deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-gxhx-g4fq-49hj
Package: carrierwave (RUBYGEMS)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.2.5
Patched in: 2.2.5

Summary: CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS

Details:
### Impact
[CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb) has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. 

The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match.
If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed.

In addition, by setting the Content-Type configured by the attacker at the time of file delivery, it is possible to cause XSS on the user's browser when the uploaded file is opened.

### Patches
Upgrade to [3.0.5](https://rubygems.org/gems/carrierwave/versions/3.0.5) or [2.2.5](https://rubygems.org/gems/carrierwave/versions/2.2.5).

### Workarounds
When validating with `allowlisted_content_type?` in [CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb) , forward match(`\A`) the Content-Type set in `content_type_allowlist`, preventing unintentional permission of `text/html;image/png` when you want to allow only `image/png` in `content_type_allowlist`.

### References
[OWASP - File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html#content-type-validation)
GitHub Security Advisory: GHSA-gxhx-g4fq-49hj
Package: carrierwave (RUBYGEMS)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0, < 3.0.5
Patched in: 3.0.5

Summary: CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS

Details:
### Impact
[CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb) has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. 

The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match.
If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed.

In addition, by setting the Content-Type configured by the attacker at the time of file delivery, it is possible to cause XSS on the user's browser when the uploaded file is opened.

### Patches
Upgrade to [3.0.5](https://rubygems.org/gems/carrierwave/versions/3.0.5) or [2.2.5](https://rubygems.org/gems/carrierwave/versions/2.2.5).

### Workarounds
When validating with `allowlisted_content_type?` in [CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb) , forward match(`\A`) the Content-Type set in `content_type_allowlist`, preventing unintentional permission of `text/html;image/png` when you want to allow only `image/png` in `content_type_allowlist`.

### References
[OWASP - File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html#content-type-validation)
GitHub Security Advisory: GHSA-w457-6q6x-cgp9
Package: bootstrap-wysihtml5-rails (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: >= 0.3.3.5, <= 0.3.3.8
Patched in: unpatched

Summary: Prototype Pollution in handlebars

Details:
Versions of `handlebars` prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' `__proto__` and `__defineGetter__` properties, which may allow an attacker to execute arbitrary code through crafted payloads.


## Recommendation

Upgrade to version 3.0.8, 4.3.0 or later.
GitHub Security Advisory: GHSA-9v3m-8fp8-mj99
Package: twitter-bootstrap-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 5.0.0
Patched in: unpatched

Summary: Bootstrap Vulnerable to Cross-Site Scripting

Details:
Versions of `bootstrap` prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The  `data-template` attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.


## Recommendation

For `bootstrap` 4.x upgrade to 4.3.1 or later.
For `bootstrap` 3.x upgrade to 3.4.1 or later.
GitHub Security Advisory: GHSA-pqj5-7r86-64fv
Package: puppet (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 4.0.0, < 4.4.2
Patched in: 4.4.2

Summary: Puppet Improper Access Control

Details:
Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.
GitHub Security Advisory: GHSA-vcmm-ppqx-95ch
Package: logstash-core (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 2.3.4
Patched in: 2.3.4

Summary: Logstash Logs Sensitive Information

Details:
Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information.
GitHub Security Advisory: GHSA-3gg4-6hqg-2vjx
Package: logstash-core (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 5.0.1
Patched in: 5.0.1

Summary: Logstash Logs Sensitive Information

Details:
Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials.
GitHub Security Advisory: GHSA-frgf-8jr5-j2jv
Package: rmagick (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-401: Missing Release of Memory after Effective Lifetime
Vulnerable versions: < 5.3.0
Patched in: 5.3.0

Summary: memory leak flaw was found in ruby-magick

Details:
A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion.
GitHub Security Advisory: GHSA-v6rp-3r3v-hf4p
Package: openssl (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 2.0.0
Patched in: 2.0.0

Summary: Ruby OpenSSL DoS Vulnerability

Details:
The decode method in the `OpenSSL::ASN1` module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string. The `openssl` gem that contains this module is patched in version 2.0.0.
GitHub Security Advisory: GHSA-93pm-5p5f-3ghx
Package: rack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 3.0.0.0, < 3.0.4.1
Patched in: 3.0.4.1

Summary: Denial of Service Vulnerability in Rack Content-Disposition parsing

Details:
There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44571.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1
Impact

Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Releases

The fixed releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    2-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.0 series
    2-1-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.1 series
    2-2-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.2 series
    3-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 3.0 series
GitHub Security Advisory: GHSA-93pm-5p5f-3ghx
Package: rack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 2.2.0, < 2.2.6.1
Patched in: 2.2.6.1

Summary: Denial of Service Vulnerability in Rack Content-Disposition parsing

Details:
There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44571.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1
Impact

Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Releases

The fixed releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    2-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.0 series
    2-1-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.1 series
    2-2-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.2 series
    3-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 3.0 series
GitHub Security Advisory: GHSA-93pm-5p5f-3ghx
Package: rack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 2.1.0, < 2.1.4.2
Patched in: 2.1.4.2

Summary: Denial of Service Vulnerability in Rack Content-Disposition parsing

Details:
There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44571.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1
Impact

Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Releases

The fixed releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    2-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.0 series
    2-1-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.1 series
    2-2-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.2 series
    3-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 3.0 series
GitHub Security Advisory: GHSA-93pm-5p5f-3ghx
Package: rack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 2.0.0, < 2.0.9.2
Patched in: 2.0.9.2

Summary: Denial of Service Vulnerability in Rack Content-Disposition parsing

Details:
There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44571.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1
Impact

Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Releases

The fixed releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    2-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.0 series
    2-1-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.1 series
    2-2-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.2 series
    3-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 3.0 series
GitHub Security Advisory: GHSA-rqv2-275x-2jq5
Package: rack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 3.0.0.0, < 3.0.4.1
Patched in: 3.0.4.1

Summary: Denial of service via multipart parsing in Rack

Details:
There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1
Impact

Carefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Releases

The fixed releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    2-0-Forbid-control-characters-in-attributes.patch - Patch for 2.0 series
    2-1-Forbid-control-characters-in-attributes.patch - Patch for 2.1 series
    2-2-Forbid-control-characters-in-attributes.patch - Patch for 2.2 series
    3-0-Forbid-control-characters-in-attributes.patch - Patch for 3.0 series
GitHub Security Advisory: GHSA-rqv2-275x-2jq5
Package: rack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 2.2.0.0, < 2.2.6.1
Patched in: 2.2.6.1

Summary: Denial of service via multipart parsing in Rack

Details:
There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1
Impact

Carefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Releases

The fixed releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    2-0-Forbid-control-characters-in-attributes.patch - Patch for 2.0 series
    2-1-Forbid-control-characters-in-attributes.patch - Patch for 2.1 series
    2-2-Forbid-control-characters-in-attributes.patch - Patch for 2.2 series
    3-0-Forbid-control-characters-in-attributes.patch - Patch for 3.0 series
GitHub Security Advisory: GHSA-rqv2-275x-2jq5
Package: rack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 2.1.0.0, < 2.1.4.2
Patched in: 2.1.4.2

Summary: Denial of service via multipart parsing in Rack

Details:
There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1
Impact

Carefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Releases

The fixed releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    2-0-Forbid-control-characters-in-attributes.patch - Patch for 2.0 series
    2-1-Forbid-control-characters-in-attributes.patch - Patch for 2.1 series
    2-2-Forbid-control-characters-in-attributes.patch - Patch for 2.2 series
    3-0-Forbid-control-characters-in-attributes.patch - Patch for 3.0 series
GitHub Security Advisory: GHSA-rqv2-275x-2jq5
Package: rack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 2.0.0, < 2.0.9.2
Patched in: 2.0.9.2

Summary: Denial of service via multipart parsing in Rack

Details:
There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1
Impact

Carefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Releases

The fixed releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    2-0-Forbid-control-characters-in-attributes.patch - Patch for 2.0 series
    2-1-Forbid-control-characters-in-attributes.patch - Patch for 2.1 series
    2-2-Forbid-control-characters-in-attributes.patch - Patch for 2.2 series
    3-0-Forbid-control-characters-in-attributes.patch - Patch for 3.0 series
GitHub Security Advisory: GHSA-p33q-4h4m-j994
Package: inline_svg (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.7.2
Patched in: 1.7.2

Summary: Inline SVG vulnerable to Cross-site Scripting

Details:
A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file `lib/inline_svg/action_view/helpers.rb` of the component `URL Parameter Handler`. The manipulation of the argument filename leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.7.2 is able to address this issue. The name of the patch is f5363b[PII_REDACTED]21f99e083c92068cf2943621. It is recommended to upgrade the affected component. The identifier VDB-217597 was assigned to this vulnerability.
GitHub Security Advisory: GHSA-399p-vq28-5hg8
Package: keynote (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.0.0
Patched in: 1.0.0

Summary: keynote Cross-site Scripting vulnerability

Details:
A vulnerability was found in rf Keynote up to 0.x. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lib/keynote/rumble.rb. The manipulation of the argument value leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.0.0 can address this issue. The name of the patch is 05be4356b0a6ca7de48da926a9b997beb5ffeb4a. It is recommended to upgrade the affected component. VDB-217142 is the identifier assigned to this vulnerability.
GitHub Security Advisory: GHSA-85gf-wr67-f83w
Package: curupira (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 0.1.4
Patched in: 0.1.4

Summary: curupira is vulnerable to SQL injection

Details:
A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3. Affected is an unknown function of the file app/controllers/curupira/passwords_controller.rb. The manipulation leads to sql injection. Upgrading to version 0.1.4 is able to address this issue. The name of the patch is 93a9a77896bb66c949acb8e64bceafc74bc8c271. It is recommended to upgrade the affected component. VDB-218394 is the identifier assigned to this vulnerability.
GitHub Security Advisory: GHSA-6hvg-62q8-95v7
Package: svg_optimizer (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: = 0.2.6
Patched in: 0.3.0

Summary: svg_optimizer rubygem external XML entity (XXE) vulnerability

Details:
An issue in Fnando svg_optimizer v.0.2.6 allows a remote attacker to escalate privileges when optimizing untrusted SVG content.
GitHub Security Advisory: GHSA-289m-2964-f8q5
Package: bolt (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: < 3.27.4
Patched in: 3.27.4

Summary: Puppet Bolt privilege escalation vulnerability

Details:
In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.
GitHub Security Advisory: GHSA-pchc-949f-53m5
Package: multi_xml (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 0.5.2
Patched in: 0.5.2

Summary: Improper Input Validation in multi_xml

Details:
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.