GHSA SYNC: advisories (1 brand new and 1 updated)

Author: jasnow

gems/activerecord/CVE-2013-3221.yml

@@ -0,0 +1,38 @@
+---
+gem: activerecord
+framework: rails
+cve: 2013-3221
+ghsa: f57c-hx33-hvh8
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-3221
+title: Data-type injection vulnerability
+date: 2013-04-21
+description: |
+  The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x,
+  and 3.2.x does not ensure that the declared data type of a database
+  column is used during comparisons of input values to stored values
+  in that column, which makes it easier for remote attackers to
+  conduct data-type injection attacks against Ruby on Rails applications
+  via a crafted value, as demonstrated by unintended interaction
+  between the "typed XML" feature and a MySQL database.
+
+  ## RELEASE INFO
+  - Phrack writeup says that 'couple of days after the advisory the
+    issue was "fixed" in Rails 3.2.12 as by the following commit' 921a296.
+    But "Indeed the vector is completely fixed as of Rails 4.2 almost
+    two years after the original advisory."
+cvss_v2: 6.4
+patched_versions:
+  - ">= 4.2"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-3221
+    - https://github.com/rails/rails/commit/c9909db9f2f81575ef2ea2ed3b4e8743c8d6f1b9
+    - https://github.com/rails/rails/commit/921a296a3390192a71abeec6d9a035cc6d1865c8
+    - https://groups.google.com/group/rubyonrails-security/msg/1f3bc0b88a60c1ce
+    - http://pl.reddit.com/r/netsec/comments/17yajp/mysql_madness_and_rails
+    - http://openwall.com/lists/oss-security/2013/02/06/7
+    - http://openwall.com/lists/oss-security/2013/04/24/7
+    - https://gist.github.com/marianposaceanu/5442275
+    - https://web.archive.org/web/20160307143147/http://www.phenoelit.org/blog/archives/2013/02/index.html
+    - https://github.com/advisories/GHSA-f57c-hx33-hvh8
+    - https://phrack.org/issues/69/12

rubies/ruby/CVE-2009-1904.yml

@@ -1,7 +1,7 @@
 ---
 engine: ruby
 cve: 2009-1904
-ghsa: v74x-h8vc-p3j5
+ghsa: prwc-wj59-8vwr
 osvdb: 55031
 url: https://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal
 title: "CVE-2009-1904 ruby: DoS vulnerability in BigDecimal"
@@ -19,5 +19,5 @@ related:
   url:
     - https://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal
     - https://nvd.nist.gov/vuln/detail/CVE-2009-1904
-    - https://github.com/advisories/GHSA-v74x-h8vc-p3j5
+    - https://github.com/advisories/GHSA-prwc-wj59-8vwr
     - http://www.osvdb.org/show/osvdb/55031