Skip to content

Commit 8ba0f94

Browse files
jasnowjasnow
authored
GHSA SYNC: Advisories (2 mruby and 1 mrubyc) plus schema change (#971)
1 parent e4d63d4 commit 8ba0f94

File tree

6 files changed

+142
-3
lines changed

6 files changed

+142
-3
lines changed

‎gems/activerecord/CVE-2013-3221.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
gem: activerecord
3+
framework: rails
4+
cve: 2013-3221
5+
ghsa: f57c-hx33-hvh8
6+
url: https://nvd.nist.gov/vuln/detail/CVE-2013-3221
7+
title: Data-type injection vulnerability
8+
date: 2013-04-21
9+
description: |
10+
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x,
11+
and 3.2.x does not ensure that the declared data type of a database
12+
column is used during comparisons of input values to stored values
13+
in that column, which makes it easier for remote attackers to
14+
conduct data-type injection attacks against Ruby on Rails applications
15+
via a crafted value, as demonstrated by unintended interaction
16+
between the "typed XML" feature and a MySQL database.
17+
18+
## RELEASE INFO
19+
- Phrack writeup says that 'couple of days after the advisory the
20+
issue was "fixed" in Rails 3.2.12 as by the following commit' 921a296.
21+
But "Indeed the vector is completely fixed as of Rails 4.2 almost
22+
two years after the original advisory."
23+
cvss_v2: 6.4
24+
patched_versions:
25+
- ">= 4.2.0"
26+
related:
27+
url:
28+
- https://nvd.nist.gov/vuln/detail/CVE-2013-3221
29+
- https://github.com/rails/rails/commit/c9909db9f2f81575ef2ea2ed3b4e8743c8d6f1b9
30+
- https://github.com/rails/rails/commit/921a296a3390192a71abeec6d9a035cc6d1865c8
31+
- https://groups.google.com/group/rubyonrails-security/msg/1f3bc0b88a60c1ce
32+
- http://pl.reddit.com/r/netsec/comments/17yajp/mysql_madness_and_rails
33+
- http://openwall.com/lists/oss-security/2013/02/06/7
34+
- http://openwall.com/lists/oss-security/2013/04/24/7
35+
- https://gist.github.com/marianposaceanu/5442275
36+
- https://web.archive.org/web/20160307143147/http://www.phenoelit.org/blog/archives/2013/02/index.html
37+
- https://github.com/advisories/GHSA-f57c-hx33-hvh8
38+
- https://phrack.org/issues/69/12

‎rubies/mruby/CVE-2025-12875.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
engine: mruby
3+
cve: 2025-12875
4+
ghsa: q269-xqww-45mm
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2025-12875
6+
title: Out-of-bounds write vulnerability
7+
date: 2025-11-07
8+
description: |
9+
A weakness has been identified in mruby 3.4.0. This vulnerability
10+
affects the function ary_fill_exec of the file
11+
mrbgems/mruby-array-ext/src/array.c. Executing manipulation of
12+
the argument start/length can lead to out-of-bounds write. The
13+
attack needs to be launched locally. The exploit has been made
14+
available to the public and could be exploited.
15+
This patch is called 93619f06dd378db6766666b30c08978311c7ec94.
16+
It is best practice to apply a patch to resolve this issue.
17+
18+
## RELEASE INFO
19+
- Commit 93619f0 10/22//2025 for ISS#6650 (Found in
20+
unreleased mruby3.5 NEWS.md file)
21+
cvss_v2: 4.3
22+
cvss_v3: 7.8
23+
cvss_v4: 4.8
24+
patched_versions:
25+
- ">= 3.5.0"
26+
related:
27+
url:
28+
- https://nvd.nist.gov/vuln/detail/CVE-2025-12875
29+
- https://github.com/mruby/mruby/blob/master/NEWS.md
30+
- https://github.com/mruby/mruby/commit/93619f06dd378db6766666b30c08978311c7ec94
31+
- https://github.com/mruby/mruby/issues/6650
32+
- https://vuldb.com/?ctiid.331511
33+
- https://vuldb.com/?id.331511
34+
- https://vuldb.com/?submit.680879
35+
- https://github.com/advisories/GHSA-q269-xqww-45mm

‎rubies/mruby/CVE-2025-13120.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
engine: mruby
3+
cve: 2025-13120
4+
ghsa: j383-q79v-268x
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2025-13120
6+
title: Use-after-realloc vulnerablity in mruby 3.4.0
7+
date: 2025-11-13
8+
description: |
9+
A vulnerability has been found in mruby up to 3.4.0. This
10+
vulnerability affects the function sort_cmp of the file src/array.c.
11+
Such manipulation leads to use after free. An attack has to be
12+
approached locally. The exploit has been disclosed to the public
13+
and may be used.
14+
The name of the patch is eb398971bfb43c38db3e04528b68ac9a7ce509bc.
15+
It is advisable to implement a patch to correct this issue.
16+
17+
## RELEASE INFO
18+
- Commit eb39897 10/27//2025 for ISS#6649 (Found in
19+
unreleased mruby3.5 NEWS.md file)
20+
cvss_v2: 4.3
21+
cvss_v3: 5.5
22+
cvss_v4: 4.8
23+
patched_versions:
24+
- ">= 3.5.0"
25+
related:
26+
url:
27+
- https://nvd.nist.gov/vuln/detail/CVE-2025-13120
28+
- https://github.com/mruby/mruby/blob/master/NEWS.md
29+
- https://github.com/mruby/mruby/commit/eb398971bfb43c38db3e04528b68ac9a7ce509bc
30+
- https://github.com/mruby/mruby/issues/6649
31+
- https://github.com/makesoftwaresafe/mruby/pull/263
32+
- https://vuldb.com/?ctiid.332325
33+
- https://vuldb.com/?id.332325
34+
- https://vuldb.com/?submit.683435
35+
- https://github.com/advisories/GHSA-j383-q79v-268x

‎rubies/mrubyc/CVE-2025-13397.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
engine: mrubyc
3+
cve: 2025-13397
4+
ghsa: 99jr-qh2r-jwfm
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2025-13397
6+
title: null pointer dereference vulnerability in mrubyc 3.4
7+
date: 2025-11-19
8+
description: |
9+
A security vulnerability has been detected in mrubyc up to 3.4.
10+
This impacts the function mrbc_raw_realloc of the file src/alloc.c.
11+
Such manipulation of the argument ptr leads to null pointer
12+
dereference. An attack has to be approached locally.
13+
The name of the patch is 009111904807b8567262036bf45297c3da8f1c87.
14+
It is advisable to implement a patch to correct this issue.
15+
16+
## RELEASE INFO
17+
- Release 3.4 commit stopped on 6/26/2025 and ommit 0091119 was
18+
on 10/14/2025 so not in 3.4. Do not see any CHANGELOG or NEWS files.
19+
cvss_v2: .17
20+
cvss_v3: 5.5
21+
cvss_v4: 4.8
22+
notes: "Never patched"
23+
related:
24+
url:
25+
- https://nvd.nist.gov/vuln/detail/CVE-2025-13397
26+
- https://github.com/mrubyc/mrubyc/commit/009111904807b8567262036bf45297c3da8f1c87
27+
- https://github.com/mrubyc/mrubyc/issues/244
28+
- https://vuldb.com/?ctiid.332925
29+
- https://vuldb.com/?id.332925
30+
- https://vuldb.com/?submit.692130
31+
- https://github.com/advisories/GHSA-99jr-qh2r-jwfm

‎rubies/ruby/CVE-2009-1904.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
engine: ruby
33
cve: 2009-1904
4-
ghsa: v74x-h8vc-p3j5
4+
ghsa: prwc-wj59-8vwr
55
osvdb: 55031
66
url: https://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal
77
title: "CVE-2009-1904 ruby: DoS vulnerability in BigDecimal"
@@ -19,5 +19,5 @@ related:
1919
url:
2020
- https://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal
2121
- https://nvd.nist.gov/vuln/detail/CVE-2009-1904
22-
- https://github.com/advisories/GHSA-v74x-h8vc-p3j5
22+
- https://github.com/advisories/GHSA-prwc-wj59-8vwr
2323
- http://www.osvdb.org/show/osvdb/55031

‎spec/schemas/ruby.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ mapping:
44
"engine":
55
type: str
66
required: true
7-
enum: [jruby, rbx, ruby, mruby]
7+
enum: [jruby, rbx, ruby, mruby, mrubyc]
88
"platform":
99
type: str
1010
"cve":

0 commit comments

Comments
 (0)