deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-c6qr-h5vq-59jc
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 6.0.0, <= 6.0.3.1
Patched in: 6.0.3.2

Summary: Untrusted users can run pending migrations in production in Rails

Details:
There is a vulnerability in versions of Rails prior to 6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.

This vulnerability has been assigned the CVE identifier CVE-2020-8185.

Versions Affected:  6.0.0 < rails < 6.0.3.2
Not affected:       Applications with `config.action_dispatch.show_exceptions = false` (this is not a default setting in production)
Fixed Versions:     rails >= 6.0.3.2

Impact
------

Using this issue, an attacker would be able to execute any migrations that are pending for a Rails app running in production mode. It is important to note that an attacker is limited to running migrations the application developer has already defined in their application and ones that have not already run.

Workarounds
-----------

Until such time as the patch can be applied, application developers should disable the ActionDispatch middleware in their production environment via a line such as this one in their config/environment/production.rb:

`config.middleware.delete ActionDispatch::ActionableExceptions`
GitHub Security Advisory: GHSA-p4x4-rw2p-8j8m
Package: sanitize (RUBYGEMS)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0, < 5.2.1
Patched in: 5.2.1

Summary: Cross-site Scripting in Sanitize 

Details:
When HTML is sanitized using Sanitize's "relaxed" config or a custom config that allows certain elements, some content in a `<math>` or `<svg>` element may not be sanitized correctly even if `math` and `svg` are not in the allowlist.

You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements:

- `iframe`
- `math`
- `noembed`
- `noframes`
- `noscript`
- `plaintext`
- `script`
- `style`
- `svg`
- `xmp`

### Impact

Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser.

### Releases

This problem has been fixed in Sanitize 5.2.1.

### Workarounds

If upgrading is not possible, a workaround is to override the default value of Sanitize's `:remove_contents` config option with the following value, which ensures that the contents of `math` and `svg` elements (among others) are removed entirely when those elements are not in the allowlist:

```ruby
%w[iframe math noembed noframes noscript plaintext script style svg xmp]
```

For example, if you currently use Sanitize's relaxed config, you can create a custom config object that overrides the default value of `:remove_contents` like this:

```ruby
custom_config = Sanitize::Config.merge(
  Sanitize::Config::RELAXED,
  :remove_contents => %w[iframe math noembed noframes noscript plaintext script style svg xmp]
)
```

You would then pass this custom config to Sanitize when sanitizing HTML.

### For more information

If you have any questions or comments about this advisory:

- Open an issue in the [Sanitize repo](https://github.com/rgrove/sanitize).
- See Sanitize's [security policy](https://github.com/rgrove/sanitize/security/policy).

### Credits

Many thanks to Michal Bentkowski of Securitum for reporting this bug and helping to verify the fix.

### References

- [GHSA-p4x4-rw2p-8j8m](https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m)
- [CVE-2020-4054](https://nvd.nist.gov/vuln/detail/CVE-2020-4054)
- https://github.com/rgrove/sanitize/releases/tag/v5.2.1
GitHub Security Advisory: GHSA-864j-6qpp-cmrr
Package: geocoder (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 1.6.1
Patched in: 1.6.1

Summary: SQL Injection in Geocoder

Details:
sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when `within_bounding_box` is used in conjunction with untrusted `sw_lat`, `sw_lng`, `ne_lat`, or `ne_lng` data.
GitHub Security Advisory: GHSA-g6wq-qcwm-j5g2
Package: websocket-extensions (RUBYGEMS)
Severity: HIGH (CVSS 8.2)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 0.1.5
Patched in: 0.1.5

Summary: Regular Expression Denial of Service in websocket-extensions (RubyGem)

Details:
### Impact

The ReDoS flaw allows an attacker to exhaust the server's capacity to process incoming requests by sending a WebSocket handshake request containing a header of the following form:

    Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...

That is, a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. The parser takes exponential time to reject this header as invalid, and this will block the processing of any other work on the same thread. Thus if you are running a single-threaded server, such a request can render your service completely unavailable.

### Patches

Users should upgrade to version 0.1.5.

### Workarounds

There are no known work-arounds other than disabling any public-facing WebSocket functionality you are operating.

### References

- https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/
GitHub Security Advisory: GHSA-r5jw-62xg-j433
Package: kaminari (RUBYGEMS)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.2.1
Patched in: 1.2.1

Summary: Cross-Site Scripting in Kaminari

Details:
### Impact
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

### Releases
The 1.2.1 gem including the patch has already been released.
All past released versions are affected by this vulnerability.

### Workarounds
Application developers who can't update the gem can workaround by overriding the `PARAM_KEY_EXCEPT_LIST` constant.

```ruby
module Kaminari::Helpers
  PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
end
```

### Credits
Thanks to Daniel Mircea for finding the issue and sending a patch via GitHub. Also thanks to Aditya Prakash for reporting the vulnerability.
GitHub Security Advisory: GHSA-m42x-37p3-fv5w
Package: activestorage (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type, CWE-602: Client-Side Enforcement of Server-Side Security
Vulnerable versions: >= 6.0.0, <= 6.0.3
Patched in: 6.0.3.1

Summary: Circumvention of file size limits in ActiveStorage

Details:
There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user.

Versions Affected:  rails < 5.2.4.2, rails < 6.0.3.1
Not affected:       Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter.
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------

Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be used to bypass controls in place on the server to limit upload size.

Workarounds
-----------

This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.
GitHub Security Advisory: GHSA-m42x-37p3-fv5w
Package: activestorage (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type, CWE-602: Client-Side Enforcement of Server-Side Security
Vulnerable versions: >= 5.0.0, <= 5.2.4.2
Patched in: 5.2.4.3

Summary: Circumvention of file size limits in ActiveStorage

Details:
There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user.

Versions Affected:  rails < 5.2.4.2, rails < 6.0.3.1
Not affected:       Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter.
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------

Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be used to bypass controls in place on the server to limit upload size.

Workarounds
-----------

This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.
GitHub Security Advisory: GHSA-w64w-qqph-5gxm
Package: puma (RUBYGEMS)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: >= 4.0.0, < 4.3.5
Patched in: 4.3.5

Summary: HTTP Smuggling via Transfer-Encoding Header in Puma

Details:
### Impact
This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4.

A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. 

If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.

### Patches

The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
GitHub Security Advisory: GHSA-w64w-qqph-5gxm
Package: puma (RUBYGEMS)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: < 3.12.6
Patched in: 3.12.6

Summary: HTTP Smuggling via Transfer-Encoding Header in Puma

Details:
### Impact
This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4.

A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. 

If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.

### Patches

The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
GitHub Security Advisory: GHSA-x7jg-6pwg-fx5h
Package: puma (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: >= 4.0.0, < 4.3.4
Patched in: 4.3.4

Summary: HTTP Smuggling via Transfer-Encoding Header in Puma

Details:
### Impact

By using an invalid transfer-encoding header, an attacker could [smuggle an HTTP response.](https://portswigger.net/web-security/request-smuggling)

Originally reported by @ZeddYu, who has our thanks for the detailed report.

### Patches

The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
GitHub Security Advisory: GHSA-x7jg-6pwg-fx5h
Package: puma (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: < 3.12.5
Patched in: 3.12.5

Summary: HTTP Smuggling via Transfer-Encoding Header in Puma

Details:
### Impact

By using an invalid transfer-encoding header, an attacker could [smuggle an HTTP response.](https://portswigger.net/web-security/request-smuggling)

Originally reported by @ZeddYu, who has our thanks for the detailed report.

### Patches

The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
GitHub Security Advisory: GHSA-mg5p-95m9-rmfp
Package: actionpack-page_caching (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.2.1
Patched in: 1.2.1

Summary: Arbitrary file write in actionpack-page_caching gem

Details:
There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view.
GitHub Security Advisory: GHSA-jc8m-cxhj-668x
Package: sorcery (RUBYGEMS)
Severity: HIGH (CVSS 8.3)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: < 0.15.0
Patched in: 0.15.0

Summary: Improper Restriction of Excessive Authentication Attempts in Sorcery

Details:
### Impact
Brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will prevent a brute force attack for the defined lockout period, but once expired protection will not be re-enabled until a user or malicious actor logs in successfully. This does not affect users that do not use the built-in brute force protection submodule, nor users that use permanent account lockout.

### Patches
Patched as of version `0.15.0`.

### Workarounds
Currently no workarounds, other than monkey patching the authenticate method provided by Sorcery or upgrading to version `0.15.0`.
GitHub Security Advisory: GHSA-j7vx-8mqj-cqp9
Package: doorkeeper (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 5.3.0, < 5.3.2
Patched in: 5.3.2

Summary: Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper

Details:
### Impact
Information disclosure vulnerability. Allows an attacker to see all `Doorkeeper::Application` model attribute values (including secrets) using authorized applications controller if it's enabled (GET /oauth/authorized_applications.json).

### Patches

These versions have the fix:

* 5.0.3
* 5.1.1
* 5.2.5
* 5.3.2

### Workarounds
Patch `Doorkeeper::Application` model `#as_json(options = {})` method and define only those attributes you want to expose.

Additional recommended hardening is to enable application secrets hashing ([guide](https://doorkeeper.gitbook.io/guides/security/token-and-application-secrets)), available since Doorkeeper 5.1. This would render the exposed secret useless.

### References

- Commit with fix: https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10187
GitHub Security Advisory: GHSA-j7vx-8mqj-cqp9
Package: doorkeeper (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 5.2.0, < 5.2.5
Patched in: 5.2.5

Summary: Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper

Details:
### Impact
Information disclosure vulnerability. Allows an attacker to see all `Doorkeeper::Application` model attribute values (including secrets) using authorized applications controller if it's enabled (GET /oauth/authorized_applications.json).

### Patches

These versions have the fix:

* 5.0.3
* 5.1.1
* 5.2.5
* 5.3.2

### Workarounds
Patch `Doorkeeper::Application` model `#as_json(options = {})` method and define only those attributes you want to expose.

Additional recommended hardening is to enable application secrets hashing ([guide](https://doorkeeper.gitbook.io/guides/security/token-and-application-secrets)), available since Doorkeeper 5.1. This would render the exposed secret useless.

### References

- Commit with fix: https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10187
GitHub Security Advisory: GHSA-j7vx-8mqj-cqp9
Package: doorkeeper (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-862: Missing Authorization
Vulnerable versions: = 5.1.0
Patched in: 5.1.1

Summary: Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper

Details:
### Impact
Information disclosure vulnerability. Allows an attacker to see all `Doorkeeper::Application` model attribute values (including secrets) using authorized applications controller if it's enabled (GET /oauth/authorized_applications.json).

### Patches

These versions have the fix:

* 5.0.3
* 5.1.1
* 5.2.5
* 5.3.2

### Workarounds
Patch `Doorkeeper::Application` model `#as_json(options = {})` method and define only those attributes you want to expose.

Additional recommended hardening is to enable application secrets hashing ([guide](https://doorkeeper.gitbook.io/guides/security/token-and-application-secrets)), available since Doorkeeper 5.1. This would render the exposed secret useless.

### References

- Commit with fix: https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10187
GitHub Security Advisory: GHSA-j7vx-8mqj-cqp9
Package: doorkeeper (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 5.0.0, < 5.0.3
Patched in: 5.0.3

Summary: Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper

Details:
### Impact
Information disclosure vulnerability. Allows an attacker to see all `Doorkeeper::Application` model attribute values (including secrets) using authorized applications controller if it's enabled (GET /oauth/authorized_applications.json).

### Patches

These versions have the fix:

* 5.0.3
* 5.1.1
* 5.2.5
* 5.3.2

### Workarounds
Patch `Doorkeeper::Application` model `#as_json(options = {})` method and define only those attributes you want to expose.

Additional recommended hardening is to enable application secrets hashing ([guide](https://doorkeeper.gitbook.io/guides/security/token-and-application-secrets)), available since Doorkeeper 5.1. This would render the exposed secret useless.

### References

- Commit with fix: https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10187
GitHub Security Advisory: GHSA-qpg4-4w7w-2mq5
Package: faye (RUBYGEMS)
Severity: HIGH (CVSS 8.5)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 1.2.0, < 1.2.5
Patched in: 1.2.5

Summary: Authentication and extension bypass in Faye

Details:
On 20 April 2020 it was reported to me that the potential for authentication bypass exists in [Faye][1]'s extension system. This vulnerability has existed in the Node.js and Ruby versions of the server since version 0.5.0, when extensions were first introduced, in July 2010. It is patched in versions 1.0.4, 1.1.3 and 1.2.5, which we are releasing today.

The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. For example, the Faye [extension docs][2] suggest that users implement access control for subscriptions by checking incoming messages for the `/meta/subscribe` channel, for example:

```js
server.addExtension({
  incoming: function(message, callback) {
    if (message.channel === '/meta/subscribe') {
      if (message.ext.authToken !== 'my super secret password') {
        message.error = 'Invalid auth token';
      }
    }
    callback(message);
  }
});
```

A bug in the server's code for recognising the special `/meta/*` channels, which trigger connection and subscription events, means that a client can bypass this check by sending a message to `/meta/subscribe/x` rather than `/meta/subscribe`:

```json
{
  "channel": "/meta/subscribe/x",
  "clientId": "3jrc6602npj4gyp6bn5ap2wqzjtb2q3",
  "subscription": "/foo"
}
```

This message will not be checked by the above extension, as it checks the message's channel is exactly equal to `/meta/subscribe`. But it will still be processed as a subscription request by the server, so the client becomes subscribed to the channel `/foo` without supplying the necessary credentials.

The vulnerability is caused by the way the Faye server recognises meta channels. It will treat a message to any channel that's a prefix-match for one of the special channels `/meta/handshake`, `/meta/connect`, `/meta/subscribe`, `/meta/unsubscribe` or `/meta/disconnect`, as though it were an exact match for that channel. So, a message to `/meta/subscribe/x` is still processed as a subscription request, for example.

An authentication bypass for subscription requests is the most serious effect of this but all other meta channels are susceptible to similar manipulation.

This parsing bug in the server is fixed in versions 1.0.4, 1.1.3 and 1.2.5. These should be drop-in replacements for prior versions and you should upgrade immediately if you are running any prior version.

If you are unable to install one of these versions, you can make your extensions catch all messages the server would process by checking the channel _begins_ with the expected channel name, for example:

```js
server.addExtension({
  incoming: function(message, callback) {
    if (message.channel.startsWith('/meta/subscribe')) {
      // authentication logic
    }
    callback(message);
  }
});
```

[1]: https://faye.jcoglan.com/
[2]: https://faye.jcoglan.com/node/extensions.html