Skip to content

Commit edd9a2b

Browse files
author
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@b08435d 
1 parent ce6a31a commit edd9a2b

File tree

251 files changed

+2371
-1256
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

251 files changed

+2371
-1256
lines changed

‎advisories/_posts/2007-05-21-OSVDB-101157.md

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
layout: advisory
3-
title: 'OSVDB-101157: json Gem for Ruby Data Handling Stack Buffer Overflow'
3+
title: ! 'OSVDB-101157: json Gem for Ruby Data Handling Stack Buffer Overflow'
44
comments: false
55
categories:
66
- json
@@ -10,12 +10,18 @@ advisory:
1010
url: http://osvdb.org/show/osvdb/101157
1111
title: json Gem for Ruby Data Handling Stack Buffer Overflow
1212
date: 2007-05-21
13-
description: |
14-
json Gem for Ruby contains an overflow condition that is triggered as
13+
description: ! 'json Gem for Ruby contains an overflow condition that is triggered
14+
as
15+
1516
user-supplied input is not properly validated when handling specially crafted
17+
1618
data. This may allow a remote attacker to cause a stack-based buffer
19+
1720
overflow, resulting in a denial of service or potentially allowing the
21+
1822
execution of arbitrary code.
23+
24+
'
1925
patched_versions:
20-
- ">= 1.1.0"
26+
- ! '>= 1.1.0'
2127
---

‎advisories/_posts/2007-06-15-OSVDB-95668.md

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
layout: advisory
3-
title: 'OSVDB-95668: Builder Gem for Ruby Tag Name Handling Private Method Exposure'
3+
title: ! 'OSVDB-95668: Builder Gem for Ruby Tag Name Handling Private Method Exposure'
44
comments: false
55
categories:
66
- builder
@@ -10,11 +10,16 @@ advisory:
1010
url: http://osvdb.org/show/osvdb/95668
1111
title: Builder Gem for Ruby Tag Name Handling Private Method Exposure
1212
date: 2007-06-15
13-
description: |
14-
Builder Gem for Ruby contains a flaw in the handling of tag names. The issue
13+
description: ! 'Builder Gem for Ruby contains a flaw in the handling of tag names.
14+
The issue
15+
1516
is triggered when the program reads tag names from XML data and then calls a
17+
1618
method with that name. With a specially crafted file, a context-dependent
19+
1720
attacker can call private methods and manipulate data.
21+
22+
'
1823
patched_versions:
19-
- ">= 2.1.2"
24+
- ! '>= 2.1.2'
2025
---

‎advisories/_posts/2007-11-27-CVE-2007-6183.md

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
layout: advisory
3-
title: 'CVE-2007-6183: Ruby-GNOME2 gtk/src/rbgtkmessagedialog.c Gtk::MessageDialog.new()
3+
title: ! 'CVE-2007-6183: Ruby-GNOME2 gtk/src/rbgtkmessagedialog.c Gtk::MessageDialog.new()
44
Function Format String'
55
comments: false
66
categories:
@@ -13,12 +13,16 @@ advisory:
1313
title: Ruby-GNOME2 gtk/src/rbgtkmessagedialog.c Gtk::MessageDialog.new() Function
1414
Format String
1515
date: 2007-11-27
16-
description: |
17-
Format string vulnerability in the mdiag_initialize function in
16+
description: ! 'Format string vulnerability in the mdiag_initialize function in
17+
1818
gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and
19+
1920
SVN versions before 20071127, allows context-dependent attackers to execute
21+
2022
arbitrary code via format string specifiers in the message parameter.
23+
24+
'
2125
cvss_v2: 6.8
2226
patched_versions:
23-
- "> 0.16.0"
27+
- ! '> 0.16.0'
2428
---

‎advisories/_posts/2008-08-12-CVE-2008-7311.md

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,11 @@
11
---
22
layout: advisory
3-
title: |
4-
CVE-2008-7311: Spree Hardcoded config.action_controller_session Hash Value Cryptographic
3+
title: ! 'CVE-2008-7311: Spree Hardcoded config.action_controller_session Hash Value
4+
Cryptographic
5+
56
Protection Weakness
7+
8+
'
69
comments: false
710
categories:
811
- spree
@@ -11,15 +14,20 @@ advisory:
1114
cve: 2008-7311
1215
osvdb: 81506
1316
url: https://spreecommerce.com/blog/security-vulernability-session-cookie-store
14-
title: |
15-
Spree Hardcoded config.action_controller_session Hash Value Cryptographic
17+
title: ! 'Spree Hardcoded config.action_controller_session Hash Value Cryptographic
18+
1619
Protection Weakness
20+
21+
'
1722
date: 2008-08-12
18-
description: |
19-
Spree contains a hardcoded flaw related to the
23+
description: ! 'Spree contains a hardcoded flaw related to the
24+
2025
config.action_controller_session hash value. This may allow an attacker to
26+
2127
more easily bypass cryptographic protection.
28+
29+
'
2230
cvss_v2: 5.0
2331
patched_versions:
24-
- ">= 0.3.0"
32+
- ! '>= 0.3.0'
2533
---

‎advisories/_posts/2008-08-15-OSVDB-95749.md

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
layout: advisory
3-
title: 'OSVDB-95749: activeresource Gem for Ruby lib/active_resource/connection.rb
3+
title: ! 'OSVDB-95749: activeresource Gem for Ruby lib/active_resource/connection.rb
44
request Function Multiple Variable Format String'
55
comments: false
66
categories:
@@ -12,13 +12,20 @@ advisory:
1212
title: activeresource Gem for Ruby lib/active_resource/connection.rb request Function
1313
Multiple Variable Format String
1414
date: 2008-08-15
15-
description: |
16-
activeresource contains a format string flaw in the request function of
15+
description: ! 'activeresource contains a format string flaw in the request function
16+
of
17+
1718
lib/active_resource/connection.rb. The issue is triggered as format string
19+
1820
specifiers (e.g. %s and %x) are not properly sanitized in user-supplied input
19-
when passed via the 'result.code' and 'result.message' variables. This may
21+
22+
when passed via the ''result.code'' and ''result.message'' variables. This may
23+
2024
allow a remote attacker to cause a denial of service or potentially execute
25+
2126
arbitrary code.
27+
28+
'
2229
patched_versions:
23-
- ">= 2.2.0"
30+
- ! '>= 2.2.0'
2431
---

‎advisories/_posts/2008-09-22-CVE-2008-7310.md

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
---
22
layout: advisory
3-
title: |
4-
CVE-2008-7310: Spree Hash Restriction Weakness URL Parsing Order State Value Manipulation
3+
title: ! 'CVE-2008-7310: Spree Hash Restriction Weakness URL Parsing Order State Value
4+
Manipulation
5+
6+
'
57
comments: false
68
categories:
79
- spree
@@ -10,13 +12,17 @@ advisory:
1012
cve: 2008-7310
1113
osvdb: 81505
1214
url: https://spreecommerce.com/blog/security-vulnerability-mass-assignment
13-
title: |
14-
Spree Hash Restriction Weakness URL Parsing Order State Value Manipulation
15+
title: ! 'Spree Hash Restriction Weakness URL Parsing Order State Value Manipulation
16+
17+
'
1518
date: 2008-09-22
16-
description: |
17-
Spree contains a hash restriction weakness that occurs when parsing a
19+
description: ! 'Spree contains a hash restriction weakness that occurs when parsing
20+
a
21+
1822
modified URL. This may allow an attacker to manipulate order state values.
23+
24+
'
1925
cvss_v2: 5.0
2026
patched_versions:
21-
- ">= 0.3.0"
27+
- ! '>= 0.3.0'
2228
---

‎advisories/_posts/2008-10-10-OSVDB-95376.md

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
layout: advisory
3-
title: 'OSVDB-95376: Oracle "enhanced" ActiveRecord Gem for Ruby :limit / :offset
3+
title: ! 'OSVDB-95376: Oracle "enhanced" ActiveRecord Gem for Ruby :limit / :offset
44
SQL Injection'
55
comments: false
66
categories:
@@ -11,13 +11,20 @@ advisory:
1111
url: http://osvdb.org/show/osvdb/95376
1212
title: Oracle "enhanced" ActiveRecord Gem for Ruby :limit / :offset SQL Injection
1313
date: 2008-10-10
14-
description: |
15-
Oracle "enhanced" ActiveRecord Gem for Ruby contains a flaw that may allow an
14+
description: ! 'Oracle "enhanced" ActiveRecord Gem for Ruby contains a flaw that
15+
may allow an
16+
1617
attacker to carry out an SQL injection attack. The issue is due to the
18+
1719
program not properly sanitizing user-supplied input related to the :limit and
20+
1821
:offset functions. This may allow an attacker to inject or manipulate SQL
22+
1923
queries in the back-end database, allowing for the manipulation or disclosure
24+
2025
of arbitrary data.
26+
27+
'
2128
patched_versions:
22-
- ">= 1.1.8"
29+
- ! '>= 1.1.8'
2330
---

‎advisories/_posts/2009-12-07-CVE-2009-4123.md

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
layout: advisory
3-
title: 'CVE-2009-4123: jruby-openssl Gem for JRuby fails to do proper certificate
3+
title: ! 'CVE-2009-4123: jruby-openssl Gem for JRuby fails to do proper certificate
44
validation'
55
comments: false
66
categories:
@@ -12,13 +12,20 @@ advisory:
1212
url: http://jruby.org/2009/12/07/vulnerability-in-jruby-openssl
1313
title: jruby-openssl Gem for JRuby fails to do proper certificate validation
1414
date: 2009-12-07
15-
description: |
16-
A security problem involving peer certificate verification was found where
15+
description: ! 'A security problem involving peer certificate verification was found
16+
where
17+
1718
failed verification silently did nothing, making affected applications
19+
1820
vulnerable to attackers. Attackers could lead a client application to believe
21+
1922
that a secure connection to a rogue SSL server is legitimate. Attackers could
23+
2024
also penetrate client-validated SSL server applications with a dummy
25+
2126
certificate.
27+
28+
'
2229
patched_versions:
23-
- ">= 0.6"
30+
- ! '>= 0.6'
2431
---

‎advisories/_posts/2010-02-01-OSVDB-62067.md

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
layout: advisory
3-
title: 'OSVDB-62067: bcrypt-ruby Gem for Ruby incorrect encoding of non US-ASCII characters
4-
(JRuby only)'
3+
title: ! 'OSVDB-62067: bcrypt-ruby Gem for Ruby incorrect encoding of non US-ASCII
4+
characters (JRuby only)'
55
comments: false
66
categories:
77
- bcrypt
@@ -13,14 +13,21 @@ advisory:
1313
title: bcrypt-ruby Gem for Ruby incorrect encoding of non US-ASCII characters (JRuby
1414
only)
1515
date: 2010-02-01
16-
description: |
17-
bcrypt-ruby Gem for Ruby suffered from a bug related to character
16+
description: ! 'bcrypt-ruby Gem for Ruby suffered from a bug related to character
17+
1818
encoding that substantially reduced the entropy of hashed passwords
19+
1920
containing non US-ASCII characters. An incorrect encoding step
20-
transparently replaced such characters by '?' prior to hashing. In the
21+
22+
transparently replaced such characters by ''?'' prior to hashing. In the
23+
2124
worst case of a password consisting solely of non-US-ASCII characters,
25+
2226
this would cause its hash to be equivalent to all other such passwords
27+
2328
of the same length. This issue only affects the JRuby implementation.
29+
30+
'
2431
patched_versions:
25-
- ">= 2.1.4"
32+
- ! '>= 2.1.4'
2633
---

‎advisories/_posts/2010-08-12-OSVDB-114600.md

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
layout: advisory
3-
title: 'OSVDB-114600: curb Gem for Ruby Empty http_put Body Handling Remote DoS'
3+
title: ! 'OSVDB-114600: curb Gem for Ruby Empty http_put Body Handling Remote DoS'
44
comments: false
55
categories:
66
- curb
@@ -10,10 +10,14 @@ advisory:
1010
url: http://osvdb.org/show/osvdb/114600
1111
title: curb Gem for Ruby Empty http_put Body Handling Remote DoS
1212
date: 2010-08-12
13-
description: |
14-
curb Gem for Ruby contains a flaw that is triggered when handling an empty
13+
description: ! 'curb Gem for Ruby contains a flaw that is triggered when handling
14+
an empty
15+
1516
http_put body. This may allow a remote attacker to crash an application
17+
1618
linked against the library.
19+
20+
'
1721
patched_versions:
18-
- ">= 0.7.8"
22+
- ! '>= 0.7.8'
1923
---

‎advisories/_posts/2010-11-02-CVE-2010-3978.md

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,11 @@
11
---
22
layout: advisory
3-
title: |
4-
CVE-2010-3978: Spree Multiple Script JSON Request Validation Weakness Remote Information
3+
title: ! 'CVE-2010-3978: Spree Multiple Script JSON Request Validation Weakness Remote
4+
Information
5+
56
Disclosure
7+
8+
'
69
comments: false
710
categories:
811
- spree
@@ -11,18 +14,25 @@ advisory:
1114
cve: 2010-3978
1215
osvdb: 69098
1316
url: https://spreecommerce.com/blog/json-hijacking-vulnerability
14-
title: |
15-
Spree Multiple Script JSON Request Validation Weakness Remote Information
17+
title: ! 'Spree Multiple Script JSON Request Validation Weakness Remote Information
18+
1619
Disclosure
20+
21+
'
1722
date: 2010-11-02
18-
description: |
19-
Spree contains a flaw that may lead to an unauthorized information
23+
description: ! 'Spree contains a flaw that may lead to an unauthorized information
24+
2025
disclosure. The issue is triggered when the application exchanges data using
26+
2127
the JSON service without validating requests, which will disclose sensitive
28+
2229
user and order information to a context-dependent attacker when a logged-in
30+
2331
user visits a crafted website.
32+
33+
'
2434
cvss_v2: 5.0
2535
patched_versions:
26-
- "~> 0.11.2"
27-
- ">= 0.30.0"
36+
- ~> 0.11.2
37+
- ! '>= 0.30.0'
2838
---

‎advisories/_posts/2011-01-12-OSVDB-106954.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
layout: advisory
3-
title: 'OSVDB-106954: quick_magick Gem for Ruby QuickMagick::Image.read Function Crafted
4-
String Handling Remote Command Injection'
3+
title: ! 'OSVDB-106954: quick_magick Gem for Ruby QuickMagick::Image.read Function
4+
Crafted String Handling Remote Command Injection'
55
comments: false
66
categories:
77
- quick_magick

0 commit comments

Comments
 (0)