RubyGems Advisories.

RubyGems passenger gem allows remote attackers to delete files

• CWE-20

<4.0.0.rc4 · fixed in 4.0.0.rc4

Cross site scripting in actionpack Rubygem

• Cross-site scripting (XSS)

>=3.0.0.rc, <3.0.6 · fixed in 3.0.6

SQL injection in blazer

• SQL injection

<2.6.0 · fixed in 2.6.0

Command injection in ruby-git

• Command injection

<1.11.0 · fixed in 1.11.0

Denial of Service (DoS) in Nokogiri on JRuby

• Denial of service

<1.13.4 · fixed in 1.13.4

XML Injection in Xerces Java affects Nokogiri

• Other injection

<1.13.4 · fixed in 1.13.4

Out-of-bounds Write in zlib affects Nokogiri

• Memory corruption

<1.13.4 · fixed in 1.13.4

Nokogiri Inefficient Regular Expression Complexity

• Denial of service

<1.13.4 · fixed in 1.13.4

Improper one time password handling in devise-two-factor

• CWE-254

<4.0.2 · fixed in 4.0.2

Buffer Overflow in yajl-ruby

• Memory corruption

<1.4.3 · fixed in 1.4.3

Command injection in cocoapods-downloader

• Other injection
• Command injection

<1.6.2 · fixed in 1.6.2

Command injection in cocoapods-downloader

• Other injection
• Command injection

<1.6.0 || >=1.6.2, <1.6.3 · fixed in 1.6.0, 1.6.3

Command Injection vulnerability in asciidoctor-include-ext

• Command injection

<0.4.0 · fixed in 0.4.0

Puma vulnerable to HTTP Request Smuggling

• HTTP request smuggling

<4.3.12 || >=5.0.0, <5.6.4 · fixed in 4.3.12, 5.6.4

Nokogiri affected by zlib's Out-of-bounds Write vulnerability

• Memory corruption

<1.13.4 · fixed in 1.13.4

Improper Certificate Validation in kubeclient

• Weak cryptography or TLS

<4.9.3 · fixed in 4.9.3

Missing Authentication for Critical Function in Foreman Ansible

• Authentication bypass

<2.0.0 · fixed in 2.0.0

Possible code injection vulnerability in Rails / Active Storage

• Code injection

>=5.2.0, <5.2.6.3 || >=6.0.0, <6.0.4.7 || >=6.1.0, <6.1.4.7 || >=7.0.0, <7.0.2.3 · fixed in 5.2.6.3, 6.0.4.7, 6.1.4.7, 7.0.2.3

Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption

• Memory corruption

<0.23.4 · fixed in 0.23.4

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component

• Cross-site scripting (XSS)

>=2.31.0, <2.31.2 || >=2.32.0, <2.49.1 · fixed in 2.31.2, 2.49.1

Remote shell execution vulnerability in image_processing

• Command injection
• CWE-20

<1.12.2 · fixed in 1.12.2

Vulnerable dependencies in Nokogiri

• Memory corruption

<1.13.2 · fixed in 1.13.2

Hub Package Arbitrary File Overwrite

• CWE-377

<1.12.1 · fixed in 1.12.1

Puma used with Rails may lead to Information Exposure

• Information disclosure
• Denial of service

<4.3.11 || >=5.0.0, <5.6.2 · fixed in 4.3.11, 5.6.2

Exposure of information in Action Pack

• Information disclosure
• CWE-212

>=5.0.0.0, <5.2.6.2 || >=6.0.0.0, <6.0.4.6 || >=6.1.0.0, <6.1.4.6 || >=7.0.0.0, <7.0.2.2 · fixed in 5.2.6.2, 6.0.4.6, 6.1.4.6, 7.0.2.2

Publify Business Logic Errors

• CWE-840
• CWE-841

<9.2.7 · fixed in 9.2.7

Denial of service in sidekiq

• Denial of service

<5.2.10 || >=6.0.0, <6.4.0 · fixed in 5.2.10, 6.4.0

Cookie Prefix Spoofing in CGI::Cookie.parse

• CWE-565

<0.1.0.1 || >=0.2.0, <0.2.1 || >=0.3.0, <0.3.1 · fixed in 0.1.0.1, 0.2.1, 0.3.1

A potential Denial of Service issue in protobuf-java

• CWE-696

<3.16.1 || >=3.18.0, <3.18.2 || >=3.19.0, <3.19.2 · fixed in 3.16.1, 3.18.2, 3.19.2

Regular Expression Denial of Service (ReDoS) in lodash

• Denial of service

>=4.0.0, <4.17.21 · fixed in 4.17.21

CSRF forgery protection bypass in solidus_frontend

• Cross-site request forgery (CSRF)

<2.11.14 || >=3.0.0, <3.0.5 || >=3.1.0, <3.1.5 · fixed in 2.11.14, 3.0.5, 3.1.5

Path traversal when MessageBus::Diagnostics is enabled

• Path traversal

<3.3.7 · fixed in 3.3.7

Buffer overrun in CGI.escape_html

• Memory corruption

<0.1.0.1 || >=0.2.0, <0.2.1 || >=0.3.0, <0.3.1 · fixed in 0.1.0.1, 0.2.1, 0.3.1

actionpack Open Redirect in Host Authorization Middleware

• Open redirect

>=6.0.0, <6.0.4.2 || >=6.1.0, <6.1.4.2 · fixed in 6.0.4.2, 6.1.4.2

Improper Privilege Management in devise_masquerade

• Privilege escalation

<1.3.1 · fixed in 1.3.1

Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile.

• Command injection

<2.2.33 · fixed in 2.2.33

ReDos vulnerability on guest checkout email validation

• Denial of service

<2.11.13 || >=3.0.0, <3.0.4 || >=3.1.0, <3.1.4 · fixed in 2.11.13, 3.0.4, 3.1.4

Silent Configuration Failure in Puppet Agent

<6.25.1 || >=7.0.0, <7.12.1 · fixed in 6.25.1, 7.12.1

Unsafe HTTP Redirect in Puppet Agent and Puppet Server

<6.25.1 || >=7.0.0, <7.12.1 · fixed in 6.25.1, 7.12.1

Duplicate Advisory: Authentication Bypass by CSRF Weakness

• Cross-site request forgery (CSRF)

<4.0.1 · fixed in 4.0.1

Duplicate Advisory: Authentication Bypass by CSRF Weakness

• Cross-site request forgery (CSRF)

>=4.1.0, <4.1.1 · fixed in 4.1.1

Duplicate Advisory: Authentication Bypass by CSRF Weakness

• Cross-site request forgery (CSRF)

>=4.2.0, <4.2.1 · fixed in 4.2.1

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

• Cross-site request forgery (CSRF)

<4.0.1 || >=4.1.0, <4.1.1 || >=4.2.0, <4.2.1 || >=4.3.0, <4.4.1 · fixed in 4.0.1, 4.1.1, 4.2.1, 4.4.1

Authentication Bypass by CSRF Weakness

• Cross-site request forgery (CSRF)
• CWE-305

<2.11.12 || >=3.0.0, <3.0.3 || >=3.1.0, <3.1.3 · fixed in 2.11.12, 3.0.3, 3.1.3

Authentication Bypass by CSRF Weakness

• Cross-site request forgery (CSRF)

>=1.0.0, <2.5.4 · fixed in 2.5.4

Regular expression denial of service vulnerability (ReDoS) in date

• Denial of service

<2.0.1 || >=3.0.0, <3.0.2 || >=3.1.0, <3.1.2 || >=3.2.0, <3.2.1 · fixed in 2.0.1, 3.0.2, 3.1.2, 3.2.1

Rails Multisite secure/signed cookies share secrets between sites in a multi-site application

• Information disclosure
• Weak cryptography or TLS

<4.0.0 · fixed in 4.0.0

Publify `guest` role users can self-register even when the admin does not allow it

• Broken access control
• CWE-669

>=9.0.0.pre1, <9.2.5 · fixed in 9.2.5

ReDoS vulnerability in parser_apache2

• Denial of service

>=0.14.14, <1.14.2 · fixed in 1.14.2

XSS in `*Text` options of the Datepicker widget in jquery-ui

• Cross-site scripting (XSS)

<1.13.0 · fixed in 1.13.0

XSS in the `of` option of the `.position()` util in jquery-ui

• Cross-site scripting (XSS)

<1.13.0 · fixed in 1.13.0

XSS in the `altField` option of the Datepicker widget in jquery-ui

• Cross-site scripting (XSS)

<1.13.0 · fixed in 1.13.0

OS Command Injection in ftpd

• Command injection

<0.2.2 · fixed in 0.2.2

Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling

• HTTP request smuggling

<4.3.9 || >=5.0.0, <5.5.1 · fixed in 4.3.9, 5.5.1

Remote code execution in ruby-jss

<1.6.0 · fixed in 1.6.0

Cross-site Scripting in Sidekiq

• Cross-site scripting (XSS)

<5.2.0 || >=6.0.0, <6.2.1 · fixed in 5.2.0, 6.2.1

Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby

• XML external entities (XXE)

<1.12.5 · fixed in 1.12.5

Clearance Gem Open Redirect Vulnerability

• Open redirect

<2.5.0 · fixed in 2.5.0

Older releases of better_errors open to Cross-Site Request Forgery attack

• Cross-site request forgery (CSRF)

<2.8.0 · fixed in 2.8.0

Arbitrary Code Execution in Rdoc

• Other injection
• Command injection

>=3.11, <6.1.2.1 || >=6.2.0, <6.2.1.1 || >=6.3.0, <6.3.1 · fixed in 6.1.2.1, 6.2.1.1, 6.3.1