deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-8cgq-6mh2-7j6v
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection'), CWE-117: Improper Output Neutralization for Logs
Vulnerable versions: >= 3.1, < 3.1.11
Patched in: 3.1.11

Summary: Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

Details:
## Summary

`Rack::Sendfile` can be exploited by crafting input that includes newline characters to manipulate log entries.

## Details

The `Rack::Sendfile` middleware logs unsanitized header values from the `X-Sendfile-Type` header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection.

## Impact

This vulnerability can distort log files, obscure attack traces, and complicate security auditing.

## Mitigation

- Update to the latest version of Rack, or
- Remove usage of `Rack::Sendfile`.
GitHub Security Advisory: GHSA-8cgq-6mh2-7j6v
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection'), CWE-117: Improper Output Neutralization for Logs
Vulnerable versions: >= 3.0, < 3.0.13
Patched in: 3.0.13

Summary: Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

Details:
## Summary

`Rack::Sendfile` can be exploited by crafting input that includes newline characters to manipulate log entries.

## Details

The `Rack::Sendfile` middleware logs unsanitized header values from the `X-Sendfile-Type` header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection.

## Impact

This vulnerability can distort log files, obscure attack traces, and complicate security auditing.

## Mitigation

- Update to the latest version of Rack, or
- Remove usage of `Rack::Sendfile`.
GitHub Security Advisory: GHSA-8cgq-6mh2-7j6v
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection'), CWE-117: Improper Output Neutralization for Logs
Vulnerable versions: < 2.2.12
Patched in: 2.2.12

Summary: Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

Details:
## Summary

`Rack::Sendfile` can be exploited by crafting input that includes newline characters to manipulate log entries.

## Details

The `Rack::Sendfile` middleware logs unsanitized header values from the `X-Sendfile-Type` header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection.

## Impact

This vulnerability can distort log files, obscure attack traces, and complicate security auditing.

## Mitigation

- Update to the latest version of Rack, or
- Remove usage of `Rack::Sendfile`.
GitHub Security Advisory: GHSA-22h5-pq3x-2gf2
Package: uri (RUBYGEMS)
Severity: LOW (CVSS 3.2)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
Vulnerable versions: >= 1.0.0, < 1.0.3
Patched in: 1.0.3

Summary: URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+

Details:
There is a possibility for userinfo leakage by in the uri gem.
This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem.

## Details

The methods `URI#join`, `URI#merge`, and `URI#+` retained userinfo, such as `user:password`, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur.

Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later.

## Affected versions

uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2.

## Credits

Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue.
Also thanks to nobu for additional fixes of this vulnerability.
GitHub Security Advisory: GHSA-22h5-pq3x-2gf2
Package: uri (RUBYGEMS)
Severity: LOW (CVSS 3.2)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
Vulnerable versions: >= 0.13.0, < 0.13.2
Patched in: 0.13.2

Summary: URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+

Details:
There is a possibility for userinfo leakage by in the uri gem.
This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem.

## Details

The methods `URI#join`, `URI#merge`, and `URI#+` retained userinfo, such as `user:password`, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur.

Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later.

## Affected versions

uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2.

## Credits

Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue.
Also thanks to nobu for additional fixes of this vulnerability.
GitHub Security Advisory: GHSA-22h5-pq3x-2gf2
Package: uri (RUBYGEMS)
Severity: LOW (CVSS 3.2)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
Vulnerable versions: >= 0.12.0, < 0.12.4
Patched in: 0.12.4

Summary: URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+

Details:
There is a possibility for userinfo leakage by in the uri gem.
This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem.

## Details

The methods `URI#join`, `URI#merge`, and `URI#+` retained userinfo, such as `user:password`, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur.

Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later.

## Affected versions

uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2.

## Credits

Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue.
Also thanks to nobu for additional fixes of this vulnerability.
GitHub Security Advisory: GHSA-22h5-pq3x-2gf2
Package: uri (RUBYGEMS)
Severity: LOW (CVSS 3.2)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
Vulnerable versions: < 0.11.3
Patched in: 0.11.3

Summary: URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+

Details:
There is a possibility for userinfo leakage by in the uri gem.
This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem.

## Details

The methods `URI#join`, `URI#merge`, and `URI#+` retained userinfo, such as `user:password`, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur.

Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later.

## Affected versions

uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2.

## Credits

Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue.
Also thanks to nobu for additional fixes of this vulnerability.
GitHub Security Advisory: GHSA-mhwm-jh88-3gjf
Package: cgi (RUBYGEMS)
Severity: MODERATE (CVSS 4.0)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 0.4.0, < 0.4.2
Patched in: 0.4.2

Summary: CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement

Details:
There is a possibility for Regular expression Denial of Service (ReDoS) by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27220. We recommend upgrading the cgi gem.

## Details

The regular expression used in `CGI::Util#escapeElement` is vulnerable to ReDoS. The crafted input could lead to a high CPU consumption.

This vulnerability only affects Ruby 3.1 and 3.2. If you are using these versions, please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.

## Affected versions

cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.

## Credits

Thanks to svalkanov for discovering this issue.
Also thanks to nobu for fixing this vulnerability.
GitHub Security Advisory: GHSA-mhwm-jh88-3gjf
Package: cgi (RUBYGEMS)
Severity: MODERATE (CVSS 4.0)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: = 0.3.6
Patched in: 0.3.7

Summary: CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement

Details:
There is a possibility for Regular expression Denial of Service (ReDoS) by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27220. We recommend upgrading the cgi gem.

## Details

The regular expression used in `CGI::Util#escapeElement` is vulnerable to ReDoS. The crafted input could lead to a high CPU consumption.

This vulnerability only affects Ruby 3.1 and 3.2. If you are using these versions, please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.

## Affected versions

cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.

## Credits

Thanks to svalkanov for discovering this issue.
Also thanks to nobu for fixing this vulnerability.
GitHub Security Advisory: GHSA-mhwm-jh88-3gjf
Package: cgi (RUBYGEMS)
Severity: MODERATE (CVSS 4.0)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 0.3.5.1
Patched in: 0.3.5.1

Summary: CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement

Details:
There is a possibility for Regular expression Denial of Service (ReDoS) by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27220. We recommend upgrading the cgi gem.

## Details

The regular expression used in `CGI::Util#escapeElement` is vulnerable to ReDoS. The crafted input could lead to a high CPU consumption.

This vulnerability only affects Ruby 3.1 and 3.2. If you are using these versions, please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.

## Affected versions

cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.

## Credits

Thanks to svalkanov for discovering this issue.
Also thanks to nobu for fixing this vulnerability.
GitHub Security Advisory: GHSA-gh9q-2xrm-x6qv
Package: cgi (RUBYGEMS)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 0.4.0, < 0.4.2
Patched in: 0.4.2

Summary: CGI has Denial of Service (DoS) potential in Cookie.parse

Details:
There is a possibility for DoS by in the cgi gem.
This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem.

## Details

CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service.

Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.

## Affected versions

cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.

## Credits

Thanks to lio346 for discovering this issue.
Also thanks to mame for fixing this vulnerability.
GitHub Security Advisory: GHSA-gh9q-2xrm-x6qv
Package: cgi (RUBYGEMS)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: = 0.3.6
Patched in: 0.3.7

Summary: CGI has Denial of Service (DoS) potential in Cookie.parse

Details:
There is a possibility for DoS by in the cgi gem.
This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem.

## Details

CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service.

Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.

## Affected versions

cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.

## Credits

Thanks to lio346 for discovering this issue.
Also thanks to mame for fixing this vulnerability.
GitHub Security Advisory: GHSA-gh9q-2xrm-x6qv
Package: cgi (RUBYGEMS)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 0.3.5.1
Patched in: 0.3.5.1

Summary: CGI has Denial of Service (DoS) potential in Cookie.parse

Details:
There is a possibility for DoS by in the cgi gem.
This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem.

## Details

CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service.

Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.

## Affected versions

cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.

## Credits

Thanks to lio346 for discovering this issue.
Also thanks to mame for fixing this vulnerability.
GitHub Security Advisory: GHSA-jx6p-9c26-g373
Package: oxidized-web (RUBYGEMS)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 0.15.0
Patched in: 0.15.0

Summary: Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account

Details:
In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web.
GitHub Security Advisory: GHSA-2cj2-qqxj-5m3r
Package: passenger (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: >= 6.0.21, < 6.0.26
Patched in: 6.0.26

Summary: Phusion Passenger denial of service 

Details:
The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.
GitHub Security Advisory: GHSA-5mwf-688x-mr7x
Package: nokogiri (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: < 1.18.3
Patched in: 1.18.3

Summary: Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

Details:
# Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vvfq-8hwr-qm4m. This link is maintained to preserve external references.

# Original Description

## Summary

Nokogiri v1.18.3 upgrades its dependency libxml2 to
[v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).

libxml2 v2.13.6 addresses:

- CVE-2025-24928
  - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847
- CVE-2024-56171
   - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828

## Impact

### CVE-2025-24928

Stack-buffer overflow is possible when reporting DTD validation
errors if the input contains a long (~3kb) QName prefix.

### CVE-2024-56171

Use-after-free is possible during validation against untrusted
XML Schemas (.xsd) and, potentially, validation of untrusted documents
against trusted Schemas if they make use of `xsd:keyref` in combination
with recursively defined types that have additional identity constraints.
GitHub Security Advisory: GHSA-vvfq-8hwr-qm4m
Package: nokogiri (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-121: Stack-based Buffer Overflow, CWE-416: Use After Free, CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: < 1.18.3
Patched in: 1.18.3

Summary: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

Details:
## Summary

Nokogiri v1.18.3 upgrades its dependency libxml2 to [v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).

libxml2 v2.13.6 addresses:

- CVE-2025-24928
  - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847
- CVE-2024-56171
   - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828

## Impact

### CVE-2025-24928

Stack-buffer overflow is possible when reporting DTD validation errors if the input contains a long (~3kb) QName prefix.

### CVE-2024-56171

Use-after-free is possible during validation against untrusted XML Schemas (.xsd) and, potentially, validation of untrusted documents against trusted Schemas if they make use of `xsd:keyref` in combination with recursively defined types that have additional identity constraints.
GitHub Security Advisory: GHSA-7g2v-jj9q-g3rg
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection'), CWE-117: Improper Output Neutralization for Logs
Vulnerable versions: >= 3.1, < 3.1.10
Patched in: 3.1.10

Summary: Possible Log Injection in Rack::CommonLogger

Details:
## Summary

`Rack::CommonLogger` can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs.

## Details

When a user provides the authorization credentials via `Rack::Auth::Basic`, if success, the username will be put in `env['REMOTE_USER']` and later be used by `Rack::CommonLogger` for logging purposes.

The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile.

## Impact

Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files.

## Mitigation

- Update to the latest version of Rack.
GitHub Security Advisory: GHSA-7g2v-jj9q-g3rg
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection'), CWE-117: Improper Output Neutralization for Logs
Vulnerable versions: >= 3.0, < 3.0.12
Patched in: 3.0.12

Summary: Possible Log Injection in Rack::CommonLogger

Details:
## Summary

`Rack::CommonLogger` can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs.

## Details

When a user provides the authorization credentials via `Rack::Auth::Basic`, if success, the username will be put in `env['REMOTE_USER']` and later be used by `Rack::CommonLogger` for logging purposes.

The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile.

## Impact

Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files.

## Mitigation

- Update to the latest version of Rack.
GitHub Security Advisory: GHSA-7g2v-jj9q-g3rg
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection'), CWE-117: Improper Output Neutralization for Logs
Vulnerable versions: < 2.2.11
Patched in: 2.2.11

Summary: Possible Log Injection in Rack::CommonLogger

Details:
## Summary

`Rack::CommonLogger` can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs.

## Details

When a user provides the authorization credentials via `Rack::Auth::Basic`, if success, the username will be put in `env['REMOTE_USER']` and later be used by `Rack::CommonLogger` for logging purposes.

The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile.

## Impact

Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files.

## Mitigation

- Update to the latest version of Rack.
GitHub Security Advisory: GHSA-hgpp-pp89-4fgf
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 2.3.16
Patched in: 2.3.16

Summary: Action Pack contains database-query restrictions bypass

Details:
`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain `[nil]` values, a related issue to CVE-2012-2694.
GitHub Security Advisory: GHSA-hgpp-pp89-4fgf
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 3.0.0.beta, < 3.0.13
Patched in: 3.0.13

Summary: Action Pack contains database-query restrictions bypass

Details:
`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain `[nil]` values, a related issue to CVE-2012-2694.
GitHub Security Advisory: GHSA-92w9-2pqw-rhjj
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-287: Improper Authentication
Vulnerable versions: < 2.3.5
Patched in: 2.3.5

Summary: actionpack Improper Authentication vulnerability

Details:
The `decode_credentials` method in `actionpack/lib/action_controller/metal/http_authentication.rb` in Ruby on Rails before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a `with_http_digest` helper method, as demonstrated by the `authenticate_or_request_with_http_digest` method.
GitHub Security Advisory: GHSA-92w9-2pqw-rhjj
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 3.0.0.beta, < 3.0.16
Patched in: 3.0.16

Summary: actionpack Improper Authentication vulnerability

Details:
The `decode_credentials` method in `actionpack/lib/action_controller/metal/http_authentication.rb` in Ruby on Rails before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a `with_http_digest` helper method, as demonstrated by the `authenticate_or_request_with_http_digest` method.
GitHub Security Advisory: GHSA-gh2w-j7cx-2664
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 2.3.15
Patched in: 2.3.15

Summary: Active Record contains SQL Injection

Details:
SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.