RubyGems Advisories.

Sprockets path traversal leads to information leak

• Path traversal
• Information disclosure

<2.12.5 || >=3.0.0, <3.7.2 || >=4.0.0.beta1, <4.0.0.beta8 · fixed in 2.12.5, 3.7.2, 4.0.0.beta8

Sinatra Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=2.0.0, <2.0.2 · fixed in 2.0.2

rails-html-sanitizer Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<1.0.4 · fixed in 1.0.4

Uncontrolled resource consumption in nokogiri

• Denial of service

<1.8.2 · fixed in 1.8.2

Cross-site Scripting in loofah

• Cross-site scripting (XSS)

<2.2.1 · fixed in 2.2.1

Sanitize vulnerable to Improper Input Validation and Cross-site Scripting

• Cross-site scripting (XSS)
• CWE-20

>=3.0.0, <4.6.3 · fixed in 4.6.3

Cap-Strap gem for Ruby places credentials on the useradd command line

• Information disclosure

=0.1.5 · no fixed version yet

Doorkeeper is vulnerable to stored XSS and code execution

• Cross-site scripting (XSS)

>=2.1.0, <4.2.6 · fixed in 4.2.6

http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

• Information disclosure

<0.6.4 || >=0.7.0, <0.7.3 · fixed in 0.6.4, 0.7.3

rack-protection gem timing attack vulnerability when validating CSRF token

• Information disclosure

<1.5.5 || >=2.0.0.beta1, <2.0.0 · fixed in 1.5.5, 2.0.0

bson is vulnerable to denial of service due to incorrect regex validation

• Denial of service

<1.12.3 || >=2.0, <3.0.4 · fixed in 1.12.3, 3.0.4

rails_admin ruby gem XSS

• Cross-site scripting (XSS)

<1.3.0 · fixed in 1.3.0

brbackup exposes database password to unauthorized users

• Information disclosure

=0.1.1 · no fixed version yet

delayed_job_web Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=1.2.9, <1.4.2 · fixed in 1.4.2

Ox gem stack overflow in sax_parse

• Memory corruption

<2.8.2 · fixed in 2.8.2

Sinatra Path Traversal vulnerability

• Path traversal

>=2.0.0.beta1, <2.0.1 · fixed in 2.0.1

Omniauth allows POST parameters to be stored in session

<1.3.2 · fixed in 1.3.2

lynx doesn't properly sanitize user input and exposes database password to unauthorized users

• Information disclosure

<1.0.0 · fixed in 1.0.0

lawn-login exposes database password to unauthorized users

• Information disclosure

=0.0.7 · no fixed version yet

Gyazo allows local users to write arbitrary files

• CWE-20

>=1.0.0, <2.0.0 · fixed in 2.0.0

Denial of Service in jquery

• Denial of service

>=3.0.0-rc1, <3.0.0 · fixed in 3.0.0

Cross-Site Scripting (XSS) in jquery

• Cross-site scripting (XSS)

<1.12.2 || >=1.12.3, <3.0.0 · fixed in 1.12.2, 3.0.0

paperclip Server-Side Request Forgery vulnerability

• Server-side request forgery (SSRF)

>=3.1.4, <5.2.0 · fixed in 5.2.0

Radiant CMS vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

<=1.1.4 · no fixed version yet

net-ldap Improper Certificate Validation vulnerability

• Weak cryptography or TLS

<0.16.0 · fixed in 0.16.0

Arbitrary file read vulnerability in yard server

• Path traversal

<0.9.11 · fixed in 0.9.11

Out-of-bounds read in nokogiri

• Memory corruption

<1.8.1 · fixed in 1.8.1

Recurly gem Server-Side Request Forgery in Resource#find method

• Server-side request forgery (SSRF)

>=2.0.0, <2.0.13 || >=2.1.0, <2.1.11 || >=2.2.0, <2.2.5 || >=2.3.0, <2.3.10 || >=2.4.0, <2.4.11 || >=2.5.0, <2.5.4 || >=2.6.0, <2.6.3 || >=2.7.0, <2.7.8 || >=2.8.0, <2.8.2 || >=2.9.0, <2.9.2 || >=2.10.0, <2.10.4 || >=2.11.0, <2.11.3 · fixed in 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3

redis-store deserializes untrusted data

• Insecure deserialization

<1.4.0 · fixed in 1.4.0

private_address_check contains Incomplete List of Disallowed Inputs

• CWE-184

<0.4.1 · fixed in 0.4.1

private_address_check vulnerable to bypass of Resolv.getaddresses method

• CWE-242

<0.4.0 · fixed in 0.4.0

Geminabox contains Cross-site Scripting

• Cross-site scripting (XSS)

<0.13.10 · fixed in 0.13.10

Gemirro Stored XSS in Gemspec "homepage" value

• Cross-site scripting (XSS)

<0.16.0 · fixed in 0.16.0

yajl-ruby gem Denial of Service vulnerability

• Memory corruption

<1.3.1 · fixed in 1.3.1

Ox gem crashes due to a crafted input

• CWE-20

<2.8.1 · fixed in 2.8.1

gollum and gollum-lib allow remote authenticated users to execute arbitrary code

• Broken access control

<3.1.1 · fixed in 3.1.1

cairo is vulnerable to denial of service due to a null pointer dereference

• Memory corruption

>=1.15.4, <1.15.5 · fixed in 1.15.5

RuboCop gem Insecure use of /tmp

• Information disclosure

<0.49.0 · fixed in 0.49.0

Cross-site Scripting vulnerability in i18n translations helper method

• Cross-site scripting (XSS)

>=3.0.0, <3.0.11 || >=3.1.0, <3.1.2 · fixed in 3.0.11, 3.1.2

gtk2 vulnerable to Use of Externally-Controlled Format String

• Memory corruption

<0.17.0 · fixed in 0.17.0

Rails ActiveRecord gem vulnerable to SQL injection

• SQL injection

<2.1.1 · fixed in 2.1.1

Remote code execution in rwiki

>=2.1.0pre1, <2.1.1 · fixed in 2.1.1

Cross-site Scripting in jquery-ui

• Cross-site scripting (XSS)

>=1.7.0, <1.10.0 · fixed in 1.10.0

Puppet supports use of IP addresses in certnames without warning of potential risks

• Authentication bypass

<2.7.18 · fixed in 2.7.18

rails Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=2.0.0, <2.3.12 || >=3.0.0, <3.0.8 · fixed in 2.3.12, 3.0.8

actionpack Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=2.0.0, <2.3.13 || >=3.0.0, <3.0.10 · fixed in 2.3.13, 3.0.10

rails vulnerable to improper authentication

• Authentication bypass

<2.3.3 · fixed in 2.3.3

Ruby on Rails vulnerable to code injection

• Code injection

>=1.1.0, <1.1.6 · fixed in 1.1.6

Mail Gem Improper Input Validation vulnerability

• CWE-20

<2.4.3 · fixed in 2.4.3

actionpack Improper Input Validation vulnerability

• CWE-20

>=3.0.0, <3.0.10 · fixed in 3.0.10

activesupport Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=3.0.0, <3.0.12 || >=3.1.0, <3.1.4 || >=3.2.0, <3.2.2 · fixed in 3.0.12, 3.1.4, 3.2.2

actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request

>=3.0.13, <3.0.14 || >=3.1.0, <3.1.6 || >=3.2.0, <3.2.6 · fixed in 3.0.14, 3.1.6, 3.2.6

session fixation protection mechanism in cgi_process.rb in Rails

• Race condition

<1.2.6 · fixed in 1.2.6

Session fixation vulnerability in Rails

• Authentication bypass

<1.2.4 · fixed in 1.2.4

activerecord vulnerable to SQL Injection

• SQL injection

>=3.0.0, <3.0.4 · fixed in 3.0.4

rails is vulnerable to CRLF injection

• Cross-site request forgery (CSRF)

<2.0.5 · fixed in 2.0.5

High severity vulnerability that affects thin

• CWE-20

<1.2.4 · fixed in 1.2.4

Action Pack contains database-query restrictions bypass

• Broken access control

<2.3.16 || >=3.0.0.beta, <3.0.13 || >=3.1.0, <3.1.5 || >=3.2.0, <3.2.4 · fixed in 2.3.16, 3.0.13, 3.1.5, 3.2.4

activerecord vulnerable to SQL Injection

• SQL injection

>=2.0.0, <2.3.13 || >=3.0.0.beta, <3.0.10 || >=3.1.0.beta1, <3.1.0.rc5 · fixed in 2.3.13, 3.0.10, 3.1.0.rc5

Moderate severity vulnerability that affects rails

• Cross-site scripting (XSS)

<1.2.5 · fixed in 1.2.5