RubyGems Advisories.

Bundler allows attacker to inject arbitrary code via secondary Gem source

• Code injection

>=1.0.0, <2.0.0 · fixed in 2.0.0

Puppet uses predictable filenames, allowing arbitrary file overwrite

• CWE-340

<2.6.11 || >=2.7.0, <2.7.5 · fixed in 2.6.11, 2.7.5

Puppet does not properly restrict access to node resources

• Broken access control

>=2.6.0, <2.6.4 · fixed in 2.6.4

Puppet allows local users to modify the permissions of arbitrary files

• Path traversal

<2.6.11 || >=2.7.0, <2.7.5 · fixed in 2.6.11, 2.7.5

Puppet arbitrary file overwrite

• Path traversal

<2.6.11 || >=2.7.0, <2.7.5 · fixed in 2.6.11, 2.7.5

Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata

• Information disclosure

>=1.6.0, <2.4.1 · fixed in 2.4.1

Puppet Denial of Service and Arbitrary File Write

• Denial of service

>=2.6.0, <2.6.15 || >=2.7.0, <2.7.13 · fixed in 2.6.15, 2.7.13

Puppet uses predictable filenames, allowing arbitrary file overwrite

• CWE-377

>=2.6, <2.6.15 || >=2.7, <2.7.13 · fixed in 2.6.15, 2.7.13

Puppet Arbitrary Command Execution

• Command injection

>=2.6.0, <2.6.15 || >=2.7.0, <2.7.13 · fixed in 2.6.15, 2.7.13

Puppet Privilege Escallation

• Privilege escalation

>=2.6, <2.6.14 || >=2.7, <2.7.11 · fixed in 2.6.14, 2.7.11

Authlogic Information Exposure vulnerability

• Information disclosure

<3.3.0 · fixed in 3.3.0

Active Record component in Ruby on Rails has a data-type injection vulnerability

• SQL injection
• CWE-20

<4.2.0 · fixed in 4.2.0

Asciidoctor Infinite Loop vulnerability

• Denial of service

<1.5.8 · fixed in 1.5.8

Ruby Openssl Allows Incorrect Value Comparison

<2.0.9 || >=2.1.0, <2.1.2 · fixed in 2.0.9, 2.1.2

Phusion Passenger incorrect permission assignment

• Broken access control

<5.3.2 · fixed in 5.3.2

Insecure Permissions in Phusion Passenger

• Information disclosure

>=5.3.0, <5.3.2 · fixed in 5.3.2

Incorrect Access Control in Phusion Passenger

• Broken access control

>=5.3.0, <5.3.2 · fixed in 5.3.2

RubyGems Infinite Loop vulnerability

• Denial of service

<9.1.16.0 · fixed in 9.1.16.0

Tarball permission preservation in puppet

• Privilege escalation

<4.10.10 || >=5.0.0, <5.3.4 · fixed in 4.10.10, 5.3.4

Logstash Logs Sensitive Information

• Information disclosure

<5.0.1 · fixed in 5.0.1

RubyGems may allow a maliciously crafted gem to overwrite files

• Path traversal
• CWE-20

<2.6.13 · fixed in 2.6.13

RubyGems vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

>=2.0.0, <2.6.14 · fixed in 2.6.14

RubyGems Code Injection vulnerability

• Code injection
• CWE-150

<2.6.13 · fixed in 2.6.13

RubyGems has Origin Validation Error vulnerability

• CWE-346
• CWE-350

<2.6.13 · fixed in 2.6.13

katello Improper Privilege Management vulnerability

• Privilege escalation
• Broken access control

<3.17.0.rc1 · fixed in 3.17.0.rc1

hammer_cli_foreman Improper Certificate Validation vulnerability

• Weak cryptography or TLS
• CWE-345

<0.10.0 · fixed in 0.10.0

katello SQL Injection vulnerability

• SQL injection
• Information disclosure

<=3.10 · no fixed version yet

Gem in a Box vulnerable to Cross-site Request Forgery

• Cross-site request forgery (CSRF)

<0.13.7 · fixed in 0.13.7

Gem in a Box vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

<0.13.6 · fixed in 0.13.6

Phusion Passenger information disclosure

• Information disclosure

<5.1.11 · fixed in 5.1.11

Nokogiri vulnerable to libxslt protection mechanism bypass

<1.10.3 · fixed in 1.10.3

RubyGems Link Following vulnerability

• Path traversal

<9.1.16.0 · fixed in 9.1.16.0

smalruby and smalruby-editor vulnerable to OS Command Injection

• Command injection

<0.1.11 · fixed in 0.1.11

open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution

• CWE-20

<=1.0.0 · no fixed version yet

mixlib-archive Path Traversal vulnerability

• Path traversal

<0.4.0 · fixed in 0.4.0

Bootstrap vulnerable to Cross-Site Scripting (XSS)

• Cross-site scripting (XSS)

>=4.0.0, <4.1.2 || >=2.3.0, <3.4.0 · fixed in 4.1.2, 3.4.0

Fluentd Escape Sequence Injection Vulnerability

>=0.12.29, <0.12.41 · fixed in 0.12.41

Puppet Improper Access Control

• Broken access control

>=4.0.0, <4.4.2 · fixed in 4.4.2

Camaleon CMS vulnerable to Stored Cross-site Scripting

• Cross-site scripting (XSS)

=2.4 · no fixed version yet

Nokogiri gem, via libxml, is affected by DoS vulnerabilities

• Denial of service

<1.8.1 · fixed in 1.8.1

Bundler may install gems from a different source than expected

• CWE-20

<1.7.0 · fixed in 1.7.0

Rack arbitrary code execution via timing attack

>=1.1.0, <1.1.6 || >=1.2.0, <1.2.8 || >=1.3.0, <1.3.10 || >=1.4.0, <1.4.5 || >=1.5.0, <1.5.2 · fixed in 1.1.6, 1.2.8, 1.3.10, 1.4.5, 1.5.2

Rack vulnerable to Denial of Service

>=1.1.0, <1.1.5 || >=1.2.0, <1.2.7 || >=1.3.0, <1.3.9 || >=1.4.0, <1.4.4 · fixed in 1.1.5, 1.2.7, 1.3.9, 1.4.4

ruby_parser allows local users to overwrite arbitrary files via symlink attack on temporary file with predictable name

• CWE-377

>=2.0.2, <3.1.2 · fixed in 3.1.2

PDFKit Improper Input Validation vulnerability

• CWE-20

<0.5.3 · fixed in 0.5.3

Features file injection vulnerability

• Other injection

<=0.3.0 · no fixed version yet

omniauth-facebook Improper Authentication vulnerability

• Authentication bypass

<1.5.1 · fixed in 1.5.1

RubyGem openshift-origin-controller is vulnerable to command injection

• Other injection

<=1.3.4 · no fixed version yet

Nokogiri vulnerable to DoS while parsing XML entities

• Denial of service

>=1.5.0, <1.5.11 || >=1.6.0, <1.6.1 · fixed in 1.5.11, 1.6.1

Nokogiri vulnerable to DoS while parsing XML documents

• Denial of service

>=1.5.0, <1.5.11 || >=1.6.0, <1.6.1 · fixed in 1.5.11, 1.6.1

CSV-Safe improperly filters special characters potentially leading to CSV injection

• Other injection

<3.0.0 · fixed in 3.0.0

sinatra does not validate expanded path matches

• Path traversal
• CWE-426

<2.2.0 · fixed in 2.2.0

Puppet arbitrary files overwrite via a symlink attack

• Path traversal

>=0.24.0, <0.24.9 || >=0.25.0, <0.25.2 · fixed in 0.24.9, 0.25.2

WEBrick Denial of Service Vulnerability

• Denial of service

<1.3.1 · fixed in 1.3.1

Mongrel vulnerable to directory traversal via double-encoded sequences

• Path traversal

>=1.0.4, <1.0.5 || >=1.1.0, <1.1.3 · fixed in 1.0.5, 1.1.3

RubyGems file overwrite vulnerability

<0.9.1 · fixed in 0.9.1

XSS Vulnerability in Action View tag helpers

• Cross-site scripting (XSS)

<5.2.7.1 || >=6.0.0, <6.0.4.8 || >=6.1.0, <6.1.5.1 || >=7.0.0, <7.0.2.4 · fixed in 5.2.7.1, 6.0.4.8, 6.1.5.1, 7.0.2.4

Cross-site Scripting Vulnerability in Action Pack

• Cross-site scripting (XSS)

>=5.2.0, <5.2.7.1 || >=6.0.0, <6.0.4.8 || >=6.1.0, <6.1.5.1 || >=7.0.0, <7.0.2.4 · fixed in 5.2.7.1, 6.0.4.8, 6.1.5.1, 7.0.2.4

Server side request forgery in gibbon

• Server-side request forgery (SSRF)

<3.4.4 · fixed in 3.4.4

Nokogiri is vulnerable to XML External Entity (XXE) attack

• Denial of service

<1.5.4 · fixed in 1.5.4