Skip to content

Commit 0a7f663

Browse files
jasnowjasnow
authored
GHSA SYNC: 2 modified advisories; 3 brand new advisories (#957)
1 parent dec39a7 commit 0a7f663

File tree

6 files changed

+151
-3
lines changed

6 files changed

+151
-3
lines changed

‎rubies/ruby/CVE-2011-4121.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
engine: ruby
3+
cve: 2011-4121
4+
ghsa: mjg4-5rfj-952f
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2011-4121
6+
title: Private Ruby OpenSSL RSA key generation is always "1"
7+
date: 2019-11-26
8+
description: |
9+
The OpenSSL extension of Ruby (Git trunk) versions after
10+
2011-09-01 up to 2011-11-03 always generated an exponent value
11+
of '1' to be used for private RSA key generation. A remote
12+
attacker could use this flaw to bypass or corrupt integrity
13+
of services, depending on strong private RSA keys generation
14+
mechanism.
15+
16+
- "The fix was introduced via SVN revision 33633, resolving
17+
the faulty random exponent generation."
18+
- "fix was integrated into the Ruby 1.9.3 series"
19+
cvss_v2: 7.5
20+
cvss_v3: 9.8
21+
patched_versions:
22+
- ">= 1.9.3"
23+
related:
24+
url:
25+
- https://nvd.nist.gov/vuln/detail/CVE-2011-4121
26+
- https://github.com/saltstack/salt/commit/5dd304276ba5745ec21fc1e6686a0b28da29e6fc
27+
- https://access.redhat.com/security/cve/cve-2011-4121
28+
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4121
29+
- https://security-tracker.debian.org/tracker/CVE-2011-4121
30+
- http://www.openwall.com/lists/oss-security/2013/07/01/1
31+
- https://github.com/advisories/GHSA-mjg4-5rfj-952f

‎rubies/ruby/CVE-2016-2337.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
engine: ruby
3+
cve: 2016-2337
4+
ghsa: f58m-77qc-8gjv
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2016-2337
6+
title: Type confusion exists in _cancel_eval Ruby's TclTkIp class
7+
date: 2017-01-06
8+
description: |
9+
Type confusion exists in _cancel_eval Ruby's TclTkIp class method.
10+
Attacker passing different type of object than String as "retval"
11+
argument can cause arbitrary code execution.
12+
cvss_v3: 9.8
13+
cvss_v4: 7.5
14+
patched_versions:
15+
- ">= 2.2.8"
16+
related:
17+
url:
18+
- https://nvd.nist.gov/vuln/detail/CVE-2016-2337
19+
- https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html
20+
- https://security.gentoo.org/glsa/201710-18
21+
- http://www.talosintelligence.com/reports/TALOS-2016-0031
22+
- https://github.com/advisories/GHSA-f58m-77qc-8gjv

‎rubies/ruby/CVE-2016-2338.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
engine: ruby
3+
cve: 2016-2338
4+
ghsa: r46x-xjwr-8v2g
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2016-2338
6+
title: Exploitable heap overflow vulnerability exists
7+
in Ruby's Psych::Emitter start_document function
8+
date: 2022-09-28
9+
description: |
10+
An exploitable heap overflow vulnerability exists in the
11+
Psych::Emitter start_document function of Ruby. In Psych::Emitter
12+
start_document function heap buffer "head" allocation is made
13+
based on tags array length. Specially constructed object passed
14+
as element of tags array can increase this array size after
15+
mentioned allocation and cause heap overflow.
16+
17+
- "Ruby versions 2.2.2 (4/13/2015) and 2.3.0 (12/25/2015)
18+
are susceptible"
19+
cvss_v3: 9.8
20+
patched_versions:
21+
- "~> 2.3.1"
22+
- ">= 2.4.0"
23+
related:
24+
url:
25+
- https://nvd.nist.gov/vuln/detail/CVE-2016-2338
26+
- https://lists.debian.org/debian-lts-announce/2020/03/msg00032.html
27+
- http://www.talosintelligence.com/reports/TALOS-2016-0032
28+
- https://security.netapp.com/advisory/ntap-20221228-0005
29+
- https://cve.reconshell.com/cve/CVE-2016-2338
30+
- https://alas.aws.amazon.com/AL2/ALAS2-2025-2990.html
31+
- https://github.com/advisories/GHSA-r46x-xjwr-8v2g

‎rubies/ruby/CVE-2016-2339.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
engine: ruby
3+
cve: 2016-2339
4+
ghsa: c4w7-m676-pcvp
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2016-2339
6+
title: Ruby 2.1 has exploitable heap overflow vulnerability
7+
date: 2017-01-06
8+
description: |
9+
An exploitable heap overflow vulnerability exists in the
10+
Fiddle::Function.new "initialize" function functionality of
11+
Ruby. In Fiddle::Function.new "initialize" heap buffer
12+
"arg_types" allocation is made based on args array length.
13+
Specially constructed object passed as element of args array
14+
can increase this array size after mentioned allocation and
15+
cause heap overflow.
16+
17+
Versions affected:
18+
- Ruby "2.0.0-p648, 2.1.0-p0 through 2.1.9, and 2.2.0 through 2.2.5."
19+
- NOTE: Unclear where the patches where applied.
20+
- "Fix was introduced in Ruby 2.1.9, with related packages like
21+
ruby2.1 updated to version 2.1.9-19.3.2 or newer"
22+
cvss_v3: 9.8
23+
patched_versions:
24+
- ">= 2.1.9"
25+
related:
26+
url:
27+
- https://nvd.nist.gov/vuln/detail/CVE-2016-2339
28+
- https://app.opencve.io/cve/CVE-2016-2339
29+
- http://www.talosintelligence.com/reports/TALOS-2016-0034
30+
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
31+
- https://web.archive.org/web/20210123144757/https://www.securityfocus.com/bid/91234
32+
- https://www.cybersecurity-help.cz/vulnerabilities/39952/
33+
- https://github.com/advisories/GHSA-c4w7-m676-pcvp

‎rubies/ruby/CVE-2018-8780.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
---
22
engine: ruby
33
cve: 2018-8780
4+
ghsa: fphx-j9v2-w2cx
45
url: https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/
56
title: Unintentional directory traversal by poisoned NUL byte in Dir
67
date: 2018-03-28
@@ -14,9 +15,20 @@ description: |
1415
attacker can make the unintentional directory traversal.
1516
1617
All users running an affected release should upgrade immediately.
18+
cvss_v2: 7.5
19+
cvss_v3: 9.1
1720
patched_versions:
1821
- "~> 2.2.10"
1922
- "~> 2.3.7"
2023
- "~> 2.4.4"
2124
- "~> 2.5.1"
2225
- "> 2.6.0-preview1"
26+
related:
27+
url:
28+
- https://nvd.nist.gov/vuln/detail/CVE-2018-8780
29+
- https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780
30+
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released
31+
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released
32+
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released
33+
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released
34+
- https://github.com/advisories/GHSA-fphx-j9v2-w2cx

‎rubies/ruby/CVE-2022-28738.yml‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,37 @@
11
---
22
engine: ruby
33
cve: 2022-28738
4+
ghsa: 8pqg-8p79-j5j8
45
url: https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/
56
title: Double free in Regexp compilation
67
date: 2022-04-12
78
description: |
8-
A double-free vulnerability is discovered in Regexp compilation. This vulnerability has been assigned the CVE identifier CVE-2022-28738. We strongly recommend upgrading Ruby.
9+
A double-free vulnerability is discovered in Regexp compilation. This
10+
vulnerability has been assigned the CVE identifier CVE-2022-28738.
11+
We strongly recommend upgrading Ruby.
912
10-
Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted source string could cause the same memory to be freed twice. This is known as a “double free” vulnerability. Note that, in general, it is considered unsafe to create and use a Regexp object generated from untrusted input. In this case, however, following a comprehensive assessment, we treat this issue as a vulnerability.
13+
Due to a bug in the Regexp compilation process, creating a Regexp
14+
object with a crafted source string could cause the same memory to
15+
be freed twice. This is known as a “double free” vulnerability. Note
16+
that, in general, it is considered unsafe to create and use a Regexp
17+
object generated from untrusted input. In this case, however,
18+
following a comprehensive assessment, we treat this issue as a vulnerability.
1119
12-
Please update Ruby to 3.0.4, or 3.1.2.
20+
Please update Ruby to 3.0.4 or 3.1.2.
21+
cvss_v2: 7.5
22+
cvss_v3: 9.8
1323
patched_versions:
1424
- "~> 3.0.4"
1525
- ">= 3.1.2"
1626
unaffected_versions:
1727
- "~> 2.6.0"
1828
- "~> 2.7.0"
29+
related:
30+
url:
31+
- https://nvd.nist.gov/vuln/detail/CVE-2022-28738
32+
- https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738
33+
- https://hackerone.com/reports/1220911
34+
- https://security-tracker.debian.org/tracker/CVE-2022-28738
35+
- https://security.netapp.com/advisory/ntap-20220624-0002
36+
- https://security.gentoo.org/glsa/202401-27
37+
- https://github.com/advisories/GHSA-8pqg-8p79-j5j8

0 commit comments

Comments
 (0)