Skip to content

Commit d67d653

Browse files
jasnowjasnow
authored
GHSA SYNC: 3 modified advisory; 3 new advisory (#978)
1 parent 6ffc700 commit d67d653

File tree

6 files changed

+148
-7
lines changed

6 files changed

+148
-7
lines changed

‎rubies/mruby/CVE-2020-36401.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
engine: mruby
3+
cve: 2020-36401
4+
ghsa: qq64-7fh7-7hmw
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2020-36401
6+
title: double free vulnerabliity
7+
date: 2021-06-30
8+
description: |
9+
mruby 2.1.2 has a double free in mrb_default_allocf (called
10+
from mrb_free and obj_free).
11+
12+
# RELEASE NOTES
13+
14+
Cloned "mruby" repo, ran "git fetch --all --tags", then
15+
"git tag --contains 97319697c8f9f6ff27b32589947e1918e3015503"
16+
and got "3.0.0-preview, 3.0.0-rc, 3.0.0, ... 3.4.0-rc2".
17+
cvss_v2: 6.8
18+
cvss_v3: 7.8
19+
patched_versions:
20+
- ">= 3.0.0"
21+
related:
22+
url:
23+
- https://nvd.nist.gov/vuln/detail/CVE-2020-36401
24+
- https://mruby.org/releases/2021/03/05/mruby-3.0.0-released.html
25+
- https://github.com/mruby/mruby/commit/97319697c8f9f6ff27b32589947e1918e3015503
26+
- https://issues.oss-fuzz.com/issues/42485317
27+
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/mruby/OSV-2020-744.yaml
28+
- https://github.com/advisories/GHSA-qq64-7fh7-7hmw

‎rubies/ruby/CVE-2006-1931.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
engine: ruby
3+
cve: 2006-1931
4+
osvdb: 24972
5+
ghsa: j98g-25wq-62h9
6+
url: https://nvd.nist.gov/vuln/detail/CVE-2006-1931
7+
title: Ruby http/xmlrpc server DoS
8+
date: 2006-04-20
9+
description: |
10+
The HTTP/XMLRPC server in Ruby before 1.8.2 uses blocking sockets,
11+
which allows attackers to cause a denial of service
12+
(blocked connections) via a large amount of data.
13+
cvss_v2: 5.0
14+
patched_versions:
15+
- ">= 1.8.3"
16+
related:
17+
url:
18+
- https://nvd.nist.gov/vuln/detail/CVE-2006-1931
19+
- https://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.2-xmlrpc-dos-1.patch
20+
- https://security.gentoo.org/glsa/200605-11
21+
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26102
22+
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189540
23+
- https://web.archive.org/web/20201208004659/https://usn.ubuntu.com/273-1
24+
- https://web.archive.org/web/20070430022104/http://www.debian.org/security/2006/dsa-1157
25+
- https://web.archive.org/web/20061128124605/http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-dev/27787
26+
- https://github.com/advisories/GHSA-j98g-25wq-62h9

‎rubies/ruby/CVE-2009-5147.yml‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,30 @@
11
---
22
engine: ruby
33
cve: 2009-5147
4-
url: https://www.ruby-lang.org/en/news/2009/05/12/ruby-1-9-1-p129-released/
5-
title: Ruby DL::dlopen could open a library with tainted library name even if $SAFE
6-
> 0
4+
ghsa: mmq8-m72q-qgm4
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2009-5147
6+
title: Ruby DL::dlopen could open a library with tainted library
7+
name even if $SAFE > 0
78
date: 2009-05-12
89
description: |
910
DL::dlopen could open a library with tainted library name even if $SAFE > 0
11+
cvss_v2: 7.5
12+
cvss_v3: 7.3
1013
unaffected_versions:
1114
- "< 1.9.1"
1215
- ">= 1.9.2"
1316
patched_versions:
1417
- "~> 1.9.1.129"
18+
- ">= 2.1.8"
19+
related:
20+
url:
21+
- https://nvd.nist.gov/vuln/detail/CVE-2009-5147
22+
- https://www.ruby-lang.org/en/news/2015/12/16/ruby-2-1-8-released
23+
- https://www.ruby-lang.org/en/news/2009/05/12/ruby-1-9-1-p129-released
24+
- https://github.com/ruby/ruby/commit/4600cf725a86ce31266153647ae5aa1197b1215b
25+
- https://github.com/ruby/ruby/commit/7269e3de3cee3bbb6ab77fc708f3a10cab00b65e
26+
- http://seclists.org/oss-sec/2015/q3/222
27+
- https://bugzilla.redhat.com/show_bug.cgi?id=1248935
28+
- https://access.redhat.com/errata/RHSA-2018:0583
29+
- https://github.com/advisories/GHSA-mmq8-m72q-qgm4
30+
- https://web.archive.org/web/20200227161903/https://www.securityfocus.com/bid/76060

‎rubies/ruby/CVE-2015-7551.yml‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
---
22
engine: ruby
33
cve: 2015-7551
4-
url: https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/
4+
ghsa: m9xr-x5mq-4fp5
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2015-7551
56
title: Unsafe tainted string usage in Fiddle and DL
67
date: 2015-12-16
78
description: |
@@ -10,10 +11,25 @@ description: |
1011
was reimplemented using Fiddle and libffi.
1112
And, about DL, CVE-2009-5147 was fixed at Ruby 1.9.1, but not fixed at other
1213
branches, then rubies which bundled DL except Ruby 1.9.1 are still vulnerable.
14+
cvss_v2: 4.6
15+
cvss_v3: 8.4
16+
unaffected_versions:
17+
- "~> 1.9.1.129"
1318
patched_versions:
1419
- "~> 2.0.0.648"
1520
- "~> 2.1.8"
1621
- "~> 2.2.4"
1722
- ">= 2.3.0"
18-
unaffected_versions:
19-
- "~> 1.9.1.129"
23+
related:
24+
url:
25+
- https://nvd.nist.gov/vuln/detail/CVE-2015-7551
26+
- https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551
27+
- https://github.com/ruby/ruby/commit/339e11a7f178312d937b7c95dd3115ce7236597a
28+
- https://ubuntu.com/security/CVE-2015-7551
29+
- https://access.redhat.com/errata/RHSA-2018:0583
30+
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796344
31+
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796551
32+
- https://www.oracle.com/security-alerts/bulletinapr2016.html
33+
- https://web.archive.org/web/20161001113255/http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
34+
- https://web.archive.org/web/20181112082809/https://puppet.com/security/cve/ruby-dec-2015-security-fixes
35+
- https://github.com/advisories/GHSA-m9xr-x5mq-4fp5

‎rubies/ruby/CVE-2017-0898.yml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
---
22
engine: ruby
33
cve: 2017-0898
4-
url: https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/
4+
url: https://nvd.nist.gov/vuln/detail/CVE-2017-0898
5+
ghsa: wvmx-3rv2-5jgf
56
title: Buffer underrun vulnerability in Kernel.sprintf
67
date: 2017-09-14
78
description: |
@@ -13,7 +14,24 @@ description: |
1314
the Ruby interpreter may crash.
1415
1516
All users running an affected release should upgrade immediately.
17+
cvss_v2: 6.4
18+
cvss_v3: 9.1
1619
patched_versions:
1720
- "~> 2.2.8"
1821
- "~> 2.3.5"
1922
- ">= 2.4.2"
23+
related:
24+
url:
25+
- https://nvd.nist.gov/vuln/detail/CVE-2017-0898
26+
- https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898
27+
- https://hackerone.com/reports/212241
28+
- https://access.redhat.com/errata/RHSA-2017:3485
29+
- https://access.redhat.com/errata/RHSA-2018:0378
30+
- https://access.redhat.com/errata/RHSA-2018:0583
31+
- https://access.redhat.com/errata/RHSA-2018:0585
32+
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
33+
- https://security.gentoo.org/glsa/201710-18
34+
- https://www.debian.org/security/2017/dsa-4031
35+
- https://ubuntu.com/security/notices/USN-3685-1
36+
- https://web.archive.org/web/20200227145420/https://www.securityfocus.com/bid/100862
37+
- https://github.com/advisories/GHSA-wvmx-3rv2-5jgf

‎rubies/ruby/CVE-2021-32066.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
engine: ruby
3+
cve: 2021-32066
4+
ghsa: gx49-h5r3-q3xj
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2021-32066
6+
title: imap - StartTLS stripping attack
7+
date: 2021-08-01
8+
description: |
9+
An issue was discovered in Ruby through
10+
2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1.
11+
Net::IMAP does not raise an exception when StartTLS fails with
12+
an an unknown response, which might allow man-in-the-middle
13+
attackers to bypass the TLS protections by leveraging a network
14+
position between the client and the registry to block the
15+
StartTLS command, aka a "StartTLS stripping attack."
16+
cvss_v2: 5.8
17+
cvss_v3: 7.4
18+
patched_versions:
19+
- "~> 2.6.8"
20+
- "~> 2.7.4"
21+
- ">= 3.0.2"
22+
related:
23+
url:
24+
- https://nvd.nist.gov/vuln/detail/CVE-2021-32066
25+
- https://www.ruby-lang.org/en/news/2021/07/07/ruby-3-0-2-released
26+
- https://www.ruby-lang.org/en/news/2021/07/07/ruby-2-7-4-released
27+
- https://www.ruby-lang.org/en/news/2021/07/07/ruby-2-6-8-released
28+
- https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap
29+
- https://github.com/ruby/ruby/commit/a21a3b7d23704a01d34bd79d09dc37897e00922a
30+
- https://hackerone.com/reports/1178562
31+
- https://osv.dev/vulnerability/BIT-ruby-2021-32066?utm_source=copilot.com
32+
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
33+
- https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html
34+
- https://www.oracle.com/security-alerts/cpuapr2022.html
35+
- https://security.netapp.com/advisory/ntap-20210902-0004
36+
- https://security.gentoo.org/glsa/202401-27
37+
- https://github.com/advisories/GHSA-gx49-h5r3-q3xj

0 commit comments

Comments
 (0)