deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-7w2c-w47h-789w
Package: doorkeeper (RUBYGEMS)
Severity: MODERATE (CVSS 4.2)
CWE: CWE-287: Improper Authentication
Vulnerable versions: < 5.6.6
Patched in: 5.6.6

Summary: Doorkeeper Improper Authentication vulnerability

Details:
OAuth RFC 8252 says  https://www.rfc-editor.org/rfc/rfc8252#section-8.6

> the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. **This includes the case where the user has previously approved an authorization request for a given client id**

But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.

Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589

Fix https://github.com/doorkeeper-gem/doorkeeper/pull/1646
GitHub Security Advisory: GHSA-75w6-p6mg-vh8j
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0, < 3.0.4
Patched in: 3.0.4

Summary: Rails actionpack gem vulnerable to Cross-site Scripting

Details:
Multiple cross-site scripting (XSS) vulnerabilities in the `mail_to` helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
GitHub Security Advisory: GHSA-75w6-p6mg-vh8j
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.3.11
Patched in: 2.3.11

Summary: Rails actionpack gem vulnerable to Cross-site Scripting

Details:
Multiple cross-site scripting (XSS) vulnerabilities in the `mail_to` helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
GitHub Security Advisory: GHSA-fg9w-g6m4-557j
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 2.1.0, < 2.2.3
Patched in: 2.2.3

Summary: actionpack and activesupport vulnerable to information leaks

Details:
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.
GitHub Security Advisory: GHSA-fg9w-g6m4-557j
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 2.3.0, < 2.3.4
Patched in: 2.3.4

Summary: actionpack and activesupport vulnerable to information leaks

Details:
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.
GitHub Security Advisory: GHSA-j4gx-p3x5-m987
Package: echor (RUBYGEMS)
Severity: HIGH (CVSS 7.8)
Vulnerable versions: <= 0.1.6
Patched in: unpatched

Summary: Echor Ruby Gem credentials can be stolen via process table monitoring

Details:
The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table.
GitHub Security Advisory: GHSA-8936-cgj4-phr2
Package: echor (RUBYGEMS)
Severity: HIGH (CVSS 7.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: <= 0.1.6
Patched in: unpatched

Summary: Echor contains Command Injection

Details:
The `perform_request` function in `/lib/echor/backplane.rb` in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi-colon in their username or password.
GitHub Security Advisory: GHSA-x2fm-93ww-ggvx
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: < 1.8.1
Patched in: 1.8.1

Summary: Nokogiri gem, via libxml, is affected by DoS vulnerabilities

Details:
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
GitHub Security Advisory: GHSA-7m2w-9gw7-c3xp
Package: open-uri-cached (RUBYGEMS)
Severity: HIGH (CVSS 7.8)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 1.0.0
Patched in: unpatched

Summary: open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution

Details:
The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a metafile is created.
GitHub Security Advisory: GHSA-7cv3-gvmc-8mq5
Package: passenger (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: >= 5.3.0, < 5.3.2
Patched in: 5.3.2

Summary: Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability

Details:
During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in arbitrary reads and writes, which in turn can result in information disclosure and privilege escalation.
GitHub Security Advisory: GHSA-jjcj-fgfm-9g9r
Package: passenger (RUBYGEMS)
Severity: HIGH (CVSS 7.0)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: >= 3.0.0, < 5.3.2
Patched in: 5.3.2

Summary: Phusion Passenger Race Condition Allows Privilege Escalation

Details:
A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.
GitHub Security Advisory: GHSA-4hm9-844j-jmxp
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: < 1.10.5
Patched in: 1.10.5

Summary: Uninitialized read in Nokogiri gem

Details:
In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.
GitHub Security Advisory: GHSA-whfx-877c-5p28
Package: passenger (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 5.3.0, < 5.3.2
Patched in: 5.3.2

Summary: Insecure Permissions in Phusion Passenger

Details:
An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a Passenger-spawned application process that reports that it listens on a certain Unix domain socket, if any of the parent directories of said socket are writable by a normal user that is not the application's user, then that non-application user can swap that directory with something else, resulting in traffic being redirected to a non-application user's process through an alternative Unix domain socket.
GitHub Security Advisory: GHSA-jjhj-8gx7-x836
Package: passenger (RUBYGEMS)
Severity: HIGH (CVSS 7.8)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: >= 5.3.0, < 5.3.2
Patched in: 5.3.2

Summary: Incorrect Access Control in Phusion Passenger

Details:
An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID.
GitHub Security Advisory: GHSA-mmrq-6999-72v8
Package: openssl (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
Vulnerable versions: < 2.0.9
Patched in: 2.0.9

Summary: Ruby Openssl Allows Incorrect Value Comparison

Details:
An issue was discovered in the OpenSSL library in Ruby when two `OpenSSL::X509::Name` objects are compared using `==`, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of `==` will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.
GitHub Security Advisory: GHSA-xp5h-f8jf-rc8q
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.0.0, < 7.0.4.3
Patched in: 7.0.4.3

Summary: rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements

Details:
NOTE: rails-ujs is part of Rails/actionview since 5.1.0.

There is a potential DOM based cross-site scripting issue in rails-ujs
which leverages the Clipboard API to target HTML elements that are
assigned the contenteditable attribute. This has the potential to
occur when pasting malicious HTML content from the clipboard that
includes a data-method, data-remote or data-disable-with attribute.

This vulnerability has been assigned the CVE identifier CVE-2023-23913.

Not affected: < 5.1.0
Versions Affected: >= 5.1.0
Fixed Versions: 6.1.7.3, 7.0.4.3

Impact
  If the specified malicious HTML clipboard content is provided to a
  contenteditable element, this could result in the arbitrary execution
  of javascript on the origin in question.

Releases
  The FIXED releases are available at the normal locations.

Workarounds
  We recommend that all users upgrade to one of the FIXED versions.
  In the meantime, users can attempt to mitigate this vulnerability
  by removing the contenteditable attribute from elements in pages
  that rails-ujs will interact with.

Patches
  To aid users who aren’t able to upgrade immediately we have provided
  patches for the two supported release series. They are in git-am
  format and consist of a single changeset.

* rails-ujs-data-method-contenteditable-6-1.patch - Patch for 6.1 series
* rails-ujs-data-method-contenteditable-7-0.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are
supported at present, and 6.0.Z for severe vulnerabilities.

Users of earlier unsupported releases are advised to upgrade as
soon as possible as we cannot guarantee the continued availability
of security fixes for unsupported releases.

Credits
  We would like to thank ryotak 15 for reporting this!

* rails-ujs-data-method-contenteditable-6-1.patch (8.5 KB)
* rails-ujs-data-method-contenteditable-7-0.patch (8.5 KB)
* rails-ujs-data-method-contenteditable-main.patch (8.9 KB)
GitHub Security Advisory: GHSA-xp5h-f8jf-rc8q
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.1.0, < 6.1.7.3
Patched in: 6.1.7.3

Summary: rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements

Details:
NOTE: rails-ujs is part of Rails/actionview since 5.1.0.

There is a potential DOM based cross-site scripting issue in rails-ujs
which leverages the Clipboard API to target HTML elements that are
assigned the contenteditable attribute. This has the potential to
occur when pasting malicious HTML content from the clipboard that
includes a data-method, data-remote or data-disable-with attribute.

This vulnerability has been assigned the CVE identifier CVE-2023-23913.

Not affected: < 5.1.0
Versions Affected: >= 5.1.0
Fixed Versions: 6.1.7.3, 7.0.4.3

Impact
  If the specified malicious HTML clipboard content is provided to a
  contenteditable element, this could result in the arbitrary execution
  of javascript on the origin in question.

Releases
  The FIXED releases are available at the normal locations.

Workarounds
  We recommend that all users upgrade to one of the FIXED versions.
  In the meantime, users can attempt to mitigate this vulnerability
  by removing the contenteditable attribute from elements in pages
  that rails-ujs will interact with.

Patches
  To aid users who aren’t able to upgrade immediately we have provided
  patches for the two supported release series. They are in git-am
  format and consist of a single changeset.

* rails-ujs-data-method-contenteditable-6-1.patch - Patch for 6.1 series
* rails-ujs-data-method-contenteditable-7-0.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are
supported at present, and 6.0.Z for severe vulnerabilities.

Users of earlier unsupported releases are advised to upgrade as
soon as possible as we cannot guarantee the continued availability
of security fixes for unsupported releases.

Credits
  We would like to thank ryotak 15 for reporting this!

* rails-ujs-data-method-contenteditable-6-1.patch (8.5 KB)
* rails-ujs-data-method-contenteditable-7-0.patch (8.5 KB)
* rails-ujs-data-method-contenteditable-main.patch (8.9 KB)
GitHub Security Advisory: GHSA-h2wm-p2vg-6pw4
Package: kredis (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 1.3.0.1
Patched in: 1.3.0.1

Summary: Kredis JSON Possible Deserialization of Untrusted Data Vulnerability

Details:
There is a deserialization of untrusted data vulnerability in
the Kredis JSON deserialization code. This vulnerability has
been assigned the CVE identifier CVE-2023-27531.

'Not affected: None.'
'Versions Affected: All.'
'Fixed Versions: 1.3.0.1'

Impact
  Carefully crafted JSON data processed by Kredis may result in
  deserialization of untrusted data, potentially leading to
  deserialization of unexpected objects in the system.

  Any applications using Kredis with JSON are affected.

Releases
  The fixed releases are available at the normal locations.

Workarounds
  There are no feasible workarounds for this issue.

Patches
  To aid users who aren’t able to upgrade immediately we have
  provided patches for the two supported release series. They
  are in git-am format and consist of a single changeset.

  * 1-3-0-1-kredis.patch - Patch for 1.3.0 series

Credits
  Thank you ooooooo_k 7 for reporting this!
GitHub Security Advisory: GHSA-x7rv-cr6v-4vm4
Package: nokogiri (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.8.3
Patched in: 1.8.3

Summary: Cross-site Scripting in loofah

Details:
Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.

Users are affected if running Loofah < 2.2.1, but only:

* when running on MRI or RBX,
* in combination with libxml2 >= 2.9.2.

JRuby users are not affected.
GitHub Security Advisory: GHSA-ggxm-pgc9-g7fp
Package: rdoc (RUBYGEMS)
Severity: HIGH (CVSS 7.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 6.3.0, < 6.3.1
Patched in: 6.3.1

Summary: Arbitrary Code Execution in Rdoc

Details:
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
GitHub Security Advisory: GHSA-ggxm-pgc9-g7fp
Package: rdoc (RUBYGEMS)
Severity: HIGH (CVSS 7.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 6.2.0, < 6.2.1.1
Patched in: 6.2.1.1

Summary: Arbitrary Code Execution in Rdoc

Details:
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
GitHub Security Advisory: GHSA-ggxm-pgc9-g7fp
Package: rdoc (RUBYGEMS)
Severity: HIGH (CVSS 7.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 3.11, < 6.1.2.1
Patched in: 6.1.2.1

Summary: Arbitrary Code Execution in Rdoc

Details:
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
GitHub Security Advisory: GHSA-xrr4-p6fq-hjg7
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 3.2.22.1
Patched in: 3.2.22.1

Summary: Directory traversal vulnerability in Action View in Ruby on Rails

Details:
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a `..` (dot dot) in a pathname.
GitHub Security Advisory: GHSA-xrr4-p6fq-hjg7
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.2.0, <= 4.2.5.0
Patched in: 4.2.5.1

Summary: Directory traversal vulnerability in Action View in Ruby on Rails

Details:
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a `..` (dot dot) in a pathname.
GitHub Security Advisory: GHSA-xrr4-p6fq-hjg7
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.0.0, <= 4.1.14.0
Patched in: 4.1.14.1

Summary: Directory traversal vulnerability in Action View in Ruby on Rails

Details:
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a `..` (dot dot) in a pathname.
GitHub Security Advisory: GHSA-fqfj-cmh6-hj49
Package: ruby-openid (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2.9.0
Patched in: 2.9.0

Summary: ruby-openid SSRF via claimed_id request

Details:
Ruby OpenID (aka ruby-openid) through 2.8.0 is vulnerable to SSRF. Ruby-openid performs discovery first, and then verification. This allows an attacker to change the URL used for discovery and trick the server into connecting to the URL, which might be a private server not publicly accessible. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the "example app" provided by the project are at highest risk.
GitHub Security Advisory: GHSA-vx9j-46rh-fqr8
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.0.0, <= 4.1.14.1
Patched in: 4.1.14.2

Summary: actionview contains Path Traversal vulnerability

Details:
There is a possible directory traversal and information leak vulnerability in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 patch was not covering all possible scenarios. This vulnerability has been assigned the CVE identifier CVE-2016-2097.

Versions Affected:  3.2.x, 4.0.x, 4.1.x
Not affected:       4.2+
Fixed Versions:     3.2.22.2, 4.1.14.2

Impact
------
Applications that pass unverified user input to the `render` method in a controller may be vulnerable to an information leak vulnerability.

Impacted code will look something like this:

```ruby
def index
  render params[:id]
end
```

Carefully crafted requests can cause the above code to render files from unexpected places like outside the application's view directory, and can possibly escalate this to a remote code execution attack.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
A workaround to this issue is to not pass arbitrary user input to the `render` method. Instead, verify that data before passing it to the `render` method.

For example, change this:

```ruby
def index
  render params[:id]
end
```

To this:

```ruby
def index
  render verify_template(params[:id])
end

private
def verify_template(name)
  # add verification logic particular to your application here
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for it. It is in git-am format and consist of a single changeset.

* 3-2-render_data_leak_2.patch - Patch for 3.2 series
* 4-1-render_data_leak_2.patch - Patch for 4.1 series

Credits
-------
Thanks to both Jyoti Singh and Tobias Kraze from makandra for reporting this and working with us in the patch!