RubyGems Advisories.

samlr XML nodes comment attack

• CWE-20

<2.6.2 · fixed in 2.6.2

datagrid contains code Injection backdoor

• Code injection

=1.0.6 · no fixed version yet

Code backdoor in simple_captcha2

• Code injection

=0.2.3 · no fixed version yet

SQL Injection in marginalia

• SQL injection

<1.6 · fixed in 1.6

Regular Expression Denial of Service (ReDoS) in lodash

• Denial of service

>=4.7.0, <4.17.11 · fixed in 4.17.11

OS Command Injection in MiniMagick

• Command injection

<4.9.4 · fixed in 4.9.4

field_test gem contains injection vulnerability

• Other injection

>=0.3.0, <0.3.1 · fixed in 0.3.1

paranoid2 gem Code backdoor

• CWE-829

=1.1.6 · no fixed version yet

Slanger Arbitrary command execution

• Insecure deserialization

<0.6.1 · fixed in 0.6.1

Prototype Pollution in lodash

• Prototype pollution
• CWE-20

<4.17.12 · fixed in 4.17.12

strong_password Ruby gem malicious version causing Remote Code Execution vulnerability

• Code injection

>=0.0.7, <0.0.8 · fixed in 0.0.8

OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal

• Authentication bypass

<1.10.0 · fixed in 1.10.0

Ruby-SAML Improper Authentication vulnerability

• Authentication bypass

<1.7.0 · fixed in 1.7.0

Path Traversal vulnerability that affects yard

• Path traversal

<0.9.20 · fixed in 0.9.20

RubyGems Escape sequence injection in errors

• Other injection

>=2.6.0, <2.7.9 || >=3.0.0, <3.0.2 · fixed in 2.7.9, 3.0.2

RubyGems Delete directory using symlink when decompressing tar

• Path traversal

>=2.7.6, <2.7.9 || >=3.0.0, <3.0.3 · fixed in 2.7.9, 3.0.3

Code injection in RubyGems

• Code injection

>=2.6.0, <2.7.9 || >=3.0.0, <3.0.2 · fixed in 2.7.9, 3.0.2

RubyGems Escape sequence injection vulnerability in verbose

• Command injection

>=2.6.0, <2.7.9 || >=3.0.0, <3.0.2 · fixed in 2.7.9, 3.0.2

RubyGems Escape sequence injection vulnerability in gem owner

• Other injection

>=2.6.0, <2.7.9 || >=3.0.0, <3.0.2 · fixed in 2.7.9, 3.0.2

RubyGems Escape sequence injection vulnerability in api response handling

• Other injection

>=2.6.0, <2.7.9 || >=3.0.0, <3.0.2 · fixed in 2.7.9, 3.0.2

ruby-openid SSRF via claimed_id request

• Server-side request forgery (SSRF)

<2.9.0 · fixed in 2.9.0

Cross-site Scripting in Chartkick

• Cross-site scripting (XSS)

<3.2.0 · fixed in 3.2.0

OmniAuth Ruby gem Cross-site Request Forgery in request phase

• Cross-site request forgery (CSRF)

<2.0.0 · fixed in 2.0.0

Duplicate Advisory: Prototype Pollution in jquery

<3.4.0 · fixed in 3.4.0

Bootstrap-sass contains code execution backdoor

• Code injection

>=3.2.0.3, <3.2.0.4 · fixed in 3.2.0.4

Improper Certificate Validation in chloride

• Weak cryptography or TLS

<0.3.0 · fixed in 0.3.0

Doorkeeper-openid_connect contains Open Redirect

• Open redirect

>=1.4.0, <1.5.4 · fixed in 1.5.4

devise Time-of-check Time-of-use Race Condition vulnerability

• Race condition

<4.6.0 · fixed in 4.6.0

Use of Insufficiently Random Values in Railties Allows Remote Code Execution

• Command injection
• Weak cryptography or TLS

>=5.2.0, <5.2.2.1 · fixed in 5.2.2.1

Path Traversal in Action View

• Path traversal

>=4.0.0, <4.2.11.1 || >=5.0.0, <5.0.7.2 || >=5.1.0, <5.1.6.2 || >=5.2.0, <5.2.2.1 · fixed in 4.2.11.1, 5.0.7.2, 5.1.6.2, 5.2.2.1

Denial of Service Vulnerability in Action View

• Denial of service

>=4.0.0, <4.2.11.1 || >=5.0.0, <5.0.7.2 || >=5.1.0, <5.1.6.2 || >=5.2.0, <5.2.2.1 || >=6.0.0.beta1, <6.0.0.beta3 · fixed in 4.2.11.1, 5.0.7.2, 5.1.6.2, 5.2.2.1, 6.0.0.beta3

Bootstrap Vulnerable to Cross-Site Scripting

• Cross-site scripting (XSS)

>=3.0.0, <3.4.1 || >=4.0.0, <4.3.1 · fixed in 3.4.1, 4.3.1

Prototype Pollution in lodash

• Denial of service

<4.17.11 · fixed in 4.17.11

High severity vulnerability that affects many_versioned_gem

<0.2.3 · fixed in 0.2.3

Nokogiri NULL Pointer Dereference

• Memory corruption

<1.8.5 · fixed in 1.8.5

bootstrap Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<3.4.0 · fixed in 3.4.0

XSS vulnerability that affects bootstrap

• Cross-site scripting (XSS)

<3.4.0 · fixed in 3.4.0

Bootstrap Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=2.0.4, <3.4.0 || >=4.0.0-beta, <4.0.0-beta.2 · fixed in 3.4.0, 4.0.0-beta.2

Cross Site Scripting (XSS) vulnerability in easymon

• Cross-site scripting (XSS)

<1.4.1 · fixed in 1.4.1

Fat Free CRM vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

<0.14.2 || >=0.15.0, <0.15.2 || >=0.16.0, <0.16.4 || >=0.17.0, <0.17.3 || >=0.18.0, <0.18.1 · fixed in 0.14.2, 0.15.2, 0.16.4, 0.17.3, 0.18.1

Improper Access Control in activejob

• Broken access control
• Insecure deserialization

>=4.2.0, <4.2.11 || >=5.0.0, <5.0.7.1 || >=5.1.0, <5.1.6.1 || >=5.2.0, <5.2.1.1 · fixed in 4.2.11, 5.0.7.1, 5.1.6.1, 5.2.1.1

Exposure of Sensitive Information to an Unauthorized Actor in activestorage

• Information disclosure

>=5.2.0, <5.2.1.1 · fixed in 5.2.1.1

Rack vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

<1.6.11 || >=2.0.0, <2.0.6 · fixed in 1.6.11, 2.0.6

Rack vulnerable to Denial of Service

• Denial of service

>=2.0.4, <2.0.6 · fixed in 2.0.6

Content Injection via TileJSON Name in mapbox.js

• Cross-site scripting (XSS)

<1.6.6 || >=2.0.0, <2.2.4 · fixed in 1.6.6, 2.2.4

Content Injection via TileJSON attribute in mapbox.js

• Cross-site scripting (XSS)

<1.6.5 || >=2.0.0, <2.1.7 · fixed in 1.6.5, 2.1.7

Loofah Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<2.2.3 · fixed in 2.2.3

mysql-bunuuid-rails vulnerable to SQL injection

• SQL injection

<1.1.1 · fixed in 1.1.1

Moderate severity vulnerability that affects sprockets

<2.0.5 || >=2.1.0, <2.1.4 || >=2.2.0, <2.2.3 || >=2.4.0, <2.4.6 || >=2.5.0, <2.5.1 || >=2.6.0, <2.7.1 || >=2.8.0, <2.8.3 || >=2.9.0, <2.9.4 || >=2.10.0, <2.10.2 || >=2.11.0, <2.11.3 || >=2.12.0, <2.12.3 · fixed in 2.0.5, 2.1.4, 2.2.3, 2.4.6, 2.5.1, 2.7.1, 2.8.3, 2.9.4, 2.10.2, 2.11.3, 2.12.3

Insecure use of temporary files in Phusion passenger

>=4.0.37, <4.0.38 · fixed in 4.0.38

Insecure use of temporary files in passenger

<4.0.38 · fixed in 4.0.38

Phusion Passenger allows remote attackers to spoof headers

• CWE-20

<4.0.60 || >=5.0.0, <5.0.22 · fixed in 4.0.60, 5.0.22

smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature

• Authentication bypass
• CWE-592

<0.1.11 || >=0.2.0, <0.2.1 · fixed in 0.1.11, 0.2.1

Jekyll allows attackers to access arbitrary files by specifying a symlink

• Path traversal

<3.6.3 || >=3.7.0, <3.7.4 || >=3.8.0, <3.8.4 · fixed in 3.6.3, 3.7.4, 3.8.4

Moderate severity vulnerability that affects rails-html-sanitizer

<1.0.3 · fixed in 1.0.3

Moderate severity vulnerability that affects rails-html-sanitizer

>=1.0.2, <1.0.3 · fixed in 1.0.3

Moderate severity vulnerability that affects activerecord

>=3.0.0, <3.2.22.1 || >=4.0.0, <4.1.14.1 || >=4.2.0, <4.2.5.1 · fixed in 3.2.22.1, 4.1.14.1, 4.2.5.1

Moderate severity vulnerability that affects rails-html-sanitizer

<1.0.3 · fixed in 1.0.3

Moderate severity vulnerability that affects actionpack

<3.2.22.1 || >=4.0.0, <4.1.14.1 || >=4.2.0, <4.2.5.1 · fixed in 3.2.22.1, 4.1.14.1, 4.2.5.1

Heap-based buffer overflow in nokogiri

• Memory corruption

>=1.6.0, <1.6.7.2 · fixed in 1.6.7.2