Skip to content

Commit ceb1564

Browse files
jasnowpostmodern
jasnow
and
postmodern
authored
GHSA SYNC: 4 enhanced ruby advisories and 2 new ruby advisories (#997)
--------- Co-authored-by: Postmodern <postmodern.mod3@gmail.com>
1 parent 68d64cc commit ceb1564

File tree

6 files changed

+152
-2
lines changed

6 files changed

+152
-2
lines changed

‎rubies/ruby/CVE-2005-2337.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
engine: ruby
3+
cve: 2005-2337
4+
ghsa: w8mr-4m5w-x8wv
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2005-2337
6+
title: Security Bypass Vulnerability with Ruby
7+
date: 2005-10-07
8+
description: |
9+
The Ruby language has a security mechanism (security model) that
10+
can restrict operations on untrusted objects. This security model
11+
is based on mechanisms called "object taint" and "safe level."
12+
A vulnerability has been confirmed that allows arbitrary script
13+
execution by bypassing the "safe level" setting and taint
14+
flag protections and execute disallowed code when Ruby
15+
processes a program through standard input (stdin).
16+
cvss_v2: 7.5
17+
patched_versions:
18+
- "~> 1.6.9"
19+
- ">= 1.8.3"
20+
related:
21+
url:
22+
- https://nvd.nist.gov/vuln/detail/CVE-2005-2337
23+
- https://web.archive.org/web/20060104024955/https://www.ruby-lang.org/en/20051003.html
24+
- https://jvn.jp/jp/JVN62914675/index.html
25+
- http://www.debian.org/security/2005/dsa-860
26+
- http://www.debian.org/security/2005/dsa-862
27+
- http://www.debian.org/security/2005/dsa-864
28+
- http://www.kb.cert.org/vuls/id/160012
29+
- http://www.gentoo.org/security/en/glsa/glsa-200510-05.xml
30+
- https://ubuntu.com/security/notices/USN-195-1
31+
- https://github.com/advisories/GHSA-w8mr-4m5w-x8wv

‎rubies/ruby/CVE-2006-6303.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
engine: ruby
3+
cve: 2006-6303
4+
ghsa: fx2r-qhmq-3jjp
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2006-6303
6+
title: Another DoS Vulnerability in CGI Library
7+
date: 2006-12-06
8+
description: |
9+
The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does
10+
not properly detect boundaries in MIME multipart content, which
11+
allows remote attackers to cause a denial of service (infinite
12+
loop) via crafted HTTP requests, a different issue than CVE-2006-5467.
13+
cvss_v2: 5.0
14+
patched_versions:
15+
- ">= 1.8.5-p2"
16+
related:
17+
url:
18+
- https://nvd.nist.gov/vuln/detail/CVE-2006-6303
19+
- http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library
20+
- https://jvn.jp/jp/JVN84798830/index.html
21+
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218287
22+
- https://ubuntu.com/security/notices/USN-394-1
23+
- http://bugs.gentoo.org/show_bug.cgi?id=157048
24+
- http://security.gentoo.org/glsa/glsa-200612-21.xml
25+
- https://github.com/advisories/GHSA-fx2r-qhmq-3jjp

‎rubies/ruby/CVE-2008-1145.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
engine: ruby
3+
cve: 2008-1145
4+
ghsa: f279-rf2r-m6m5
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2008-1145
6+
title: Directory traversal vulnerability in WEBrick
7+
date: 2008-03-04
8+
description: |
9+
Directory traversal vulnerability in WEBrick
10+
when running on systems that support backslash () path separators
11+
or case-insensitive file names, allows remote attackers to access
12+
arbitrary files via (1) "..%5c" (encoded backslash) sequences or
13+
(2) filenames that match patterns in the :NondisclosureName option.
14+
cvss_v2: 5.0
15+
patched_versions:
16+
- "~> 1.8.5.p115"
17+
- "~> 1.8.6.p114"
18+
- ">= 1.9.0.1"
19+
related:
20+
url:
21+
- https://nvd.nist.gov/vuln/detail/CVE-2008-1145
22+
- http://www.ruby-lang.org/en/news/2008/03/03/webrick-file-access-vulnerability
23+
- https://www.exploit-db.com/exploits/5215
24+
- http://www.kb.cert.org/vuls/id/404515
25+
- http://support.apple.com/kb/HT2163
26+
- http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
27+
- https://github.com/advisories/GHSA-f279-rf2r-m6m5

‎rubies/ruby/CVE-2017-14064.yml‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
---
22
engine: ruby
33
cve: 2017-14064
4-
url: https://www.ruby-lang.org/en/news/2017/09/14/json-heap-exposure-cve-2017-14064/
4+
ghsa: 954h-8gv7-2q75
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2017-14064
56
title: Heap exposure vulnerability in generating JSON
67
date: 2017-09-14
78
description: |
@@ -14,7 +15,28 @@ description: |
1415
1516
The JSON library is also distributed as a gem. If you can’t upgrade Ruby
1617
itself, install JSON gem newer than version 2.0.4.
18+
cvss_v2: 7.5
19+
cvss_v3: 9.8
1720
patched_versions:
1821
- "~> 2.2.8"
1922
- "~> 2.3.5"
2023
- ">= 2.4.2"
24+
related:
25+
url:
26+
- https://nvd.nist.gov/vuln/detail/CVE-2017-14064
27+
- https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released
28+
- https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released
29+
- https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-4-2-released
30+
- https://www.ruby-lang.org/en/news/2017/09/14/json-heap-exposure-cve-2017-14064
31+
- https://github.com/ruby/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85
32+
- https://bugs.ruby-lang.org/issues/13853
33+
- https://hackerone.com/reports/209949
34+
- https://www.debian.org/security/2017/dsa-3966
35+
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
36+
- https://ubuntu.com/security/notices/USN-3685-1
37+
- https://security.gentoo.org/glsa/201710-18
38+
- https://access.redhat.com/errata/RHSA-2017:3485
39+
- https://access.redhat.com/errata/RHSA-2018:0378
40+
- https://access.redhat.com/errata/RHSA-2018:0583
41+
- https://access.redhat.com/errata/RHSA-2018:0585
42+
- https://github.com/advisories/GHSA-954h-8gv7-2q75

‎rubies/ruby/CVE-2017-6181.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
engine: ruby
3+
cve: 2017-6181
4+
ghsa: 5pfp-rwpx-xgfx
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2017-6181
6+
title: DoS caused by infinite recursion (stack overflow) in parse_char_class()
7+
date: 2017-04-03
8+
description: |
9+
The parse_char_class function in regparse.c in the Onigmo (aka
10+
Oniguruma-mod) regular expression library, as used in Ruby 2.4.0,
11+
allows remote attackers to cause a denial of service (deep
12+
recursion and application crash) via a crafted regular expression.
13+
cvss_v2: 5.0
14+
cvss_v3: 7.5
15+
patched_versions:
16+
- ">= 2.4.0"
17+
related:
18+
url:
19+
- https://nvd.nist.gov/vuln/detail/CVE-2017-6181
20+
- https://bugs.ruby-lang.org/issues/13234
21+
- https://github.com/advisories/GHSA-5pfp-rwpx-xgfx

‎rubies/ruby/CVE-2019-16255.yml‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
---
22
engine: ruby
33
cve: 2019-16255
4-
url: https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255/
4+
ghsa: ph7w-p94x-9vvw
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2019-16255
56
title: A code injection vulnerability of Shell#[] and Shell#test
67
date: 2019-10-01
78
description: |
@@ -13,8 +14,31 @@ description: |
1314
Users must never do it. However, we treat this particular case as a
1415
vulnerability because the purpose of Shell#[] and Shell#[] is considered file
1516
testing.
17+
cvss_v2: 6.8
18+
cvss_v3: 8.1
1619
patched_versions:
1720
- "~> 2.4.8"
1821
- "~> 2.5.7"
1922
- "~> 2.6.5"
2023
- "> 2.7.0-preview1"
24+
related:
25+
url:
26+
- https://nvd.nist.gov/vuln/detail/CVE-2019-16255
27+
- https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-6-5-released
28+
- https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-5-7-released
29+
- https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-4-8-released
30+
- https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255
31+
- https://seclists.org/bugtraq/2019/Dec/31
32+
- https://seclists.org/bugtraq/2019/Dec/32
33+
- https://www.debian.org/security/2019/dsa-4587
34+
- https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html
35+
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
36+
- https://security.gentoo.org/glsa/202003-06
37+
- https://www.oracle.com/security-alerts/cpujan2020.html
38+
- https://hackerone.com/reports/327512
39+
- https://github.com/jruby/jruby/releases/tag/9.3.0.0
40+
- https://github.com/jruby/jruby/issues/5126
41+
- https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html
42+
- https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
43+
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
44+
- https://github.com/advisories/GHSA-ph7w-p94x-9vvw

0 commit comments

Comments
 (0)