RubyGems Advisories.

Missing TLS certificate verification

• Weak cryptography or TLS

<1.4.0 · fixed in 1.4.0

Unsafe object creation in json RubyGem

• CWE-20

<2.3.0 · fixed in 2.3.0

Prototype Pollution in lodash

• Denial of service
• Prototype pollution

>=3.7.0, <4.17.19 · fixed in 4.17.19

Remote code execution via user-provided local names in ActionView

• Code injection

<4.2.11.3 · fixed in 4.2.11.3

CSRF Vulnerability in rails-ujs

• Cross-site request forgery (CSRF)

>=5.0.0, <5.2.4.3 || >=6.0.0, <6.0.3.1 · fixed in 5.2.4.3, 6.0.3.1

Directory traversal in Rack::Directory app bundled with Rack

• Path traversal
• CWE-548

<2.1.3 · fixed in 2.1.3

Untrusted users can run pending migrations in production in Rails

• Denial of service

>=6.0.0, <6.0.3.2 · fixed in 6.0.3.2

Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names

• CWE-20
• CWE-784

<2.1.4 || >=2.2.0, <2.2.3 · fixed in 2.1.4, 2.2.3

Cross-site Scripting in Sanitize

• Cross-site scripting (XSS)

>=3.0.0, <5.2.1 · fixed in 5.2.1

SQL Injection in Geocoder

• SQL injection

<1.6.1 · fixed in 1.6.1

Regular Expression Denial of Service in websocket-extensions (RubyGem)

• Denial of service

<0.1.5 · fixed in 0.1.5

Cross-Site Scripting in Kaminari

• Cross-site scripting (XSS)

<1.2.1 · fixed in 1.2.1

Ability to forge per-form CSRF tokens in Rails

• Cross-site request forgery (CSRF)

>=5.0.0, <5.2.4.3 || >=6.0.0, <6.0.3.1 · fixed in 5.2.4.3, 6.0.3.1

Circumvention of file size limits in ActiveStorage

• Unrestricted file upload
• CWE-602

>=5.0.0, <5.2.4.3 || >=6.0.0, <6.0.3.1 · fixed in 5.2.4.3, 6.0.3.1

Possible Strong Parameters Bypass in ActionPack

• Insecure deserialization

>=5.0.0, <5.2.4.3 || >=6.0.0, <6.0.3.1 · fixed in 5.2.4.3, 6.0.3.1

ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

• Insecure deserialization

>=5.0.0, <5.2.4.3 || >=6.0.0, <6.0.3.1 · fixed in 5.2.4.3, 6.0.3.1

HTTP Smuggling via Transfer-Encoding Header in Puma

• HTTP request smuggling

<3.12.6 || >=4.0.0, <4.3.5 · fixed in 3.12.6, 4.3.5

HTTP Smuggling via Transfer-Encoding Header in Puma

• HTTP request smuggling

<3.12.5 || >=4.0.0, <4.3.4 · fixed in 3.12.5, 4.3.4

Information disclosure issue in Active Resource

• Information disclosure
• Broken access control

>=3.0.0.rc, <5.1.1 · fixed in 5.1.1

Cross-Site Scripting in jquery

• Cross-site scripting (XSS)

>=1.2.1, <1.9.0 · fixed in 1.9.0

Arbitrary file write in actionpack-page_caching gem

• Path traversal

<1.2.1 · fixed in 1.2.1

Improper Restriction of Excessive Authentication Attempts in Sorcery

• Authentication bypass

<0.15.0 · fixed in 0.15.0

Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper

• Broken access control

>=5.0.0, <5.0.3 || >=5.1.0, <5.1.1 || >=5.2.0, <5.2.5 || >=5.3.0, <5.3.2 · fixed in 5.0.3, 5.1.1, 5.2.5, 5.3.2

Potential XSS vulnerability in jQuery

• Cross-site scripting (XSS)

>=1.0.3, <3.5.0 · fixed in 3.5.0

Potential XSS vulnerability in jQuery

• Cross-site scripting (XSS)

>=1.12.0, <3.5.0 · fixed in 3.5.0

Authentication and extension bypass in Faye

• Authentication bypass

>=0.5.0, <1.0.4 || >=1.1.0, <1.1.3 || >=1.2.0, <1.2.5 · fixed in 1.0.4, 1.1.3, 1.2.5

BSON rubygem contains potential denial of service

• Denial of service

<3.0.4 · fixed in 3.0.4

Cross site scripting vulnerability in ActionView

• Cross-site scripting (XSS)

<5.2.4.2 || >=6.0.0, <6.0.2.2 · fixed in 5.2.4.2, 6.0.2.2

Sort order SQL injection in Administrate

• Other injection

<0.13.0 · fixed in 0.13.0

Denial of Service in uap-core when processing crafted User-Agent strings

<2.6.0 · fixed in 2.6.0

HTTP Response Splitting (Early Hints) in Puma

• Other injection

<3.12.4 || >=4.0.0, <4.3.3 · fixed in 3.12.4, 4.3.3

OS Command Injection in Rake

• Command injection

<12.3.3 · fixed in 12.3.3

HTTP Response Splitting in Puma

• Other injection

<3.12.4 || >=4.0.0, <4.3.3 · fixed in 3.12.4, 4.3.3

libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation

• Denial of service

<1.10.8 · fixed in 1.10.8

Denial of Service in uap-core when processing crafted User-Agent strings

• Denial of service
• CWE-20

<0.7.3 · fixed in 0.7.3

BibTeX-Ruby vulnerable to OS command injection

• Command injection

<5.1.0 · fixed in 5.1.0

XSS/Script injection vulnerability in matestack

• Cross-site scripting (XSS)

<0.7.4 · fixed in 0.7.4

Directive injection when using dynamic overrides with user input

• Code injection

<3.8.0 || >=5.0.0, <5.1.0 || >=6.0.0, <6.2.0 · fixed in 3.8.0, 5.1.0, 6.2.0

Limited header injection when using dynamic overrides with user input in RubyGems secure_headers

• Other injection

<3.9.0 || >=5.0.0, <5.2.0 || >=6.0.0, <6.3.0 · fixed in 3.9.0, 5.2.0, 6.3.0

Prototype Pollution in handlebars

• Other injection
• Prototype pollution

<3.0.8 || >=4.0.0, <4.3.0 · fixed in 3.0.8, 4.3.0

Possible Information Leak / Session Hijack Vulnerability in Rack

• Information disclosure
• CWE-208

<1.6.12 || >=2.0.0, <2.0.8 · fixed in 1.6.12, 2.0.8

In RubyGem excon, interrupted Persistent Connections May Leak Response Data

• Race condition
• CWE-664

<0.71.0 · fixed in 0.71.0

A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack

• Denial of service

<3.12.2 || >=4.0.0, <4.3.1 · fixed in 3.12.2, 4.3.1

Prototype Pollution in chartkick

>=3.1.0, <3.2.0 · fixed in 3.2.0

The rack-cors rubygem may allow directory traveral

• Path traversal

<1.0.4 · fixed in 1.0.4

JSON-jwt Gem lacked element count during splitting of JWE string

• Authentication bypass

<1.11.0 · fixed in 1.11.0

Loofah Allows Cross-site Scripting

• Cross-site scripting (XSS)

<2.3.1 · fixed in 2.3.1

Ruby_parser-legacy Incorrect Permission Assignment for Critical Resource

• Broken access control

<=1.0.0 · no fixed version yet

Haml vulnerable to cross-site scripting

• Cross-site scripting (XSS)

<5.0.0 · fixed in 5.0.0

netaddr before 1.5.3 and 2.0.4 has Incorrect Default Permissions

• Broken access control

<1.5.3 || >=2.0.0, <2.0.4 · fixed in 1.5.3, 2.0.4

Malicious URL drafting attack against iodines static file server may allow path traversal

• Path traversal

<0.7.34 · fixed in 0.7.34

Improper Input Validation in simple_form

• CWE-20

<5.0.0 · fixed in 5.0.0

Rubyzip denial of service

• Denial of service

<1.3.0 · fixed in 1.3.0

Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly

• Broken access control

<1.0.3 · fixed in 1.0.3

Cross-site scripting in padrino-contrib

• Cross-site scripting (XSS)

<=0.2.0 · no fixed version yet

Authentication Bypass in Devise

• Broken access control

<4.7.1 · fixed in 4.7.1

Airbrake keys not being filtered

• Information disclosure

>=4.2.3, <4.2.4 · fixed in 4.2.4

Cross-site scripting in fat_free_crm

• Cross-site scripting (XSS)

<0.18.1 · fixed in 0.18.1

rest-client Gem Contains Malicious Code

• Code injection

* · no fixed version yet

Nokogiri Command Injection Vulnerability

• Command injection

<1.10.4 · fixed in 1.10.4