GHSA SYNC: 1 modified advisory; 1 new advisory

Author: jasnow

rubies/mruby/CVE-2020-36401.yml

@@ -0,0 +1,28 @@
+---
+engine: mruby
+cve: 2020-36401
+ghsa: qq64-7fh7-7hmw
+url: https://nvd.nist.gov/vuln/detail/CVE-2020-36401
+title: double free vulnerabliity
+date: 2021-06-30
+description: |
+  mruby 2.1.2 has a double free in mrb_default_allocf (called
+  from mrb_free and obj_free).
+
+  # RELEASE NOTES
+
+  Cloned "mruby" repo, ran "git fetch --all --tags", then
+  "git tag --contains 97319697c8f9f6ff27b32589947e1918e3015503"
+   and got "3.0.0-preview, 3.0.0-rc, 3.0.0, ... 3.4.0-rc2".
+cvss_v2: 6.8
+cvss_v3: 7.8
+patched_versions:
+  - ">= 3.0.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-36401
+    - https://mruby.org/releases/2021/03/05/mruby-3.0.0-released.html
+    - https://github.com/mruby/mruby/commit/97319697c8f9f6ff27b32589947e1918e3015503
+    - https://issues.oss-fuzz.com/issues/42485317
+    - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/mruby/OSV-2020-744.yaml
+    - https://github.com/advisories/GHSA-qq64-7fh7-7hmw

rubies/ruby/CVE-2017-0898.yml

@@ -1,7 +1,8 @@
 ---
 engine: ruby
 cve: 2017-0898
-url: https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/
+url: https://nvd.nist.gov/vuln/detail/CVE-2017-0898
+ghsa: wvmx-3rv2-5jgf
 title: Buffer underrun vulnerability in Kernel.sprintf
 date: 2017-09-14
 description: |
@@ -13,7 +14,29 @@ description: |
   the Ruby interpreter may crash.
 
   All users running an affected release should upgrade immediately.
+
+  Also impacted mruby - issue #3722 mentioned it was fixed in 1.3.0.
+cvss_v2: 6.4
+cvss_v3: 9.1
 patched_versions:
   - "~> 2.2.8"
   - "~> 2.3.5"
   - ">= 2.4.2"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-0898
+    - https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898
+    - https://github.com/mruby/mruby/issues/3722
+    - https://hackerone.com/reports/212241
+    - https://access.redhat.com/errata/RHSA-2017:3485
+    - https://access.redhat.com/errata/RHSA-2018:0378
+    - https://access.redhat.com/errata/RHSA-2018:0583
+    - https://access.redhat.com/errata/RHSA-2018:0585
+    - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
+    - https://security.gentoo.org/glsa/201710-18
+    - https://www.debian.org/security/2017/dsa-4031
+    - https://ubuntu.com/security/notices/USN-3685-1
+    - https://web.archive.org/web/20200227145420/https://www.securityfocus.com/bid/100862
+    - https://github.com/advisories/GHSA-wvmx-3rv2-5jgf
+notes: |
+  - Do I need to duplicate this advisory under "mruby" directory?