RubyGems Advisories.

Rails activerecord gem has Improper Input Validation vulnerability

• CWE-20

>=2.3.9, <2.3.10 || >=3.0.0, <3.0.1 · fixed in 2.3.10, 3.0.1

Moderate severity vulnerability that affects rails

• Information disclosure

<1.2.4 · fixed in 1.2.4

Active Record vulnerable to SQL Injection via nested query parameters

• SQL injection

>=3.0.0, <3.0.13 || >=3.1.0, <3.1.5 || >=3.2.0, <3.2.4 · fixed in 3.0.13, 3.1.5, 3.2.4

actionpack and activesupport vulnerable to information leaks

• Information disclosure

>=2.1.0, <2.2.3 || >=2.3.0, <2.3.4 · fixed in 2.2.3, 2.3.4

actionpack CRLF injection vulnerability

• Code injection

>=2.3.0, <2.3.13 · fixed in 2.3.13

Mail Improper Input Validation vulnerability

• CWE-20

<2.2.15 · fixed in 2.2.15

Mail Gem Path Traversal vulnerability

• Path traversal

<2.4.4 · fixed in 2.4.4

Puppet allows local users to overwrite arbitrary files via a symlink attack

>=2.7.1, <2.7.13 · fixed in 2.7.13

Rails Denial of Service vulnerability

>=1.1.0, <1.1.6 · fixed in 1.1.6

Moderate severity vulnerability that affects rails

• Cross-site scripting (XSS)

<2.2.2 || >=2.3.0, <2.3.5 · fixed in 2.2.2, 2.3.5

activesupport Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=2.0.0, <2.3.13 || >=3.0.0, <3.0.10 · fixed in 2.3.13, 3.0.10

actionpack Improper Authentication vulnerability

• Authentication bypass

<2.3.5 || >=3.0.0.beta, <3.0.16 || >=3.1.0, <3.1.7 || >=3.2.0, <3.2.7 · fixed in 2.3.5, 3.0.16, 3.1.7, 3.2.7

Cross site scripting that affects rails

• Cross-site scripting (XSS)

>=2.0.0, <2.2.3 || >=2.3.0, <2.3.4 · fixed in 2.2.3, 2.3.4

Improper Input Validation in actionpack

• CWE-20

>=2.1.0, <2.1.3 || >=2.2.0, <2.2.2 · fixed in 2.1.3, 2.2.2

activerecord vulnerable to SQL Injection

• SQL injection

<2.3.15 || >=3.0.0.beta, <3.0.14 || >=3.1.0, <3.1.6 || >=3.2.0, <3.2.6 · fixed in 2.3.15, 3.0.14, 3.1.6, 3.2.6

Rails actionpack gem vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

<2.3.11 || >=3.0.0, <3.0.4 · fixed in 2.3.11, 3.0.4

sqlite3-ruby uses weak permissions for unspecified files, which allows local users to gain privileges

<1.2.4 · fixed in 1.2.4

WEBrick Improper Input Validation vulnerability

• CWE-20

<1.4.0 · fixed in 1.4.0

actionpack allows remote attackers to bypass intended access restrictions

>=3.0.0, <3.0.4 · fixed in 3.0.4

actionpack Improper Input Validation vulnerability

• CWE-20

>=2.3.0, <2.3.13 · fixed in 2.3.13

Cross-site Scripting in actionpack

• Cross-site scripting (XSS)

>=3.0.0, <3.0.12 || >=3.1.0, <3.1.4 || >=3.2.0, <3.2.2 · fixed in 3.0.12, 3.1.4, 3.2.2

actionpack Cross-Site Request Forgery vulnerability

• Cross-site request forgery (CSRF)

>=2.1.0, <2.3.11 || >=3.0.0, <3.0.4 · fixed in 2.3.11, 3.0.4

activesupport in Rails vulnerable to incorrect data conversion

• Other injection

>=2.3.2, <2.3.16 || >=3.0.0, <3.0.20 · fixed in 2.3.16, 3.0.20

JSON gem has Improper Input Validation vulnerability

• CWE-20

<1.5.5 || >=1.6.0, <1.6.8 || >=1.7.0, <1.7.7 · fixed in 1.5.5, 1.6.8, 1.7.7

MiniMagick Gem for Ruby URI Handling Arbitrary Command Injection

• Code injection

<3.6.0 · fixed in 3.6.0

insecure temporary directory usage in passenger

• Path traversal

<4.0.6 · fixed in 4.0.6

fastreader Gem for Ruby URI Handling Arbitrary Command Injection

• Code injection

>=1.0.0 · no fixed version yet

RDoc contains XSS vulnerability

• Cross-site scripting (XSS)

>=2.3.0, <3.12.1 · fixed in 3.12.1

Wicked gem contains Path traversal vulnerability

• Path traversal

<1.0.1 · fixed in 1.0.1

actionmailer email address processing causes Denial of service

• Memory corruption

>=3.0.0, <3.2.15 · fixed in 3.2.15

Sounder Contains Arbitrary Command Execution Vulnerability

• Code injection

<1.0.2 · fixed in 1.0.2

i18n gem Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<0.6.6 · fixed in 0.6.6

RedCloth Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<4.3.0 · fixed in 4.3.0

Code injection in dragonfly gem

• Other injection

<1.0.0 · fixed in 1.0.0

jquery-ui Tooltip widget vulnerable to XSS

• Cross-site scripting (XSS)

<1.10.0 · fixed in 1.10.0

actionpack Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<2.3.18 || >=3.0.0, <3.1.12 || >=3.2.0, <3.2.13 · fixed in 2.3.18, 3.1.12, 3.2.13

newrelic_rpm Gem Discloses Sensitive Information

• Information disclosure

>=3.2.0, <3.5.3.24 · fixed in 3.5.3.24

Pupper does not properly restrict characters in Common Name field of Certificate Signing Request

<2.6.17 || >=2.7.0, <2.7.18 · fixed in 2.6.17, 2.7.18

Improper Input Validation in multi_xml

• CWE-20

<0.5.2 · fixed in 0.5.2

Shell command injection in command_wrap

• Code injection

<=0.6.2 · no fixed version yet

Dragonfly Code Injection vulnerability

• Code injection

>=0.7, <0.8.6 || >=0.9, <0.9.13 · fixed in 0.8.6, 0.9.13

actionpack Improper Input Validation vulnerability

• CWE-20

>=3.0.0, <3.2.16 || >=4.0.0, <4.0.2 · fixed in 3.2.16, 4.0.2

HTTParty does not restrict casts of string values

• Other injection

<0.10.0 · fixed in 0.10.0

crack does not properly restrict casts of string values

• Other injection
• CWE-704

<0.3.2 · fixed in 0.3.2

Creme Fraiche contains OS Command Injection

• Command injection

<0.6.1 · fixed in 0.6.1

Spree Improper Input Validation vulnerability

• CWE-20

>=1.0.0, <2.0.0.rc1 · fixed in 2.0.0.rc1

Devise does not properly perform type conversion when performing database queries

• CWE-704

>=1.5.0, <1.5.4 || >=2.0.0, <2.0.5 || >=2.1.0, <2.1.3 || >=2.2.0, <2.2.3 · fixed in 1.5.4, 2.0.5, 2.1.3, 2.2.3

actionpack Improper Input Validation vulnerability

• CWE-20

<2.3.15 || >=3.0.0, <3.0.19 || >=3.1.0, <3.1.10 || >=3.2.0, <3.2.11 · fixed in 2.3.15, 3.0.19, 3.1.10, 3.2.11

rgpg Code Injection vulnerability

• Code injection

<0.2.3 · fixed in 0.2.3

actionpack Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<2.3.18 || >=3.0.0, <3.1.12 || >=3.2.0, <3.2.13 · fixed in 2.3.18, 3.1.12, 3.2.13

Curl Gem insufficient URL escaping command injection

• Code injection

<=0.0.9 · no fixed version yet

activesupport Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<2.3.16 || >=3.0.0.beta, <3.0.17 || >=3.1.0, <3.1.8 || >=3.2.0, <3.2.8 · fixed in 2.3.16, 3.0.17, 3.1.8, 3.2.8

Rack vulnerable to REDoS

• Denial of service

<1.1.4 || >=1.2.0, <1.2.6 || >=1.3.0, <1.3.7 || >=1.4.0, <1.4.2 · fixed in 1.1.4, 1.2.6, 1.3.7, 1.4.2

ActiveRecord vulnerable to modification of protected model attributes

• Broken access control

<2.3.17 || >=3.1.0, <3.1.11 || >=3.2.0, <3.2.12 · fixed in 2.3.17, 3.1.11, 3.2.12

Active Record allows bypassing of database-query restrictions

• Broken access control

>=3.0.0, <3.0.19 || >=3.1.0, <3.1.10 || >=3.2.0, <3.2.11 · fixed in 3.0.19, 3.1.10, 3.2.11

Active Record contains SQL Injection

• SQL injection

<2.3.15 || >=3.0.0.beta, <3.0.18 || >=3.1.0, <3.1.9 || >=3.2.0, <3.2.10 · fixed in 2.3.15, 3.0.18, 3.1.9, 3.2.10

Puppet vulnerable to Path Traversal

• Path traversal

<2.6.17 || >=2.7.0, <2.7.18 · fixed in 2.6.17, 2.7.18

ldoce Gem Arbitrary Command Execution

• CWE-20

<=0.0.2 · no fixed version yet

Active Record contains deserialization of arbitrary YAML

• Insecure deserialization

<2.3.17 || >=3.0.0, <3.1.0 · fixed in 2.3.17, 3.1.0

omniauth-oauth2 Cross-Site Request Forgery vulnerability

• Cross-site request forgery (CSRF)

<1.1.1 · fixed in 1.1.1