RubyGems Advisories.

spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles

>=1.0.0, <3.0.5 · fixed in 3.0.5

Katello uses hard coded credential

• Hard-coded credentials

<1.0.6 || >=1.1.0, <1.1.7 · fixed in 1.0.6, 1.1.7

Rack-Cache caches sensitive headers

• CWE-525

>=0.3.0, <1.2 · fixed in 1.2

Rack Gem Subject to Denial of Service via Hash Collisions

• Weak cryptography or TLS
• Denial of service

<1.6.5.1 · fixed in 1.6.5.1

Sup Code Injection vulnerability

• Code injection

<0.13.2.1 || >=0.14.0, <0.14.1.1 · fixed in 0.13.2.1, 0.14.1.1

Fat Free CRM contains Cross-site Request Forgery vulnerablilities

• Cross-site request forgery (CSRF)

<0.12.1 · fixed in 0.12.1

Fat Free CRM has fixed token value

• Weak cryptography or TLS

<0.12.1 · fixed in 0.12.1

Fat Free CRM vulnerable to Exposure of Sensitive Information

• Information disclosure

<0.12.1 · fixed in 0.12.1

Fat Free CRM vulnerable to SQL Injection

• SQL injection

<0.12.1 · fixed in 0.12.1

Fat Free CRM allows remote attackers to obtain sensitive information via a direct request

• Information disclosure

<0.12.1 · fixed in 0.12.1

RubyGems HTTPS to HTTP redirect

<1.8.23 · fixed in 1.8.23

RubyGems does not verify SSL certificate

<1.8.23 · fixed in 1.8.23

Kafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml

<0.3.17 || >=0.4.0, <0.5.2 · fixed in 0.3.17, 0.5.2

GitLab Grit Gem for Ruby contains a flaw allowing arbitrary commands to be executed

• CWE-20

<2.6.1 · fixed in 2.6.1

Fat Free CRM subject to Cross-site Scripting

• Cross-site scripting (XSS)

>=0.11.1, <0.13.3 · fixed in 0.13.3

Sup Code Injection vulnerability

• Code injection

<0.13.2.1 || >=0.14.0, <0.14.1.1 · fixed in 0.13.2.1, 0.14.1.1

Karteek Docsplit vulnerable to OS Command Injection

• Command injection

<=0.5.4 · no fixed version yet

ccsv Double Free vulnerability

• Memory corruption

<=1.1.0 · no fixed version yet

RubyGems Improper Input Validation vulnerability

• CWE-20

<2.0.17 || >=2.1.0.rc.1, <2.2.5 || >=2.3.0, <2.4.8 · fixed in 2.0.17, 2.2.5, 2.4.8

RubyGems Regular Expression Denial of Service

<1.8.23.2 || >=1.8.24, <1.8.27 || >=2.0.0, <2.0.10 || >=2.1.0, <2.1.5 · fixed in 1.8.23.2, 1.8.27, 2.0.10, 2.1.5

Publify exposes article metadata

• Broken access control

<9.2.8 · fixed in 9.2.8

Publify vulnerable to code injection

• Code injection

<9.2.8 · fixed in 9.2.8

Publify Incorrect Authorization

• Broken access control

<9.2.8 · fixed in 9.2.8

VladTheEnterprising allows local users to write to arbitrary files via a symlink attack

• Path traversal

<=0.2 · no fixed version yet

backup-agoddard and backup_checksum have Information Exposure vulnerability

• Information disclosure

<=3.0.28 · no fixed version yet

codders-dataset Process Table Local Plaintext Credential Disclosure

• Information disclosure

<=1.3.2.1 · no fixed version yet

VladTheEnterprising allows local users to obtain sensitive information by reading MySQL root password from temporary file

• Information disclosure

<=0.2 · no fixed version yet

point-cli allows local users to obtain sensitive information by listing the process

• Information disclosure

<=0.0.1 · no fixed version yet

kajam allows local users to obtain sensitive information by listing the process

• Information disclosure

<=1.0.3.rc2 · no fixed version yet

lean-ruport allows local users to obtain sensitive information by listing the process

• Information disclosure

<=0.3.8 · no fixed version yet

Echor Ruby Gem credentials can be stolen via process table monitoring

<=0.1.6 · no fixed version yet

Echor contains Command Injection

• Command injection

<=0.1.6 · no fixed version yet

ldap_fluff authentication bypass

<0.4.0 · fixed in 0.4.0

Ember.js Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=1.0.0.pre4.0, <1.0.1 || >=1.1.0, <1.1.3 || >=1.2.0.beta.1, <1.2.1 || >=1.3.0.beta.1, <1.3.1 || >=1.4.0-beta.1, <1.4.0-beta.2 · fixed in 1.0.1, 1.1.3, 1.2.1, 1.3.1, 1.4.0-beta.2

xapian-core Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<1.4.6 · fixed in 1.4.6

Fat Free CRM Cross-Site Request Forgery vulnerability

• Cross-site request forgery (CSRF)

<0.13.6 · fixed in 0.13.6

Spree allows remote attackers to obtain sensitive information

• Information disclosure

>=0.11.0, <0.11.2 || >=0.30.0.beta1, <0.30.0 · fixed in 0.11.2, 0.30.0

ember-source Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=1.0.0.pre4.0, <1.0.1 || >=1.1.0, <1.1.3 || >=1.2.0.beta.1, <1.2.1 || >=1.3.0.beta.1, <1.3.1 || >=1.4.0-beta.1, <1.4.0-beta.2 · fixed in 1.0.1, 1.1.3, 1.2.1, 1.3.1, 1.4.0-beta.2

Nokogiri gem, via libxml, is affected by DoS vulnerabilities

• Memory corruption

<1.8.2 · fixed in 1.8.2

WEBrick RCE Vulnerability

• Authentication bypass

<1.4.0 · fixed in 1.4.0

Ruby OpenSSL DoS Vulnerability

• Memory corruption

<2.0.0 · fixed in 2.0.0

Withdrawn Advisory: AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field

• Cross-site scripting (XSS)

=4.1.0 · no fixed version yet

RubyGems Path Traversal vulnerability

• Path traversal

<9.1.16.0 · fixed in 9.1.16.0

karo Metacharacter Handling Remote Command Execution

• Command injection

<=2.5.2 · no fixed version yet

i18n Vulnerable to Denial of Service Attack

• CWE-20

<0.8.0 · fixed in 0.8.0

Fileutils Command Injection vulnerability

• Command injection

<0.7.1 · fixed in 0.7.1

Phusion Passenger Race Condition Allows Privilege Escalation

• Race condition

>=3.0.0, <5.3.2 · fixed in 5.3.2

Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability

• Path traversal

>=5.3.0, <5.3.2 · fixed in 5.3.2

jQuery vulnerable to Cross-Site Scripting (XSS)

• Cross-site scripting (XSS)

<1.6.3 · fixed in 1.6.3

Katello SQL Injection vulnerabilities

• SQL injection

<2.4.3 · fixed in 2.4.3

RubyGems vulnerable to DNS hijack attack

• CWE-350

>=2.0.0, <2.0.16 || >=2.2.0, <2.2.4 || >=2.4.0, <2.4.7 · fixed in 2.0.16, 2.2.4, 2.4.7

RubyGems Regular Expression Denial of Service vulnerability

• Denial of service

<1.8.23.1 || >=1.8.24, <1.8.26 || >=2.0.0, <2.0.8 || >=2.1.0.rc.1, <2.1.0 · fixed in 1.8.23.1, 1.8.26, 2.0.8, 2.1.0

RubyGems Improper Input Validation vulnerability

• CWE-20

<2.6.13 · fixed in 2.6.13

katello Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<3.9.0 · fixed in 3.9.0

RubyGems Deserialization of Untrusted Data vulnerability

• Insecure deserialization

<9.1.16.0 · fixed in 9.1.16.0

RubyGems Improper Verification of Cryptographic Signature vulnerability

• Weak cryptography or TLS

<9.1.16.0 · fixed in 9.1.16.0

RubyGems Improper Input Validation vulnerability

• CWE-20

<9.1.16.0 · fixed in 9.1.16.0

RubyGems Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<9.1.16.0 · fixed in 9.1.16.0

Elasticsearch Logstash allows remote attackers to execute arbitrary commands

• Command injection

>=1.0.14, <1.4.2 · fixed in 1.4.2

Logstash Logs Sensitive Information

• Information disclosure

<2.3.4 · fixed in 2.3.4