Merge pull request #264 from xthk/CVE-2016-4442

phillmv · web-flow · commit 18786e5fd155 · 2016-08-04T09:54:07.000-04:00
Add CVE-2016-4442 for rack-mini-profiler
diff --git a/gems/rack-mini-profiler/CVE-2016-4442.yml b/gems/rack-mini-profiler/CVE-2016-4442.yml
@@ -0,0 +1,17 @@
+---
+gem: rack-mini-profiler
+cve: 2016-4442
+url: https://github.com/MiniProfiler/rack-mini-profiler/commit/4273771d65f1a7411e3ef5843329308d0e2d257c
+title: rack-mini-profiler may disclose information to unauthorized users
+date: 2016-05-18
+description: >-
+  Carefully crafted requests can expose information about
+  strings and objects allocated during the request for unauthorised
+  users.
+
+patched_versions:
+  - ">= 0.10.1"
+
+related:
+  url:
+    - http://seclists.org/oss-sec/2016/q2/516
