deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-4whf-rmx5-8frv
Package: active_attr (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: < 0.15.4
Patched in: 0.15.4

Summary: active_attr Improper Resource Shutdown or Release vulnerability

Details:
A vulnerability classified as problematic has been found in cgriego active_attr up to 0.15.3. This affects the function call of the file lib/active_attr/typecasting/boolean_typecaster.rb of the component Regex Handler. The manipulation of the argument value leads to denial of service. The exploit has been disclosed to the public and may be used. Upgrading to version 0.15.4 can address this issue. The name of the patch is dab95e5843b01525444b82bd7b336ef1d79377df. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216207.
GitHub Security Advisory: GHSA-74hc-57m5-83ch
Package: text_helpers (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-266: Incorrect Privilege Assignment, CWE-1022: Use of Web Link to Untrusted Target with window.opener Access
Vulnerable versions: >= 1.1.0, < 1.2.0
Patched in: 1.2.0

Summary: text_helpers uses web link to untrusted target with window.opener access

Details:
A vulnerability was found in ahorner text-helpers 1.1.0/1.1.1. This vulnerability affects unknown code of the file lib/text_helpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with window.opener access. The attack can be initiated remotely. Upgrading to version 1.2.0 can address this issue. The name of the patch is 184b60ded0e43c985788582aca2d1e746f9405a3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216520.
GitHub Security Advisory: GHSA-rrfc-7g8p-99q8
Package: rails-html-sanitizer (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.4.4
Patched in: 1.4.4

Summary: Possible XSS vulnerability with certain configurations of rails-html-sanitizer

Details:
## Summary

There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. This is due to an incomplete fix of CVE-2022-32209.

- Versions affected: ALL
- Not affected: NONE
- Fixed versions: 1.4.4


## Impact

A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both "select" and "style" elements.

Code is only impacted if allowed tags are being overridden using either of the following two mechanisms:

1. Using the Rails configuration `config.action_view.sanitized_allow_tags=`:

  ```ruby
  # In config/application.rb
  config.action_view.sanitized_allowed_tags = ["select", "style"]
  ```

  (see https://guides.rubyonrails.org/configuring.html#configuring-action-view)

2. Using the class method `Rails::Html::SafeListSanitizer.allowed_tags=`:

  ```ruby
  # class-level option
  Rails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]
  ```

All users overriding the allowed tags by either of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately.

NOTE: Code is _not_ impacted if allowed tags are overridden using either of the following mechanisms:

- the `:tags` option to the Action View helper method `sanitize`.
- the `:tags` option to the instance method `SafeListSanitizer#sanitize`.


## Workarounds

Remove either "select" or "style" from the overridden allowed tags.


## References

- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32209
- https://hackerone.com/reports/1654310


## Credit

This vulnerability was responsibly reported by Dominic Breuker.
GitHub Security Advisory: GHSA-9h9g-93gc-623h
Package: rails-html-sanitizer (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.4.4
Patched in: 1.4.4

Summary: Possible XSS vulnerability with certain configurations of rails-html-sanitizer

Details:
## Summary

There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

- Versions affected: ALL
- Not affected: NONE
- Fixed versions: 1.4.4


## Impact

A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways:

- allow both "math" and "style" elements,
- or allow both "svg" and "style" elements

Code is only impacted if allowed tags are being overridden. Applications may be doing this in four different ways:

1. using application configuration:

  ```ruby
  # In config/application.rb
  config.action_view.sanitized_allowed_tags = ["math", "style"]
  # or
  config.action_view.sanitized_allowed_tags = ["svg", "style"]
  ```

  see https://guides.rubyonrails.org/configuring.html#configuring-action-view

2. using a `:tags` option to the Action View helper `sanitize`:

  ```
  <%= sanitize @comment.body, tags: ["math", "style"] %>
  <%# or %>
  <%= sanitize @comment.body, tags: ["svg", "style"] %>
  ```

  see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize

3. using Rails::Html::SafeListSanitizer class method `allowed_tags=`:

  ```ruby
  # class-level option
  Rails::Html::SafeListSanitizer.allowed_tags = ["math", "style"]
  # or
  Rails::Html::SafeListSanitizer.allowed_tags = ["svg", "style"]
  ```

4. using a `:tags` options to the Rails::Html::SafeListSanitizer instance method `sanitize`:

  ```ruby
  # instance-level option
  Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", "style"])
  # or
  Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["svg", "style"])
  ```

All users overriding the allowed tags by any of the above mechanisms to include (("math" or "svg") and "style") should either upgrade or use one of the workarounds immediately.


## Workarounds

Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.


## References

- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
- https://hackerone.com/reports/1656627


## Credit

This vulnerability was responsibly reported by Dominic Breuker.
GitHub Security Advisory: GHSA-mcvf-2q2m-x72m
Package: rails-html-sanitizer (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.0.3, < 1.4.4
Patched in: 1.4.4

Summary: Improper neutralization of data URIs may allow XSS in rails-html-sanitizer

Details:
## Summary

rails-html-sanitizer `>= 1.0.3, < 1.4.4` is vulnerable to cross-site scripting via data URIs when used in combination with Loofah `>= 2.1.0`.


## Mitigation

Upgrade to rails-html-sanitizer `>= 1.4.4`.


## Severity

The maintainers have evaluated this as [Medium Severity 6.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).


## References

- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
- [SVG MIME Type (image/svg+xml) is misleading to developers · Issue #266 · w3c/svgwg](https://github.com/w3c/svgwg/issues/266)
- https://github.com/rails/rails-html-sanitizer/issues/135
- https://hackerone.com/reports/1694173


## Credit

This vulnerability was independently reported by Maciej Piechota (@haqpl) and Mrinmoy Das (@goromlagche).
GitHub Security Advisory: GHSA-2x8x-jmrp-phxw
Package: sinatra (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-494: Download of Code Without Integrity Check
Vulnerable versions: >= 2.0.0, < 2.2.3
Patched in: 2.2.3

Summary: Sinatra vulnerable to Reflected File Download attack

Details:
### Description
An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input.

### References
* https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf
* https://github.com/advisories/GHSA-8x94-hmjh-97hq
GitHub Security Advisory: GHSA-qv4q-mr5r-qprj
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-252: Unchecked Return Value, CWE-476: NULL Pointer Dereference
Vulnerable versions: >= 1.13.8, < 1.13.10
Patched in: 1.13.10

Summary: Unchecked return value from xmlTextReaderExpand

Details:
## Summary

Nokogiri `1.13.8, 1.13.9` fails to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed. 

For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack.


## Mitigation

Upgrade to Nokogiri `>= 1.13.10`.

Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected.


## Severity

The Nokogiri maintainers have evaluated this as [High Severity 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).


## References

- [CWE - CWE-252: Unchecked Return Value (4.9)](https://cwe.mitre.org/data/definitions/252.html)
- [CWE - CWE-476: NULL Pointer Dereference (4.9)](https://cwe.mitre.org/data/definitions/476.html)


## Credit

This vulnerability was responsibly reported by @davidwilemski.
GitHub Security Advisory: GHSA-2x8x-jmrp-phxw
Package: sinatra (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-494: Download of Code Without Integrity Check
Vulnerable versions: >= 3.0, < 3.0.4
Patched in: 3.0.4

Summary: Sinatra vulnerable to Reflected File Download attack

Details:
### Description
An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input.

### References
* https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf
* https://github.com/advisories/GHSA-8x94-hmjh-97hq
GitHub Security Advisory: GHSA-3xg8-cc8f-9wv2
Package: dalli (RUBYGEMS)
Severity: LOW (CVSS 3.7)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: < 3.2.3
Patched in: 3.2.3

Summary: Unsanitized input leading to code injection in Dalli

Details:
A vulnerability was found in Dalli. Affected is the function self.meta_set of the file lib/dalli/protocol/meta/request_formatter.rb of the component Meta Protocol Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The name of the patch is 48d594dae55934476fec61789e7a7c3700e0f50d. It is recommended to apply a patch to fix this issue.
GitHub Security Advisory: GHSA-rhwx-hjx2-x4qr
Package: pdfkit (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: < 0.8.7.2
Patched in: 0.8.7.2

Summary: PDFKit vulnerable to Command Injection

Details:
The package pdfkit is vulnerable to Command Injection where the URL is not properly sanitized.

Note: This issue was patched in 0.8.7.2, but the patch was discovered to be ineffective. The updated patch version is 0.8.7.2.
GitHub Security Advisory: GHSA-fppq-mj76-fpj2
Package: fluentd (RUBYGEMS)
Severity: LOW (CVSS 3.1)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 1.13.2, < 1.15.3
Patched in: 1.15.3

Summary: fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)

Details:
### Impact
A remote code execution (RCE) vulnerability in non-default configurations of Fluentd  allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads.

Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`.

Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability.

### Patches
v1.15.3

### Workarounds
Do not use `FLUENT_OJ_OPTION_MODE=object`.

### References

* GHSL-2022-067
GitHub Security Advisory: GHSA-9chr-4fjh-5rgw
Package: actionpack (RUBYGEMS)
Severity: LOW (CVSS 3.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-707: Improper Neutralization
Vulnerable versions: <= 7.0.4
Patched in: unpatched

Summary: Cross-site Scripting in actionpack

Details:
actionpack from the Ruby on Rails project is vulnerable to Cross-site Scripting in the Route Error Page. This issue has been patched with this [commit](https://github.com/rails/rails/commit/be177e4566747b73ff63fd5f529fab564e475ed4). 

This vulnerability is disputed by the Rails security team. It requires that the developer is tricked into copy pasting a malicious javascript-containing string into a development-only error page accessible only via localhost.
GitHub Security Advisory: GHSA-p75c-5x3h-cxcg
Package: fat_free_crm (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 0.20.1
Patched in: 0.20.1

Summary: Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint

Details:
### Impact
An authenticated user can perform a remote Denial of Service attack against Fat Free CRM.

This vulnerability has been assigned the CVE identifier: CVE-2022-39281

Affected versions: All
Not affected: None
Fixed versions: 0.20.1

All users running an affected release should either upgrade or apply the patch immediately.

### Releases
Fixed versions: 0.20.1 and above

### Patches

If you are unable to upgrade immediately, you should apply the following patch.

```
diff --git a/app/models/polymorphic/task.rb b/app/models/polymorphic/task.rb
index d3d5c32c..7cdb24d6 100644
--- a/app/models/polymorphic/task.rb
+++ b/app/models/polymorphic/task.rb
@@ -189,6 +189,7 @@ class Task < ActiveRecord::Base
   #----------------------------------------------------------------------------
   def self.bucket_empty?(bucket, user, view = "pending")
     return false if bucket.blank? || !ALLOWED_VIEWS.include?(view)
+    return false unless Setting.task_bucket.map(&:to_s).include?(bucket.to_s)

     if view == "assigned"
       assigned_by(user).send(bucket).pending.count
```

### Credits

Thanks to @p- for reporting this and working with us to responsibly disclose this vulnerability.

### Further information
If you have any questions or comments about this advisory, please Open an issue in [GitHub Issue Tracker](https://github.com/fatfreecrm/fat_free_crm/issues)
GitHub Security Advisory: GHSA-jxhc-q857-3j6g
Package: addressable (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 2.3.0, <= 2.7.0
Patched in: 2.8.0

Summary: Regular Expression Denial of Service in Addressable templates

Details:
### Impact

Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected.

### Patches

The vulnerability was introduced in version 2.3.0 (previously yanked) and has been present in all subsequent versions up to, and including, 2.7.0. It is fixed in version 2.8.0.

### Workarounds

The vulnerability can be avoided by only creating Template objects from trusted sources that have been validated not to produce catastrophic backtracking.

### References

- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
- https://cwe.mitre.org/data/definitions/1333.html
- https://www.regular-expressions.info/catastrophic.html

### For more information
If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/sporkmonger/addressable/issues)
GitHub Security Advisory: GHSA-h4h5-3hr4-j3g2
Package: google-protobuf (RUBYGEMS)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 3.16.3
Patched in: 3.16.3

Summary: protobuf-java has a potential Denial of Service issue

Details:
## Summary
A potential Denial of Service issue in `protobuf-java` core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated [embedded messages](http://developers.google.com/protocol-buffers/docs/encoding#embedded) with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. 

Reporter: [OSS Fuzz](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771)

Affected versions: This issue affects both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

## Severity

[CVE-2022-3171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3171) Medium - CVSS Score: 5.7 (NOTE: there may be a delay in publication)

## Remediation and Mitigation

Please update to the latest available versions of the following packages:

protobuf-java (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-javalite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-kotlin (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-kotlin-lite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
google-protobuf [JRuby gem only] (3.21.7, 3.20.3, 3.19.6)
GitHub Security Advisory: GHSA-h4h5-3hr4-j3g2
Package: google-protobuf (RUBYGEMS)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 3.17.0.rc.1, < 3.19.6
Patched in: 3.19.6

Summary: protobuf-java has a potential Denial of Service issue

Details:
## Summary
A potential Denial of Service issue in `protobuf-java` core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated [embedded messages](http://developers.google.com/protocol-buffers/docs/encoding#embedded) with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. 

Reporter: [OSS Fuzz](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771)

Affected versions: This issue affects both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

## Severity

[CVE-2022-3171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3171) Medium - CVSS Score: 5.7 (NOTE: there may be a delay in publication)

## Remediation and Mitigation

Please update to the latest available versions of the following packages:

protobuf-java (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-javalite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-kotlin (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-kotlin-lite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
google-protobuf [JRuby gem only] (3.21.7, 3.20.3, 3.19.6)
GitHub Security Advisory: GHSA-h4h5-3hr4-j3g2
Package: google-protobuf (RUBYGEMS)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 3.20.0.rc.1, < 3.20.3
Patched in: 3.20.3

Summary: protobuf-java has a potential Denial of Service issue

Details:
## Summary
A potential Denial of Service issue in `protobuf-java` core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated [embedded messages](http://developers.google.com/protocol-buffers/docs/encoding#embedded) with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. 

Reporter: [OSS Fuzz](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771)

Affected versions: This issue affects both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

## Severity

[CVE-2022-3171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3171) Medium - CVSS Score: 5.7 (NOTE: there may be a delay in publication)

## Remediation and Mitigation

Please update to the latest available versions of the following packages:

protobuf-java (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-javalite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-kotlin (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-kotlin-lite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
google-protobuf [JRuby gem only] (3.21.7, 3.20.3, 3.19.6)
GitHub Security Advisory: GHSA-h4h5-3hr4-j3g2
Package: google-protobuf (RUBYGEMS)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 3.21.0.rc.1, < 3.21.7
Patched in: 3.21.7

Summary: protobuf-java has a potential Denial of Service issue

Details:
## Summary
A potential Denial of Service issue in `protobuf-java` core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated [embedded messages](http://developers.google.com/protocol-buffers/docs/encoding#embedded) with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. 

Reporter: [OSS Fuzz](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771)

Affected versions: This issue affects both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

## Severity

[CVE-2022-3171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3171) Medium - CVSS Score: 5.7 (NOTE: there may be a delay in publication)

## Remediation and Mitigation

Please update to the latest available versions of the following packages:

protobuf-java (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-javalite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-kotlin (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-kotlin-lite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
google-protobuf [JRuby gem only] (3.21.7, 3.20.3, 3.19.6)
GitHub Security Advisory: GHSA-cj43-9h3w-v976
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 3.2.0, < 3.2.4
Patched in: 3.2.4

Summary: Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service

Details:
Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service.  NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.