NicoArbogast/authentifyd — pull request #2 by hellvinz (2014-06-02 13:16:11+00:00)
Title: fix omniauth CVE + add tests

Name: devise
Version: 2.1.2
Advisory: OSVDB-89642
Criticality: High
URL: http://osvdb.org/show/osvdb/89642
Title: Devise Database Type Conversion Crafted Request Parsing Security
Bypass
Solution: upgrade to ~> 1.5.4, ~> 2.0.5, ~> 2.1.3, >= 2.2.3

Name: omniauth-facebook
Version: 1.4.0
Advisory: OSVDB-99888
Criticality: High
URL: http://www.osvdb.org/show/osvdb/99888
Title: omniauth-facebook Gem for Ruby Insecure Access Token Handling
Authentication Bypass
Solution: upgrade to >= 1.5.1

Name: omniauth-oauth2
Version: 1.0.3
Advisory: OSVDB-90264
Criticality: High
URL: http://www.osvdb.org/show/osvdb/90264
Title: Ruby on Rails omniauth-oauth2 Gem CSRF vulnerability
Solution: upgrade to >= 1.1.1