RubyGems Advisories.

Puppet Improper Input Validation vulnerability

• CWE-20

>=2.7.0, <2.7.22 || >=3.2.0, <3.2.2 · fixed in 2.7.22, 3.2.2

Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service

>=2.7.0, <2.7.23 || >=3.2.0, <3.2.4 · fixed in 2.7.23, 3.2.4

omniauth-facebook Cross-Site Request Forgery vulnerability

• Cross-site request forgery (CSRF)

>=1.4.1, <1.5.0 · fixed in 1.5.0

Cocaine Gem OS Command Injection vulnerability

• Command injection

>=0.4.0, <0.5.3 · fixed in 0.5.3

Phusion Passenger Denial of Service

• CWE-377

<3.0.21 || >=4.0.1, <4.0.5 · fixed in 3.0.21, 4.0.5

Script Injection in Show In Browser gem

• Path traversal

=0.0.3 · no fixed version yet

extlib does not properly restrict casts of string values

• CWE-704

<0.9.16 · fixed in 0.9.16

activesupport Improper Input Validation vulnerability

• CWE-20

>=3.0.0, <3.1.12 || >=3.2.0, <3.2.13 · fixed in 3.1.12, 3.2.13

md2pdf allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename

<=0.0.1 · no fixed version yet

actionpack Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=3.0, <3.0.17 || >=3.1.0, <3.1.8 || >=3.2.0, <3.2.8 · fixed in 3.0.17, 3.1.8, 3.2.8

Puppet allows local users to obtain sensitive configuration information

>=2.7.0, <2.7.18 · fixed in 2.7.18

Rack Vulnerable to Path Traversal

• Path traversal

>=1.4.0, <1.4.5 || >=1.5.0, <1.5.2 · fixed in 1.4.5, 1.5.2

actionpack Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<2.3.16 || >=3.0.0.beta, <3.0.17 || >=3.1.0, <3.1.8 || >=3.2.0, <3.2.8 · fixed in 2.3.16, 3.0.17, 3.1.8, 3.2.8

Thumbshooter vulnerable to Code Injection

• Code injection

<=0.1.5 · no fixed version yet

Shell Metacharacter Injection in kelredd-pruview

• Command injection

<=0.5.0 · no fixed version yet

Denial of service in ruby-openid

<2.2.2 · fixed in 2.2.2

actionpack vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

>=3.0.0, <3.2.16 || >=4.0.0, <4.0.2 · fixed in 3.2.16, 4.0.2

Puppet Improper Input Validation vulnerability

• CWE-20

>=2.7.0, <2.7.21 || >=3.1.0, <3.1.1 · fixed in 2.7.21, 3.1.1

nori contains Improper Input Validation

• CWE-20

>=1.0.0, <1.0.3 || >=1.1.0, <1.1.4 || >=2.0.0, <2.0.2 · fixed in 1.0.3, 1.1.4, 2.0.2

Rack rubygems receiving excessively long lines triggers out-of-memory error

• Memory corruption
• Denial of service

>=1.3.0, <1.3.8 || >=1.4.0, <1.4.3 · fixed in 1.3.8, 1.4.3

Active Record Improper Input Validation

• CWE-20

>=2.3.0, <2.3.18 || >=3.1.0, <3.1.12 || >=3.2.0, <3.2.13 · fixed in 2.3.18, 3.1.12, 3.2.13

Exposure of Sensitive Information in bio-basespace-sdk

• Information disclosure

<=0.1.7 · no fixed version yet

Active Record Improper Access Control

• Broken access control

>=3.1.0, <3.2.22.1 || >=4.0.0, <4.1.14.1 || >=4.2.0, <4.2.5.1 || >=5.0.0.beta1, <5.0.0.beta1.1 · fixed in 3.2.22.1, 4.1.14.1, 4.2.5.1, 5.0.0.beta1.1

rbovirt uses the rest-client gem with SSL verification disabled

<0.0.24 · fixed in 0.0.24

actionpack allows bypass of database-query restrictions

• Broken access control

>=3.0.0, <3.2.16 || >=4.0.0, <4.0.2 · fixed in 3.2.16, 4.0.2

actionpack Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=4.0.0, <4.0.2 · fixed in 4.0.2

activesupport Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=4.1.0, <4.1.11 || >=4.2.0, <4.2.2 · fixed in 4.1.11, 4.2.2

sfpagent Command Injection vulnerability

• Command injection

<0.4.15 · fixed in 0.4.15

rack-ssl Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<1.4.0 · fixed in 1.4.0

Rack vulnerable to Denial of Service via large parameter depth request

>=1.4.0, <1.4.6 || >=1.5.0, <1.5.4 || >=1.6.0, <1.6.2 · fixed in 1.4.6, 1.5.4, 1.6.2

rails-html-sanitizer Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<1.0.3 · fixed in 1.0.3

Active Record contains SQL Injection via improper range quoting

• SQL injection

>=4.0.0, <4.0.7 || >=4.1.0, <4.1.3 · fixed in 4.0.7, 4.1.3

Mail Gem CRLF Injection vulnerability

• Other injection

<2.5.5 · fixed in 2.5.5

actionpack is vulnerable to remote bypass authentication

>=3.1.0, <3.2.22.1 || >=4.0.0, <4.1.14.1 · fixed in 3.2.22.1, 4.1.14.1

Webbynode Code Injection vulnerability

• Code injection

<=1.0.5.3 · no fixed version yet

rest-client allows local users to obtain sensitive information by reading the log

• Information disclosure

<1.7.3 · fixed in 1.7.3

SQL Injection in Active Record

• SQL injection

>=2.0.0, <3.2.19 · fixed in 3.2.19

Rails vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

>=3.0.0, <3.2.17 || >=4.0.0, <4.0.3 · fixed in 3.2.17, 4.0.3

activesupport vulnerable to Denial of Service via large XML document depth

<3.2.22 || >=4.0.0.beta1, <4.1.11 || >=4.2.0.beta1, <4.2.2 · fixed in 3.2.22, 4.1.11, 4.2.2

Array data injection vulnerability in activerecord

• SQL injection

>=4.0.0, <4.0.3 || >=4.1.0.beta1, <4.1.0.beta2 · fixed in 4.0.3, 4.1.0.beta2

Arabic Prawn allows remote attackers to execute arbitrary commands via shell metacharacters

<=0.0.1 · no fixed version yet

Directory traversal vulnerability in actionpack

• Path traversal

>=3.0.0, <3.2.21 || >=4.0.0, <4.0.12 || >=4.1.0, <4.1.8 || >=4.2.0.beta1, <4.2.0.beta4 · fixed in 3.2.21, 4.0.12, 4.1.8, 4.2.0.beta4

rails-html-sanitizer Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<1.0.3 · fixed in 1.0.3

Local API Login Credentials Disclosure in paratrooper-pingdom

• Information disclosure

<=1.0.0 · no fixed version yet

sentry-raven allows remote attackers to cause a denial of service via a large exponent value in a scientific number

• Denial of service

<0.12.2 · fixed in 0.12.2

Active Record subject to strong parameters protection bypass

• Broken access control

>=4.0.0, <4.0.9 || >=4.1.0, <4.1.5 · fixed in 4.0.9, 4.1.5

actionpack is vulnerable to denial of service because of a wildcard controller route

>=4.0.0, <4.2.5.1 · fixed in 4.2.5.1

Paratrooper-newrelic Exposes of Sensitive Information to an Unauthorized Actor

• Information disclosure

<=1.0.1 · no fixed version yet

facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability

<1.7.6 || >=2.0.0, <2.0.2 · fixed in 1.7.6, 2.0.2

will_paginate Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<3.0.5 · fixed in 3.0.5

actionpack Improper Input Validation vulnerability

• CWE-20

>=3.0.0, <3.2.17 · fixed in 3.2.17

colorscore Command Injection vulnerability

• Command injection

<0.0.5 · fixed in 0.0.5

actionpack Path Traversal vulnerability

• Path traversal

>=3.0.0, <3.2.18 || >=4.0.0, <4.0.5 || >=4.1.0, <4.1.1 · fixed in 3.2.18, 4.0.5, 4.1.1

paperclip Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<4.2.2 · fixed in 4.2.2

actionpack vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

>=3.0.0, <3.2.16 || >=4.0.0, <4.0.2 · fixed in 3.2.16, 4.0.2

Web Console (Ruby gem) contains whitelisted_ips bypass

• Broken access control

<2.1.3 · fixed in 2.1.3

rails-html-sanitizer Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<1.0.3 · fixed in 1.0.3

jquery-rails and jquery-ujs subject to Exposure of Sensitive Information

• Information disclosure

<3.1.3 || >=4.0.0, <4.0.4 · fixed in 3.1.3, 4.0.4

Aescrypt does not sufficiently use random values

• Weak cryptography or TLS

<=1.0.0 · no fixed version yet

Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js

• CWE-670
• CWE-1254

<2.4.24 · fixed in 2.4.24