Skip to content

Commit 85bec7f

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@722d9d9 
1 parent 6b4bb2a commit 85bec7f

File tree

5 files changed

+245
-0
lines changed

5 files changed

+245
-0
lines changed

‎advisories/_posts/2026-03-16-CVE-2026-32700.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-32700 (devise): Confirmable "change email" race condition permits
4+
user to confirm email they have no access to'
5+
comments: false
6+
categories:
7+
- devise
8+
advisory:
9+
gem: devise
10+
cve: 2026-32700
11+
ghsa: 57hq-95w6-v4fc
12+
url: https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc
13+
title: Confirmable "change email" race condition permits user to confirm email they
14+
have no access to
15+
date: 2026-03-16
16+
description: |
17+
## Impact
18+
19+
A race condition in Devise's Confirmable module allows an attacker
20+
to confirm an email address they do not own. This affects any Devise
21+
application using the reconfirmable option (the default when using
22+
Confirmable with email changes).
23+
24+
By sending two concurrent email change requests, an attacker can
25+
desynchronize the confirmation_token and unconfirmed_email fields.
26+
The confirmation token is sent to an email the attacker controls,
27+
but the unconfirmed_email in the database points to a victim's
28+
email address. When the attacker uses the token, the victim's email
29+
is confirmed on the attacker's account.
30+
31+
## Patch
32+
33+
This is patched in Devise v5.0.3. Users should upgrade as soon as possible.
34+
35+
## Workaround
36+
37+
Applications can override this specific method from Devise models
38+
to force unconfirmed_email to be persisted when unchanged:
39+
(assuming your model is User)
40+
41+
```
42+
class User < ApplicationRecord
43+
protected
44+
45+
def postpone_email_change_until_confirmation_and_regenerate_confirmation_token
46+
unconfirmed_email_will_change!
47+
super
48+
end
49+
end
50+
```
51+
52+
Note: Mongoid does not seem to respect that will_change! should
53+
force the attribute to be persisted, even if it did not really
54+
change, so you might have to implement a workaround similar to
55+
Devise by setting changed_attributes["unconfirmed_email"] = nil as well.
56+
patched_versions:
57+
- ">= 5.0.3"
58+
related:
59+
url:
60+
- https://about.gitlab.com/releases/2023/01/09/security-release-gitlab-15-7-2-released
61+
- https://github.com/heartcombo/devise/pull/5784
62+
- https://github.com/heartcombo/devise/issues/5783
63+
- https://portswigger.net/research/smashing-the-state-machine
64+
- https://groups.google.com/g/heartcombo/c/ieiLJhG4EGE/m/PNlIQv54AAAJ
65+
- https://groups.google.com/g/heartcombo/c/o9mtkcfvt_g/m/SABX6rp8AgAJ
66+
- https://groups.google.com/g/heartcombo/c/XDII89RV6Ak/m/AJMOyayNAgAJ
67+
- https://groups.google.com/g/heartcombo/c/TWge7vKELhc/m/gRTrgKz4CQAJ
68+
- https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc
69+
---

‎advisories/_posts/2026-03-17-CVE-2026-4324.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-4324 (katello): Katello - Denial of Service and potential information
4+
disclosure via SQL injection'''
5+
comments: false
6+
categories:
7+
- katello
8+
advisory:
9+
gem: katello
10+
cve: 2026-4324
11+
ghsa: fwj4-6wgp-mpxm
12+
url: https://access.redhat.com/security/cve/CVE-2026-4324
13+
title: Katello - Denial of Service and potential information disclosure via SQL
14+
injection'
15+
date: 2026-03-17
16+
description: |
17+
A flaw was found in the Katello plugin for Red Hat Satellite. This
18+
vulnerability, caused by improper sanitization of user-provided
19+
input, allows a remote attacker to inject arbitrary SQL commands
20+
into the sort_by parameter of the /api/hosts/bootc_images API
21+
endpoint. This can lead to a Denial of Service (DoS) by triggering
22+
database errors, and potentially enable Boolean-based Blind SQL
23+
injection, which could allow an attacker to extract sensitive
24+
information from the database.
25+
cvss_v3: 5.4
26+
patched_versions:
27+
- ">= 4.19.1"
28+
related:
29+
url:
30+
- https://nvd.nist.gov/vuln/detail/CVE-2026-4324
31+
- https://access.redhat.com/security/cve/CVE-2026-4324
32+
- https://bugzilla.redhat.com/show_bug.cgi?id=2448349
33+
- https://github.com/Katello/katello/commit/a0a793b08d4f0a897ee985d79a687ad043f99e57
34+
- https://github.com/advisories/GHSA-fwj4-6wgp-mpxm
35+
---

‎advisories/_posts/2026-03-18-CVE-2026-33209.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-33209 (avo): Avo has a XSS vulnerability on `return_to` param'
4+
comments: false
5+
categories:
6+
- avo
7+
advisory:
8+
gem: avo
9+
cve: 2026-33209
10+
ghsa: 762r-27w2-q22j
11+
url: https://github.com/avo-hq/avo/security/advisories/GHSA-762r-27w2-q22j
12+
title: Avo has a XSS vulnerability on `return_to` param
13+
date: 2026-03-18
14+
description: |
15+
## Description
16+
17+
A reflected cross-site scripting (XSS) vulnerability exists in
18+
the `return_to` query parameter used in the avo interface.
19+
20+
An attacker can craft a malicious URL that injects arbitrary
21+
JavaScript, which is executed when he clicks a dynamically
22+
generated navigation button.
23+
24+
## Impact
25+
26+
This vulnerability may allow execution of arbitrary JavaScript
27+
in the context of the application.
28+
29+
Impact varies depending on deployment:
30+
- In unauthenticated setups: exploitable via crafted links sent to users.
31+
- In authenticated setups: limited to authenticated users and
32+
requires interaction.
33+
cvss_v4: 5.3
34+
patched_versions:
35+
- ">= 3.30.3"
36+
related:
37+
url:
38+
- https://github.com/avo-hq/avo/security/advisories/GHSA-762r-27w2-q22j
39+
- https://github.com/advisories/GHSA-762r-27w2-q22j
40+
---

‎advisories/_posts/2026-03-18-GHSA-46fp-8f5p-pf2m.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-46fp-8f5p-pf2m (loofah): Improper detection of disallowed URIs by Loofah
4+
`allowed_uri?`'
5+
comments: false
6+
categories:
7+
- loofah
8+
advisory:
9+
gem: loofah
10+
ghsa: 46fp-8f5p-pf2m
11+
url: https://github.com/flavorjones/loofah/security/advisories/GHSA-46fp-8f5p-pf2m
12+
title: Improper detection of disallowed URIs by Loofah `allowed_uri?`
13+
date: 2026-03-18
14+
description: |
15+
## Summary
16+
17+
`Loofah::HTML5::Scrub.allowed_uri?` does not correctly reject
18+
`javascript:` URIs when the scheme is split by HTML entity-encoded
19+
control characters such as `&#13;` (carriage return), `&#10;`
20+
(line feed), or `&#9;` (tab).
21+
22+
## Details
23+
24+
The `allowed_uri?` method strips literal control characters before
25+
decoding HTML entities. Payloads like `java&#13;script:alert(1)`
26+
survive the control character strip, then `&#13;` is decoded to
27+
a carriage return, producing `java\rscript:alert(1)`.
28+
29+
Note that the Loofah sanitizer's default `sanitize()` path is
30+
**not affected** because Nokogiri decodes HTML entities during
31+
parsing before Loofah evaluates the URI protocol. This issue only
32+
affects direct callers of the `allowed_uri?` string-level helper
33+
when passing HTML-encoded strings.
34+
35+
## Impact
36+
37+
Applications that call `Loofah::HTML5::Scrub.allowed_uri?` to
38+
validate user-controlled URLs and then render approved URLs into
39+
`href` or other browser-interpreted URI attributes may be
40+
vulnerable to cross-site scripting (XSS).
41+
42+
This only affects Loofah `2.25.0`.
43+
44+
## Mitigation
45+
46+
Upgrade to Loofah >= `2.25.1`.
47+
48+
## Credit
49+
50+
Responsibly reported by HackOne user `@smlee`.
51+
unaffected_versions:
52+
- "< 2.25.0"
53+
patched_versions:
54+
- ">= 2.25.1"
55+
related:
56+
url:
57+
- https://github.com/flavorjones/loofah/security/advisories/GHSA-46fp-8f5p-pf2m
58+
- https://github.com/advisories/GHSA-46fp-8f5p-pf2m
59+
---

‎advisories/_posts/2026-03-19-CVE-2026-33210.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-33210 (json): Ruby JSON has a format string injection vulnerability'
4+
comments: false
5+
categories:
6+
- json
7+
advisory:
8+
gem: json
9+
cve: 2026-33210
10+
ghsa: 3m6g-2423-7cp3
11+
url: https://github.com/ruby/json/security/advisories/GHSA-3m6g-2423-7cp3
12+
title: Ruby JSON has a format string injection vulnerability
13+
date: 2026-03-19
14+
description: |
15+
### Impact
16+
17+
A format string injection vulnerability than that lead to denial of
18+
service attacks or information disclosure, when the `allow_duplicate_key:
19+
false` parsing option is used to parse user supplied documents.
20+
21+
This option isn't the default, if you didn't opt-in to use it,
22+
you are not impacted.
23+
24+
### Patches
25+
26+
Patched in `2.19.2`.
27+
28+
### Workarounds
29+
30+
The issue can be avoided by not using the `allow_duplicate_key: false`
31+
parsing option.
32+
unaffected_versions:
33+
- "< 2.14.0"
34+
patched_versions:
35+
- "~> 2.15.2.1"
36+
- "~> 2.17.1.2"
37+
- ">= 2.19.2"
38+
related:
39+
url:
40+
- https://github.com/ruby/json/security/advisories/GHSA-3m6g-2423-7cp3
41+
- https://github.com/advisories/GHSA-3m6g-2423-7cp3
42+
---

0 commit comments

Comments
 (0)