RubyGems Advisories.

Moderate severity vulnerability that affects activesupport

>=3.2.0, <3.2.22 || >=4.0.0, <4.1.11 || >=4.2.0, <4.2.2 · fixed in 3.2.22, 4.1.11, 4.2.2

Moderate severity vulnerability that affects rack

<1.4.6 || >=1.5.0, <1.5.4 || >=1.6.0, <1.6.2 · fixed in 1.4.6, 1.5.4, 1.6.2

Moderate severity vulnerability that affects actionview

>=4.1.0, <4.1.14.1 || >=4.2.0, <4.2.5.1 · fixed in 4.1.14.1, 4.2.5.1

Duplicate Advisory: Moderate severity vulnerability that affects activemodel

>=4.1.0, <4.1.14.1 || >=4.2, <4.2.5.1 · fixed in 4.1.14.1, 4.2.5.1

Doorkeeper vulnerable to Cross-site Request Forgery

• Cross-site request forgery (CSRF)

<1.4.1 · fixed in 1.4.1

Moderate severity vulnerability that affects actionpack

<3.2.22.1 || >=4.0.0, <4.1.14.1 || >=4.2.0, <4.2.5.1 · fixed in 3.2.22.1, 4.1.14.1, 4.2.5.1

Moderate severity vulnerability that affects actionpack

<3.2.21 || >=4.0.0, <4.0.12 || >=4.1.0, <4.1.8 · fixed in 3.2.21, 4.0.12, 4.1.8

Moderate severity vulnerability that affects actionpack

<3.2.20 || >=4.0.0, <4.0.11 || >=4.1.0, <4.1.7 · fixed in 3.2.20, 4.0.11, 4.1.7

Moderate severity vulnerability that affects actionpack

<3.2.18 || >=4.0.0, <4.0.5 || >=4.1.0, <4.1.1 · fixed in 3.2.18, 4.0.5, 4.1.1

Denial of service or RCE from libxml2 and libxslt

• Memory corruption

>=1.6.0, <1.6.8 · fixed in 1.6.8

Moderate severity vulnerability that affects actionpack

>=4.0.0, <4.1.14.1 || >=4.2.0, <4.2.5.1 · fixed in 4.1.14.1, 4.2.5.1

Bootstrap Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=4.0.0, <4.1.2 || >=2.3.0, <3.4.0 · fixed in 4.1.2, 3.4.0

Bootstrap Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=4.0.0, <4.1.2 · fixed in 4.1.2

Rubyzip gem contains a Directory Traversal vulnerability in zip file component

• Path traversal
• Unrestricted file upload

<1.2.2 · fixed in 1.2.2

Ruby-ffi has a DLL loading issue

• CWE-426

<1.9.24 · fixed in 1.9.24

ember-source vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

>=1.10.0, <1.10.1 || >=1.11.0, <1.11.2 · fixed in 1.10.1, 1.11.2

Spina gem vulnerable to Cross-site request forgery (CSRF) vulnerability

• Cross-site request forgery (CSRF)

<0.6.29 · fixed in 0.6.29

Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)

<2.0.0 · fixed in 2.0.0

Gollum Exposure of Sensitive Information

• Information disclosure

<4.0.1 · fixed in 4.0.1

ember-source Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=1.2.0, <1.2.2 || >=1.3.0, <1.3.2 || >=1.4.0.beta.1, <1.4.0.beta.6 · fixed in 1.2.2, 1.3.2, 1.4.0.beta.6

ember-source Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=1.8.0, <1.11.4 || >=1.12.0, <1.12.2 || >=1.13.0, <1.13.12 || >=2.0.0, <2.0.3 || >=2.1.0, <2.1.2 || >=2.2.0, <2.2.1 · fixed in 1.11.4, 1.12.2, 1.13.12, 2.0.3, 2.1.2, 2.2.1

Nokogiri does not forbid namespace nodes in XPointer ranges

• Memory corruption

<1.7.1 · fixed in 1.7.1

High severity vulnerability that affects activerecord

>=4.0.0, <4.0.9 || >=4.1.0, <4.1.5 · fixed in 4.0.9, 4.1.5

Nokogiri subject to DoS via libxml2 vulnerability

• Denial of service

>=1.6.0, <1.6.7.1 · fixed in 1.6.7.1

High severity vulnerability that affects espeak-ruby

<1.0.3 · fixed in 1.0.3

Ruby-saml allows attackers to perform XML signature wrapping attacks

• Other injection

<1.3.0 · fixed in 1.3.0

Phusion Passenger uses a known /tmp filename

<5.1.0 · fixed in 5.1.0

Moderate severity vulnerability that affects archive-tar-minitar and minitar

<0.6 · fixed in 0.6

Git-fastclone passes user modifiable strings directly to a shell command

• Command injection

<1.0.5 · fixed in 1.0.5

redcarpet Buffer Overflow vulnerability

• Memory corruption

>=3.3.0, <3.3.2 · fixed in 3.3.2

High severity vulnerability that affects festivaltts4r

* · no fixed version yet

High severity vulnerability that affects colorscore

<0.0.5 · fixed in 0.0.5

git-fastclone permits arbitrary shell command execution from .gitmodules

• Command injection

<1.0.1 · fixed in 1.0.1

Moderate severity vulnerability that affects doorkeeper

>=1.2.0, <4.2.0 · fixed in 4.2.0

Moderate severity vulnerability that affects activerecord

>=4.2.0, <4.2.7.1 · fixed in 4.2.7.1

Moderate severity vulnerability that affects actionview

>=3.2.0, <3.2.22.2 || >=4.0.0, <4.1.14.2 · fixed in 3.2.22.2, 4.1.14.2

High severity vulnerability that affects actionpack

>=3.2.0, <3.2.22.2 || >=4.0.0, <4.1.14.2 || >=4.2.0, <4.2.5.2 · fixed in 3.2.22.2, 4.1.14.2, 4.2.5.2

Moderate severity vulnerability that affects web-console

<2.1.3 · fixed in 2.1.3

Moderate severity vulnerability that affects paperclip

<4.2.2 · fixed in 4.2.2

rest-client Gem Vulnerable to Session Fixation

• Authentication bypass

>=1.6.1.a, <1.8.0 · fixed in 1.8.0

Moderate severity vulnerability that affects rack-mini-profiler

<0.10.1 · fixed in 0.10.1

Doorkeeper subject to Incorrect Permission Assignment

• Broken access control

>=4.2.0, <4.4.0 · fixed in 4.4.0

grape subject to Cross-site Scripting

• Cross-site scripting (XSS)

<1.1.0 · fixed in 1.1.0

active-support impersonates 'activesupport' gem

• Command injection

* · no fixed version yet

Nokogiri vulnerable to libxml XML Entity Expansion

• Denial of service

>=1.6.6.0, <1.6.6.4 · fixed in 1.6.6.4

Cross-site request forgery in rails_admin

• Cross-site request forgery (CSRF)

>=1.0.0, <1.1.1 · fixed in 1.1.1

Moderate severity vulnerability that affects safemode

<1.2.4 · fixed in 1.2.4

High severity vulnerability that affects safemode

<1.3.3 · fixed in 1.3.3

restforce vulnerable to Improper Input Validation

• CWE-20
• CWE-172

<3.0.0 · fixed in 3.0.0

High severity vulnerability that affects rubyzip

<1.2.1 · fixed in 1.2.1

Nokogiri implementation of libxslt lacks integer overflow checks

• Memory corruption

<1.7.2 · fixed in 1.7.2

Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request

<0.4.1 · fixed in 0.4.1

Json-jwt did not verify the cryptographic signature for data

• Weak cryptography or TLS

>=0.5.1, <1.9.4 · fixed in 1.9.4

private_address_check contains race condition

• Race condition

<0.5.0 · fixed in 0.5.0

radiant vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

=1.1.4 · no fixed version yet

High severity vulnerability that affects jquery-ui

<1.12.0 · fixed in 1.12.0

Prototype Pollution in lodash

• Prototype pollution
• CWE-471

<4.17.5 · fixed in 4.17.5

Low severity vulnerability that affects sensu

<1.2.1 · fixed in 1.2.1

Ciborg gem for Ruby allows local users to write files and gain privileges via Symlink

• CWE-20

=3.0.0 · no fixed version yet

Kcapifony gem for Ruby places database user passwords on the command line

• Information disclosure

<=2.1.6 · no fixed version yet