list for valid parameters passed from the user.  For example,

```ruby
private def check(param)
  case param
  when "valid"
    param
  else
    "/"
  end
end

def index
  redirect_to(check(params[:some_param]))
end
```

Or force the user input to be cast to a string like this,

```ruby
def index
  redirect_to(params[:some_param].to_s)
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 5-2-information-disclosure.patch - Patch for 5.2 series
* 6-0-information-disclosure.patch - Patch for 6.0 series
* 6-1-information-disclosure.patch - Patch for 6.1 series

Please note that only the 5.2, 6.0, and 6.1 series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits
-------

Thanks to Benoit Côté-Jodoin from Shopify for reporting this.
GitHub Security Advisory: GHSA-hjg4-8q5f-x6fm
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 5.2.5, < 5.2.6
Patched in: 5.2.6

Summary: Action Pack contains Information Disclosure / Unintended Method Execution vulnerability

Details:
Impact
------
There is a possible information disclosure / unintended method execution vulnerability in Action Pack when using the `redirect_to` or `polymorphic_url` helper with untrusted user input.

Vulnerable code will look like this.

```
redirect_to(params[:some_param])
```

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
To work around this problem, it is recommended to use an allow list for valid parameters passed from the user.  For example,

```ruby
private def check(param)
  case param
  when "valid"
    param
  else
    "/"
  end
end

def index
  redirect_to(check(params[:some_param]))
end
```

Or force the user input to be cast to a string like this,

```ruby
def index
  redirect_to(params[:some_param].to_s)
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 5-2-information-disclosure.patch - Patch for 5.2 series
* 6-0-information-disclosure.patch - Patch for 6.0 series
* 6-1-information-disclosure.patch - Patch for 6.1 series

Please note that only the 5.2, 6.0, and 6.1 series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits
-------

Thanks to Benoit Côté-Jodoin from Shopify for reporting this.
GitHub Security Advisory: GHSA-hjg4-8q5f-x6fm
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 6.1.0, <= 6.1.3.1
Patched in: 6.1.3.2

Summary: Action Pack contains Information Disclosure / Unintended Method Execution vulnerability

Details:
Impact
------
There is a possible information disclosure / unintended method execution vulnerability in Action Pack when using the `redirect_to` or `polymorphic_url` helper with untrusted user input.

Vulnerable code will look like this.

```
redirect_to(params[:some_param])
```

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
To work around this problem, it is recommended to use an allow list for valid parameters passed from the user.  For example,

```ruby
private def check(param)
  case param
  when "valid"
    param
  else
    "/"
  end
end

def index
  redirect_to(check(params[:some_param]))
end
```

Or force the user input to be cast to a string like this,

```ruby
def index
  redirect_to(params[:some_param].to_s)
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 5-2-information-disclosure.patch - Patch for 5.2 series
* 6-0-information-disclosure.patch - Patch for 6.0 series
* 6-1-information-disclosure.patch - Patch for 6.1 series

Please note that only the 5.2, 6.0, and 6.1 series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits
-------

Thanks to Benoit Côté-Jodoin from Shopify for reporting this.
GitHub Security Advisory: GHSA-hjg4-8q5f-x6fm
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 6.0.0, <= 6.0.3.6
Patched in: 6.0.3.7

Summary: Action Pack contains Information Disclosure / Unintended Method Execution vulnerability

Details:
Impact
------
There is a possible information disclosure / unintended method execution vulnerability in Action Pack when using the `redirect_to` or `polymorphic_url` helper with untrusted user input.

Vulnerable code will look like this.

```
redirect_to(params[:some_param])
```

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
To work around this problem, it is recommended to use an allow list for valid parameters passed from the user.  For example,

```ruby
private def check(param)
  case param
  when "valid"
    param
  else
    "/"
  end
end

def index
  redirect_to(check(params[:some_param]))
end
```

Or force the user input to be cast to a string like this,

```ruby
def index
  redirect_to(params[:some_param].to_s)
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 5-2-information-disclosure.patch - Patch for 5.2 series
* 6-0-information-disclosure.patch - Patch for 6.0 series
* 6-1-information-disclosure.patch - Patch for 6.1 series

Please note that only the 5.2, 6.0, and 6.1 series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits
-------

Thanks to Benoit Côté-Jodoin from Shopify for reporting this.
GitHub Security Advisory: GHSA-g98m-96g9-wfjq
Package: bundler (RUBYGEMS)
Severity: HIGH (CVSS 7.0)
CWE: CWE-427: Uncontrolled Search Path Element, CWE-552: Files or Directories Accessible to External Parties
Vulnerable versions: >= 1.14.0, < 2.1.0
Patched in: 2.1.0

Summary: Insecure path handling in Bundler

Details:
Bundler prior to 2.1.0 uses a predictable path in `/tmp/`, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.
GitHub Security Advisory: GHSA-8cr8-4vfw-mr7h
Package: rexml (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-115: Misinterpretation of Input, CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: < 3.2.5
Patched in: 3.2.5

Summary: REXML round-trip instability

Details:
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
GitHub Security Advisory: GHSA-7359-3c6r-hfc2
Package: oauth (RUBYGEMS)
Severity: HIGH (CVSS 7.4)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: < 0.5.5
Patched in: 0.5.5

Summary: Improper Certificate Validation in oauth ruby gem

Details:
lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.
GitHub Security Advisory: GHSA-h8hx-2c5r-32cf
Package: trestle-auth (RUBYGEMS)
Severity: HIGH (CVSS 8.1)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 0.4.0, < 0.4.2
Patched in: 0.4.2

Summary: Cross-Site Request Forgery (CSRF) in trestle-auth

Details:
### Impact
A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials.

### Patches
The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [trestle-auth](https://github.com/TrestleAdmin/trestle-auth/issues)
* Email the maintainer at [sam@sampohlenz.com](mailto:sam@sampohlenz.com)
GitHub Security Advisory: GHSA-6hrm-jqp3-64cv
Package: tweetstream (RUBYGEMS)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: <= 2.6.1
Patched in: unpatched

Summary: Improper Certificate Validation in TweetStream

Details:
TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.
GitHub Security Advisory: GHSA-52p9-v744-mwjj
Package: kramdown (RUBYGEMS)
Severity: HIGH (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 1.16.0, < 2.3.1
Patched in: 2.3.1

Summary: Remote code execution in Kramdown

Details:
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
GitHub Security Advisory: GHSA-p6p8-q4pj-f74m
Package: twitter-stream (RUBYGEMS)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: <= 0.1.16
Patched in: unpatched

Summary: Improper Certificate Validation in twitter-stream

Details:
In voloko twitter-stream 0.1.16, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused).
GitHub Security Advisory: GHSA-8877-prq4-9xfw
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 6.1.0, <= 6.1.2.0
Patched in: 6.1.2.1

Summary: Actionpack Open Redirect Vulnerability 

Details:
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
GitHub Security Advisory: GHSA-8877-prq4-9xfw
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 6.0.0, <= 6.0.3.4
Patched in: 6.0.3.5

Summary: Actionpack Open Redirect Vulnerability 

Details:
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
GitHub Security Advisory: GHSA-8hc4-xxm3-5ppp
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 6.1.0, <= 6.1.2.0
Patched in: 6.1.2.1

Summary: Active Record subject to Regular Expression Denial-of-Service (ReDoS)

Details:
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
GitHub Security Advisory: GHSA-8hc4-xxm3-5ppp
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 6.0.0, <= 6.0.3.4
Patched in: 6.0.3.5

Summary: Active Record subject to Regular Expression Denial-of-Service (ReDoS)

Details:
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
GitHub Security Advisory: GHSA-8hc4-xxm3-5ppp
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 5.0.0, <= 5.2.4.4
Patched in: 5.2.4.5

Summary: Active Record subject to Regular Expression Denial-of-Service (ReDoS)

Details:
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
GitHub Security Advisory: GHSA-cf3w-g86h-35x4
Package: carrierwave (RUBYGEMS)
Severity: HIGH (CVSS 7.4)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 2.0.0, < 2.1.1
Patched in: 2.1.1

Summary: Code Injection vulnerability in CarrierWave::RMagick

Details:
### Impact
[CarrierWave::RMagick](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/processing/rmagick.rb) has a Code Injection vulnerability. Its `#manipulate!` method inappropriately evals the content of mutation option(`:read`/`:write`), allowing attackers to craft a string that can be executed as a Ruby code.
If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE).

(But supplying untrusted input to the option itself is dangerous even in absence of this vulnerability, since is prone to DoS vulnerability - attackers can try to consume massive amounts of memory by resizing to a very large dimension)

### Proof of Concept
```ruby
class MyUploader < CarrierWave::Uploader::Base
  include CarrierWave::RMagick
end

MyUploader.new.manipulate!({ read: { density: "1 }; p 'Hacked'; {" }}) # => shows "Hacked"
```

### Patches
Upgrade to [2.1.1](https://rubygems.org/gems/carrierwave/versions/2.1.1) or [1.3.2](https://rubygems.org/gems/carrierwave/versions/1.3.2).

### Workarounds
Stop supplying untrusted input to `#manipulate!`'s mutation option.

### References
[Code Injection Software Attack](https://owasp.org/www-community/attacks/Code_Injection)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [CarrierWave repo](https://github.com/carrierwaveuploader/carrierwave)
* Email me at [mit.shibuya@gmail.com](mailto:mit.shibuya@gmail.com)