Skip to content

Commit 56f585b

Browse files
jasnowjasnow
committed
GHSA SYNC: 6 enhanced ruby advisories
1 parent 627ae63 commit 56f585b

File tree

6 files changed

+162
-2
lines changed

6 files changed

+162
-2
lines changed

‎rubies/ruby/CVE-2005-2337.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
engine: ruby
3+
cve: 2005-2337
4+
ghsa: w8mr-4m5w-x8wv
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2005-2337
6+
title: Security Bypass Vulnerability with Ruby
7+
date: 2005-10-07
8+
description: |
9+
The Ruby language has a security mechanism (security model) that
10+
can restrict operations on untrusted objects. This security model
11+
is based on mechanisms called "object taint" and "safe level."
12+
A vulnerability has been confirmed that allows arbitrary script
13+
execution by bypassing the "safe level" setting and taint
14+
flag protections and execute disallowed code when Ruby
15+
processes a program through standard input (stdin).
16+
cvss_v2: 7.5
17+
patched_versions:
18+
- "~> 1.6.9"
19+
- ">= 1.8.3"
20+
related:
21+
url:
22+
- https://nvd.nist.gov/vuln/detail/CVE-2005-2337
23+
- https://web.archive.org/web/20060104024955/https://www.ruby-lang.org/en/20051003.html
24+
- https://jvn.jp/jp/JVN62914675/index.html
25+
26+
- http://www.debian.org/security/2005/dsa-860
27+
- http://www.debian.org/security/2005/dsa-862
28+
- http://www.debian.org/security/2005/dsa-864
29+
- http://www.kb.cert.org/vuls/id/160012
30+
- http://www.gentoo.org/security/en/glsa/glsa-200510-05.xml
31+
- https://ubuntu.com/security/notices/USN-195-1
32+
- https://github.com/advisories/GHSA-w8mr-4m5w-x8wv

‎rubies/ruby/CVE-2006-6303.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
engine: ruby
3+
cve: 2006-6303
4+
ghsa: fx2r-qhmq-3jjp
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2006-6303
6+
title: Another DoS Vulnerability in CGI Library
7+
date: 2006-12-06
8+
description: |
9+
The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does
10+
not properly detect boundaries in MIME multipart content, which
11+
allows remote attackers to cause a denial of service (infinite
12+
loop) via crafted HTTP requests, a different issue than CVE-2006-5467.
13+
cvss_v2: 5.0
14+
patched_versions:
15+
- ">= 1.8.5-p2"
16+
related:
17+
url:
18+
- https://nvd.nist.gov/vuln/detail/CVE-2006-6303
19+
- http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library
20+
- https://jvn.jp/jp/JVN84798830/index.html
21+
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218287
22+
- https://ubuntu.com/security/notices/USN-394-1
23+
- http://bugs.gentoo.org/show_bug.cgi?id=157048
24+
- http://security.gentoo.org/glsa/glsa-200612-21.xml
25+
- https://github.com/advisories/GHSA-fx2r-qhmq-3jjp

‎rubies/ruby/CVE-2008-1145.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
engine: ruby
3+
cve: 2008-1145
4+
ghsa: f279-rf2r-m6m5
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2008-1145
6+
title: Directory traversal vulnerability in WEBrick
7+
date: 2008-03-04
8+
description: |
9+
Directory traversal vulnerability in WEBrick
10+
when running on systems that support backslash () path separators
11+
or case-insensitive file names, allows remote attackers to access
12+
arbitrary files via (1) "..%5c" (encoded backslash) sequences or
13+
(2) filenames that match patterns in the :NondisclosureName option.
14+
15+
NOTE: Fixes are mentioned in 2008/03/03 reference.
16+
cvss_v2: 5.0
17+
patched_versions:
18+
- "~> 1.8.5.p115"
19+
- "~> 1.8.6.p114"
20+
- ">= 1.9.0.1"
21+
related:
22+
url:
23+
- https://nvd.nist.gov/vuln/detail/CVE-2008-1145
24+
- http://www.ruby-lang.org/en/news/2008/03/03/webrick-file-access-vulnerability
25+
- https://www.exploit-db.com/exploits/5215
26+
- http://www.kb.cert.org/vuls/id/404515
27+
- http://support.apple.com/kb/HT2163
28+
- http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
29+
- https://github.com/advisories/GHSA-f279-rf2r-m6m5

‎rubies/ruby/CVE-2017-14064.yml‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
---
22
engine: ruby
33
cve: 2017-14064
4-
url: https://www.ruby-lang.org/en/news/2017/09/14/json-heap-exposure-cve-2017-14064/
4+
ghsa: 954h-8gv7-2q75
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2017-14064
56
title: Heap exposure vulnerability in generating JSON
67
date: 2017-09-14
78
description: |
@@ -14,7 +15,28 @@ description: |
1415
1516
The JSON library is also distributed as a gem. If you can’t upgrade Ruby
1617
itself, install JSON gem newer than version 2.0.4.
18+
cvss_v2: 7.5
19+
cvss_v3: 9.8
1720
patched_versions:
1821
- "~> 2.2.8"
1922
- "~> 2.3.5"
2023
- ">= 2.4.2"
24+
related:
25+
url:
26+
- https://nvd.nist.gov/vuln/detail/CVE-2017-14064
27+
- https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released
28+
- https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released
29+
- https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-4-2-released
30+
- https://www.ruby-lang.org/en/news/2017/09/14/json-heap-exposure-cve-2017-14064
31+
- https://github.com/ruby/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85
32+
- https://bugs.ruby-lang.org/issues/13853
33+
- https://hackerone.com/reports/209949
34+
- https://www.debian.org/security/2017/dsa-3966
35+
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
36+
- https://ubuntu.com/security/notices/USN-3685-1
37+
- https://security.gentoo.org/glsa/201710-18
38+
- https://access.redhat.com/errata/RHSA-2017:3485
39+
- https://access.redhat.com/errata/RHSA-2018:0378
40+
- https://access.redhat.com/errata/RHSA-2018:0583
41+
- https://access.redhat.com/errata/RHSA-2018:0585
42+
- https://github.com/advisories/GHSA-954h-8gv7-2q75

‎rubies/ruby/CVE-2017-6181.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
engine: ruby
3+
cve: 2017-6181
4+
ghsa: 5pfp-rwpx-xgfx
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2017-6181
6+
title: DoS caused by infinite recursion (stack overflow) in parse_char_class()
7+
date: 2017-04-03
8+
description: |
9+
The parse_char_class function in regparse.c in the Onigmo (aka
10+
Oniguruma-mod) regular expression library, as used in Ruby 2.4.0,
11+
allows remote attackers to cause a denial of service (deep
12+
recursion and application crash) via a crafted regular expression.
13+
14+
## RELEASE NOTE
15+
In bug report, found
16+
- "Applied in changeset r57660" and
17+
- "ruby_2_4 r57909 merged revision(s) 57660"
18+
cvss_v2: 5.0
19+
cvss_v3: 7.5
20+
patched_versions:
21+
- ">= 2.4.0"
22+
related:
23+
url:
24+
- https://nvd.nist.gov/vuln/detail/CVE-2017-6181
25+
- https://bugs.ruby-lang.org/issues/13234
26+
- https://github.com/advisories/GHSA-5pfp-rwpx-xgfx

‎rubies/ruby/CVE-2019-16255.yml‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
---
22
engine: ruby
33
cve: 2019-16255
4-
url: https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255/
4+
ghsa: ph7w-p94x-9vvw
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2019-16255
56
title: A code injection vulnerability of Shell#[] and Shell#test
67
date: 2019-10-01
78
description: |
@@ -13,8 +14,33 @@ description: |
1314
Users must never do it. However, we treat this particular case as a
1415
vulnerability because the purpose of Shell#[] and Shell#[] is considered file
1516
testing.
17+
18+
Note: Mentioned as being fixed in JRuby 9.3.0.0 release. URLs at bottom of list.
19+
cvss_v2: 6.8
20+
cvss_v3: 8.1
1621
patched_versions:
1722
- "~> 2.4.8"
1823
- "~> 2.5.7"
1924
- "~> 2.6.5"
2025
- "> 2.7.0-preview1"
26+
related:
27+
url:
28+
- https://nvd.nist.gov/vuln/detail/CVE-2019-16255
29+
- https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-6-5-released
30+
- https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-5-7-released
31+
- https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-4-8-released
32+
- https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255
33+
- https://seclists.org/bugtraq/2019/Dec/31
34+
- https://seclists.org/bugtraq/2019/Dec/32
35+
- https://www.debian.org/security/2019/dsa-4587
36+
- https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html
37+
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
38+
- https://security.gentoo.org/glsa/202003-06
39+
- https://www.oracle.com/security-alerts/cpujan2020.html
40+
- https://hackerone.com/reports/327512
41+
- https://github.com/jruby/jruby/releases/tag/9.3.0.0
42+
- https://github.com/jruby/jruby/issues/5126
43+
- https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html
44+
- https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
45+
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
46+
- https://github.com/advisories/GHSA-ph7w-p94x-9vvw

0 commit comments

Comments
 (0)