RubyGems Advisories.

Open Redirect in ActionPack

• Open redirect

>=6.0.0, <6.0.4.1 || >=6.1.0, <6.1.4.1 · fixed in 6.0.4.1, 6.1.4.1

Cross-Site Scripting in Qiita-Markdown

• Cross-site scripting (XSS)

<0.33.0 · fixed in 0.33.0

qiita-markdown Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<0.34.0 · fixed in 0.34.0

Regular Expression Denial of Service in Addressable templates

• Denial of service

>=2.3.0, <2.8.0 · fixed in 2.8.0

Code injection in Narou

• Code injection

<3.8.0 · fixed in 3.8.0

Potential Denial-of-Service in bindata

• Denial of service

<2.4.10 · fixed in 2.4.10

Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox

• Information disclosure

<0.13.1 · fixed in 0.13.1

Dragonfly contains remote code execution vulnerability

• Command injection
• Code injection

<1.4.0 · fixed in 1.4.0

HTTP Request Smuggling in goliath

• HTTP request smuggling

<=1.0.6 · no fixed version yet

HTTP Request Smuggling in reel

• HTTP request smuggling

<=0.6.1 · no fixed version yet

Improper Certificate Validation in EM-HTTP-Request

• Weak cryptography or TLS

<1.1.6 · fixed in 1.1.6

Dependency Confusion in Bundler

>=1.16.0, <2.2.10 || >=2.2.11, <2.2.18 · fixed in 2.2.10, 2.2.18

Improper certificate validation in em-imap

• Weak cryptography or TLS

<=0.5 · no fixed version yet

Puma's Keepalive Connections Causing Denial Of Service

• Denial of service

<4.3.8 || >=5.0.0, <5.3.1 · fixed in 4.3.8, 5.3.1

Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12

<1.11.4 · fixed in 1.11.4

Insecure path handling in Bundler

• Information disclosure
• CWE-427

>=1.14.0, <2.1.0 · fixed in 2.1.0

Command Injection in lodash

• Command injection
• Code injection

<4.17.21 · fixed in 4.17.21

Tempfile on Windows path traversal vulnerability

• Path traversal

<0.1.2 · fixed in 0.1.2

Possible DoS Vulnerability in Action Controller Token Authentication

• Denial of service

>=4.0.0, <5.2.4.6 || >=5.2.5, <5.2.6 || >=6.0.0, <6.0.3.7 || >=6.1.0, <6.1.3.2 · fixed in 5.2.4.6, 5.2.6, 6.0.3.7, 6.1.3.2

Action Pack contains Information Disclosure / Unintended Method Execution vulnerability

• Information disclosure

>=2.0.0, <5.2.4.6 || >=5.2.5, <5.2.6 || >=6.0.0, <6.0.3.7 || >=6.1.0, <6.1.3.2 · fixed in 5.2.4.6, 5.2.6, 6.0.3.7, 6.1.3.2

Possible Open Redirect Vulnerability in Action Pack

• Open redirect

>=6.1.0.rc2, <6.1.3.2 · fixed in 6.1.3.2

Denial of Service in Action Dispatch

• Denial of service

>=6.0.0, <6.0.3.7 || >=6.1.0, <6.1.3.2 · fixed in 6.0.3.7, 6.1.3.2

REXML round-trip instability

• XML external entities (XXE)
• CWE-115

<3.2.5 · fixed in 3.2.5

Gon gem lack of escaping certain input when outputting as JSON

• Cross-site scripting (XSS)

<6.4.0 · fixed in 6.4.0

Pgsync Contains Cleartext Transmission of Sensitive Information

• Weak cryptography or TLS

<0.6.7 · fixed in 0.6.7

Improper Certificate Validation in oauth ruby gem

• Weak cryptography or TLS

<0.5.5 · fixed in 0.5.5

Cross-Site Request Forgery (CSRF) in trestle-auth

• Cross-site request forgery (CSRF)

>=0.4.0, <0.4.2 · fixed in 0.4.2

Improper Certificate Validation in TweetStream

• Weak cryptography or TLS

<=2.6.1 · no fixed version yet

Improper Certificate Validation in Puppet

• Weak cryptography or TLS

<5.5.19 || >=6.0.0, <6.13.0 · fixed in 5.5.19, 6.13.0

Cross-site scripting in actionpack

• Cross-site scripting (XSS)

>=6.0.0, <6.0.3.4 · fixed in 6.0.3.4

Remote code execution in Kramdown

• Code injection

>=1.16.0, <2.3.1 · fixed in 2.3.1

Improper Certificate Validation in twitter-stream

• Weak cryptography or TLS

<=0.1.16 · no fixed version yet

Activerecord-session_store Vulnerable to Timing Attack

• CWE-208

<2.0.0 · fixed in 2.0.0

Actionpack Open Redirect Vulnerability

• Open redirect

>=6.0.0, <6.0.3.5 || >=6.1.0, <6.1.2.1 · fixed in 6.0.3.5, 6.1.2.1

Active Record subject to Regular Expression Denial-of-Service (ReDoS)

• Denial of service

>=5.0.0, <5.2.4.5 || >=6.0.0, <6.0.3.5 || >=6.1.0, <6.1.2.1 · fixed in 5.2.4.5, 6.0.3.5, 6.1.2.1

Cross-Site Request Forgery (CSRF)

• Cross-site request forgery (CSRF)

<1.3.5 · fixed in 1.3.5

Backdoor / Malicious code

=0.0.3 · no fixed version yet

Code Injection vulnerability in CarrierWave::RMagick

• Other injection
• Code injection

<1.3.2 || >=2.0.0, <2.1.1 · fixed in 1.3.2, 2.1.1

Server-side request forgery in CarrierWave

• Server-side request forgery (SSRF)

<1.3.2 || >=2.0.0, <2.1.1 · fixed in 1.3.2, 2.1.1

Command Injection Vulnerability in Mechanize

• Command injection

>=2.0.0, <2.7.7 · fixed in 2.7.7

rails_admin ruby gem XSS vulnerability

• Cross-site scripting (XSS)

<1.4.3 || >=2.0.0, <2.0.2 · fixed in 1.4.3, 2.0.2

Injection/XSS in Redcarpet

• Other injection
• Cross-site scripting (XSS)

<3.5.1 · fixed in 3.5.1

Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability

• XML external entities (XXE)

<1.11.0 · fixed in 1.11.0

omniauth-apple allows attacker to fake their email address during authentication

• Authentication bypass

<1.0.1 · fixed in 1.0.1

Authorization bypass in Spree

• Broken access control

>=3.7.0, <3.7.13 || >=4.0.0, <4.0.5 || >=4.1.0, <4.1.12 · fixed in 3.7.13, 4.0.5, 4.1.12

Remote code execution in dependabot-core branch names when cloning

• Other injection

>=0.119.0.beta1, <0.125.1 · fixed in 0.125.1

Regression in JWT Signature Validation

• Authentication bypass
• Weak cryptography or TLS

>=2.3.0, <2.4.1 · fixed in 2.4.1

Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls

• Authentication bypass

<3.7.11 || >=4.0.0, <4.0.4 || >=4.1.0, <4.1.11 · fixed in 3.7.11, 4.0.4, 4.1.11

Withdrawn: HTTP Request Smuggling in Agoo

• HTTP request smuggling

<=2.13.0 · no fixed version yet

Possible timing attack in derivation_endpoint

• Information disclosure
• CWE-208

<3.3.0 · fixed in 3.3.0

personnummer/ruby vulnerable to Improper Input Validation

<3.0.1 · fixed in 3.0.1

XSS in Action View

• Cross-site scripting (XSS)

<5.2.4.4 || >=6.0.0.0, <6.0.3.3 · fixed in 5.2.4.4, 6.0.3.3

Cross-Site Scripting in jquery

• Cross-site scripting (XSS)
• CWE-64

<1.9.0 · fixed in 1.9.0

Moped Rubygem Data Injection Vulnerability

• CWE-20

<1.5.3 || >=2.0.0, <2.0.5 · fixed in 1.5.3, 2.0.5

CSS Injection in Chartkick gem

• Other injection

<3.4.0 · fixed in 3.4.0

Unintended read access in kramdown gem

• Broken access control

<2.3.0 · fixed in 2.3.0

PgHero gem allows CSRF

• Cross-site request forgery (CSRF)

<2.7.0 · fixed in 2.7.0

Field Test CSRF vulnerability

• Cross-site request forgery (CSRF)

>=0.2.0, <0.4.0 · fixed in 0.4.0

Ability to change order address without triggering address validations in solidus

• Broken access control
• CWE-20

<2.8.6 || >=2.9.0, <2.9.6 || >=2.10.0, <2.10.2 · fixed in 2.8.6, 2.9.6, 2.10.2

Missing TLS certificate verification in faye-websocket

• Weak cryptography or TLS

<0.11.0 · fixed in 0.11.0