RubyGems Advisories.

sprockets vulnerable to Path Traversal

• Path traversal

<2.0.5 || >=2.1.0, <2.1.4 || >=2.2.0, <2.2.3 || >=2.3.0, <2.3.3 || >=2.4.0, <2.4.6 || >=2.5.0, <2.5.1 || >=2.6.0, <2.7.1 || >=2.8.0, <2.8.3 || >=2.9.0, <2.9.4 || >=2.10.0, <2.10.2 || >=2.11.0, <2.11.3 || >=2.12.0, <2.12.3 · fixed in 2.0.5, 2.1.4, 2.2.3, 2.3.3, 2.4.6, 2.5.1, 2.7.1, 2.8.3, 2.9.4, 2.10.2, 2.11.3, 2.12.3

actionpack vulnerable to Path Traversal

• Path traversal

>=3.0.0, <3.2.20 || >=4.0.0, <4.0.11 || >=4.1.0, <4.1.7 || >=4.2.0.beta1, <4.2.0.beta3 · fixed in 3.2.20, 4.0.11, 4.1.7, 4.2.0.beta3

sprout Arbitrary Code Execution vulnerability

• Code injection

=0.7.246 · no fixed version yet

Directory traversal vulnerability in Action View in Ruby on Rails

• Path traversal

<3.2.22.1 || >=4.0.0, <4.1.14.1 || >=4.2.0, <4.2.5.1 · fixed in 3.2.22.1, 4.1.14.1, 4.2.5.1

actionview contains Path Traversal vulnerability

• Path traversal

>=3.0.0, <3.2.22.2 || >=4.0.0, <4.1.14.2 · fixed in 3.2.22.2, 4.1.14.2

ActiveRecord in Ruby on Rails allows database-query bypass

• Broken access control
• Memory corruption

>=4.2.0, <4.2.7.1 · fixed in 4.2.7.1

actionview Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=3.0.0, <3.2.22.3 || >=4.0.0, <4.2.7.1 || >=5.0.0, <5.0.0.1 · fixed in 3.2.22.3, 4.2.7.1, 5.0.0.1

rack-mini-profiler allows remote attackers to obtain sensitive information about allocated strings and objects

• Information disclosure

<0.10.1 · fixed in 0.10.1

jQuery-UI vulnerable to Cross-site Scripting in dialog closeText

• Cross-site scripting (XSS)

<1.12.0 · fixed in 1.12.0

archive-tar-minitar and minitar vulnerable to Path Traversal

• Path traversal

<0.5.2 · fixed in 0.5.2

Directory traversal vulnerability in RubyZip

• Path traversal

<1.2.1 · fixed in 1.2.1

actionpack is vulnerable to denial of service via a crafted HTTP Accept header

<3.2.22.1 || >=4.0.0, <4.1.14.1 || >=4.2.0, <4.2.5.1 · fixed in 3.2.22.1, 4.1.14.1, 4.2.5.1

festivaltts4r allows arbitrary command execution

• Command injection

<=0.2.0 · no fixed version yet

safemode gem allows context-dependent attackers to obtain sensitive information via the inspect method

• Information disclosure

<1.2.4 · fixed in 1.2.4

actionpack allows remote code execution via application's unrestricted use of render method

• CWE-20

>=3.0.0, <3.2.22.2 || >=4.0.0, <4.1.14.2 || >=4.2.0, <4.2.5.2 · fixed in 3.2.22.2, 4.1.14.2, 4.2.5.2

OpenSSL gem for Ruby using inadequate encryption strength

• Weak cryptography or TLS

<2.0.0 · fixed in 2.0.0

Safemode Gem Has Incomplete List of Disallowed Inputs

• CWE-184

<1.3.2 · fixed in 1.3.2

activemodel contains Improper Input Validation

• CWE-20

>=4.1.0, <4.1.14.1 || >=4.2.0, <4.2.5.1 · fixed in 4.1.14.1, 4.2.5.1

espeak-ruby allows arbitrary command execution

• Broken access control

<1.0.3 · fixed in 1.0.3

Doorkeeper is vulnerable to replay attacks

• CWE-1254

<4.2.0 · fixed in 4.2.0