deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-w3q8-m492-4pwp
Package: decidim (RUBYGEMS)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-672: Operation on a Resource after Expiration or Release
Vulnerable versions: >= 0.0.1.alpha3, < 0.26.9
Patched in: 0.26.9

Summary: Possibility to circumvent the invitation token expiry period

Details:
### Impact
The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the `devise_invitable` gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the `devise_invitable` gem:
https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the `invite_for` expiry period as explained in the gem's documentation:
https://github.com/scambra/devise_invitable#model-configuration-

> `invite_for`: The period the generated invitation token is valid. After this period, the invited resource won’t be able to accept the invitation. When `invite_for` is `0` (the default), the invitation won’t expire.

Decidim sets this configuration to `2.weeks` so this configuration should be respected:
https://github.com/decidim/decidim/blob/d2d[PII_REDACTED]72d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the `devise_invitable` gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

### Patches
Update `devise_invitable` to version `2.0.9` or above by running the following command:

```
$ bundle update devise_invitable
```

### Workarounds
The invitations can be cancelled directly from the database by running the following command from the Rails console:

```
> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)
```

### References
OWASP ASVS V4.0.3-2.3.1

This bug has existed in the `devise_invitable` gem since this commit which was first included in the `v0.4.rc3` release of this gem:
https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version `~> 1.7.0` to the `decidim-admin` gem in this commit which was first included in the `v0.0.1.alpha3` release of Decidim:
https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version `~> 1.7.0` to the `decidim-system` gem in this commit which was also first included in the `v0.0.1.alpha3` release of Decidim:
https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

### Credits
This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by [Deloitte Finland](https://www2.deloitte.com/fi/fi.html).
GitHub Security Advisory: GHSA-f3qm-vfc3-jg6v
Package: decidim-templates (RUBYGEMS)
Severity: MODERATE (CVSS 4.5)
CWE: CWE-352: Cross-Site Request Forgery (CSRF), CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 0.23.0, < 0.27.5
Patched in: 0.27.5

Summary: Possible CSRF attack at questionnaire templates preview

Details:
### Impact
The CSRF authenticity token check is currently disabled for the questionnaire templates preview as per:
https://github.com/decidim/decidim/blob/3187bdfd40ea1c57c2c12512b09a7fec0b2bed08/decidim-templates/app/controllers/decidim/templates/admin/questionnaire_templates_controller.rb#L11

This was introduced by this commit in the PR that introduced this feature (#6247):
https://github.com/decidim/decidim/pull/6247/commits/5542227be66e3b6d7530f5b536069bce09376660

The issue does not imply a serious security thread as you need to have access also to the session cookie in order to see this resource. This URL does not allow modifying the resource but it may allow attackers to gain access to information which was not meant to be public.

### Patches
#11743

### Workarounds
Disable the templates functionality or remove all available templates.

### References
#11743
GitHub Security Advisory: GHSA-r275-j57c-7mf2
Package: decidim (RUBYGEMS)
Severity: LOW (CVSS 3.1)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: >= 0.27.0, < 0.27.5
Patched in: 0.27.5

Summary: Race condition in Endorsements

Details:
### Impact

A race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement.

To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel.
 
### Workarounds

Disable the Endorsement feature in the components.
GitHub Security Advisory: GHSA-r275-j57c-7mf2
Package: decidim (RUBYGEMS)
Severity: LOW (CVSS 3.1)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: >= 0.10.0, < 0.26.9
Patched in: 0.26.9

Summary: Race condition in Endorsements

Details:
### Impact

A race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement.

To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel.
 
### Workarounds

Disable the Endorsement feature in the components.
GitHub Security Advisory: GHSA-rxq3-gm4p-5fj4
Package: rails (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-287: Improper Authentication
Vulnerable versions: < 2.3.3
Patched in: 2.3.3

Summary: rails vulnerable to improper authentication

Details:
The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.
GitHub Security Advisory: GHSA-p25m-jpj4-qcrr
Package: grpc (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: >= 1.53.0, < 1.53.2
Patched in: 1.53.2

Summary: Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

Details:
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
GitHub Security Advisory: GHSA-p25m-jpj4-qcrr
Package: grpc (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: >= 1.54.0, < 1.54.3
Patched in: 1.54.3

Summary: Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

Details:
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
GitHub Security Advisory: GHSA-p25m-jpj4-qcrr
Package: grpc (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: >= 1.55.0, < 1.55.3
Patched in: 1.55.3

Summary: Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

Details:
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
GitHub Security Advisory: GHSA-p25m-jpj4-qcrr
Package: grpc (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: >= 1.56.0, < 1.56.2
Patched in: 1.56.2

Summary: Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

Details:
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
GitHub Security Advisory: GHSA-wfrc-r6c6-7j9r
Package: webrick (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.1
Patched in: 1.3.1

Summary: WEBrick Denial of Service Vulnerability

Details:
httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request.  NOTE: this issue exists because of an incomplete fix for CVE-2008-3656.
GitHub Security Advisory: GHSA-f68m-q26r-64f6
Package: chef (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 0.9.0
Patched in: 0.9.0

Summary: Chef Improper Access Control vulnerability

Details:
`chef-server-api/app/controllers/users.rb` in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.
GitHub Security Advisory: GHSA-vrh7-99jh-3fmm
Package: puppet (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: >= 0.25.0, < 0.25.2
Patched in: 0.25.2

Summary: Puppet arbitrary files overwrite via a symlink attack

Details:
Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex, or (4) /tmp/puppetdoc.aux temporary file.
GitHub Security Advisory: GHSA-vrh7-99jh-3fmm
Package: puppet (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: >= 0.24.0, < 0.24.9
Patched in: 0.24.9

Summary: Puppet arbitrary files overwrite via a symlink attack

Details:
Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex, or (4) /tmp/puppetdoc.aux temporary file.
GitHub Security Advisory: GHSA-p84v-45xj-wwqj
Package: actionpack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 6.0.0, < 6.1.7.1
Patched in: 6.1.7.1

Summary: ReDoS based DoS vulnerability in Action Dispatch

Details:
There is a possible regular expression based DoS vulnerability in Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2023-22792.

Versions Affected: >= 3.0.0 Not affected: < 3.0.0 Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1
Impact

Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious X_FORWARDED_HOST headers before they reach the application.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-1-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 6.1 series
    7-0-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
GitHub Security Advisory: GHSA-p84v-45xj-wwqj
Package: actionpack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 7.0.0, < 7.0.4.1
Patched in: 7.0.4.1

Summary: ReDoS based DoS vulnerability in Action Dispatch

Details:
There is a possible regular expression based DoS vulnerability in Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2023-22792.

Versions Affected: >= 3.0.0 Not affected: < 3.0.0 Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1
Impact

Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious X_FORWARDED_HOST headers before they reach the application.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-1-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 6.1 series
    7-0-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
GitHub Security Advisory: GHSA-p84v-45xj-wwqj
Package: actionpack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 3.0.0, < 5.2.8.15
Patched in: 5.2.8.15

Summary: ReDoS based DoS vulnerability in Action Dispatch

Details:
There is a possible regular expression based DoS vulnerability in Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2023-22792.

Versions Affected: >= 3.0.0 Not affected: < 3.0.0 Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1
Impact

Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious X_FORWARDED_HOST headers before they reach the application.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-1-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 6.1 series
    7-0-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
GitHub Security Advisory: GHSA-hq7p-j377-6v63
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 7.0.0, < 7.0.4.1
Patched in: 7.0.4.1

Summary: SQL Injection Vulnerability via ActiveRecord comments

Details:
There is a possible vulnerability in ActiveRecord related to the sanitization of comments. This vulnerability has been assigned the CVE identifier CVE-2023-22794.

Versions Affected: >= 6.0.0 Not affected: < 6.0.0 Fixed Versions: 6.0.6.1, 6.1.7.1, 7.0.4.1
Impact

Previously the implementation of escaping for comments was insufficient for

If malicious user input is passed to either the annotate query method, the optimizer_hints query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database with insufficient sanitization and be able to inject SQL outside of the comment.

In most cases these interfaces won’t be used with user input and users should avoid doing so.

Example vulnerable code:
```
Post.where(id: 1).annotate("#{params[:user_input]}")

Post.where(id: 1).optimizer_hints("#{params[:user_input]}")
```
Example vulnerable QueryLogs configuration (the default configuration is not vulnerable):
```
config.active_record.query_log_tags = [
  {
    something: -> { <some value including user input> }
  }
]
```
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

Avoid passing user input to annotate and avoid using QueryLogs configuration which can include user input.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-0-Make-sanitize_as_sql_comment-more-strict.patch - Patch for 6.0 series
    6-1-Make-sanitize_as_sql_comment-more-strict.patch - Patch for 6.1 series
    7-0-Make-sanitize_as_sql_comment-more-strict.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
GitHub Security Advisory: GHSA-hq7p-j377-6v63
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 6.1.0, < 6.1.7.1
Patched in: 6.1.7.1

Summary: SQL Injection Vulnerability via ActiveRecord comments

Details:
There is a possible vulnerability in ActiveRecord related to the sanitization of comments. This vulnerability has been assigned the CVE identifier CVE-2023-22794.

Versions Affected: >= 6.0.0 Not affected: < 6.0.0 Fixed Versions: 6.0.6.1, 6.1.7.1, 7.0.4.1
Impact

Previously the implementation of escaping for comments was insufficient for

If malicious user input is passed to either the annotate query method, the optimizer_hints query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database with insufficient sanitization and be able to inject SQL outside of the comment.

In most cases these interfaces won’t be used with user input and users should avoid doing so.

Example vulnerable code:
```
Post.where(id: 1).annotate("#{params[:user_input]}")

Post.where(id: 1).optimizer_hints("#{params[:user_input]}")
```
Example vulnerable QueryLogs configuration (the default configuration is not vulnerable):
```
config.active_record.query_log_tags = [
  {
    something: -> { <some value including user input> }
  }
]
```
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

Avoid passing user input to annotate and avoid using QueryLogs configuration which can include user input.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-0-Make-sanitize_as_sql_comment-more-strict.patch - Patch for 6.0 series
    6-1-Make-sanitize_as_sql_comment-more-strict.patch - Patch for 6.1 series
    7-0-Make-sanitize_as_sql_comment-more-strict.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
GitHub Security Advisory: GHSA-hq7p-j377-6v63
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 6.0.0, < 6.0.6.1
Patched in: 6.0.6.1

Summary: SQL Injection Vulnerability via ActiveRecord comments

Details:
There is a possible vulnerability in ActiveRecord related to the sanitization of comments. This vulnerability has been assigned the CVE identifier CVE-2023-22794.

Versions Affected: >= 6.0.0 Not affected: < 6.0.0 Fixed Versions: 6.0.6.1, 6.1.7.1, 7.0.4.1
Impact

Previously the implementation of escaping for comments was insufficient for

If malicious user input is passed to either the annotate query method, the optimizer_hints query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database with insufficient sanitization and be able to inject SQL outside of the comment.

In most cases these interfaces won’t be used with user input and users should avoid doing so.

Example vulnerable code:
```
Post.where(id: 1).annotate("#{params[:user_input]}")

Post.where(id: 1).optimizer_hints("#{params[:user_input]}")
```
Example vulnerable QueryLogs configuration (the default configuration is not vulnerable):
```
config.active_record.query_log_tags = [
  {
    something: -> { <some value including user input> }
  }
]
```
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

Avoid passing user input to annotate and avoid using QueryLogs configuration which can include user input.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-0-Make-sanitize_as_sql_comment-more-strict.patch - Patch for 6.0 series
    6-1-Make-sanitize_as_sql_comment-more-strict.patch - Patch for 6.1 series
    7-0-Make-sanitize_as_sql_comment-more-strict.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.