RubyGems Advisories.

Possible Denial of Service Vulnerability in Rack's header parsing

>=2.0.0, <2.2.6.4 || >=3.0.0, <3.0.6.1 · fixed in 2.2.6.4, 3.0.6.1

Possible XSS Security Vulnerability in SafeBuffer#bytesplice

• Cross-site scripting (XSS)

<6.1.7.3 || >=7.0.0, <7.0.4.3 · fixed in 6.1.7.3, 7.0.4.3

Rack has possible DoS Vulnerability in Multipart MIME parsing

• Denial of service

<2.0.9.3 || >=2.1.0, <2.1.4.3 || >=2.2.0, <2.2.6.3 || >=3.0.0, <3.0.4.2 · fixed in 2.0.9.3, 2.1.4.3, 2.2.6.3, 3.0.4.2

Code injection in pdf_info

• Command injection
• Code injection

<=0.5.3 · no fixed version yet

Withdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework

• Insecure deserialization

<=6.0.33 · no fixed version yet

Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2

• Cross-site request forgery (CSRF)
• CWE-652

<0.1.2 · fixed in 0.1.2

Publify contains Weak Password Requirements

• Hard-coded credentials

<9.2.10 · fixed in 9.2.10

Improper neutralization of `noscript` element content may allow XSS in Sanitize

• Cross-site scripting (XSS)

>=5.0.0, <6.0.1 · fixed in 6.0.1

flash_tool Gem for Ruby File Download Handling Arbitrary Command Execution

• Command injection

<=0.6.0 · no fixed version yet

Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie

• Authentication bypass
• Information disclosure

<3.5.4 · fixed in 3.5.4

xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process table

• Information disclosure

<=1.2.0 · no fixed version yet

Several quadratic complexity bugs may lead to denial of service in Commonmarker

• Denial of service

<0.23.7 · fixed in 0.23.7

ExifTool vulnerable to arbitrary code execution

• Other injection

<12.25.0 · fixed in 12.25.0

jruby-openssl gem for JRuby fails to do proper certificate validation

• Weak cryptography or TLS

<0.6 · fixed in 0.6

Denial of Service Vulnerability in Rack Content-Disposition parsing

• Denial of service

>=2.0.0, <2.0.9.2 || >=2.1.0, <2.1.4.2 || >=2.2.0, <2.2.6.1 || >=3.0.0.0, <3.0.4.1 · fixed in 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1

ReDoS based DoS vulnerability in Action Dispatch

• Denial of service

>=3.0.0, <5.2.8.15 || >=6.0.0, <6.1.7.1 || >=7.0.0, <7.0.4.1 · fixed in 5.2.8.15, 6.1.7.1, 7.0.4.1

ReDoS based DoS vulnerability in Active Support's underscore

• Denial of service

<6.1.7.1 || >=7.0.0, <7.0.4.1 · fixed in 6.1.7.1, 7.0.4.1

Open Redirect Vulnerability in Action Pack

• Open redirect

>=7.0.0, <7.0.4.1 · fixed in 7.0.4.1

Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter

• Denial of service

<6.1.7.1 || >=7.0.0, <7.0.4.1 · fixed in 6.1.7.1, 7.0.4.1

ReDoS based DoS vulnerability in Action Dispatch

• Denial of service

>=4.0.0.beta1, <6.1.7.1 || >=7.0.0, <7.0.4.1 · fixed in 6.1.7.1, 7.0.4.1

SQL Injection Vulnerability via ActiveRecord comments

• SQL injection

>=6.0.0, <6.0.6.1 || >=6.1.0, <6.1.7.1 || >=7.0.0, <7.0.4.1 · fixed in 6.0.6.1, 6.1.7.1, 7.0.4.1

Denial of service via header parsing in Rack

• Denial of service

>=1.5.0, <2.0.9.2 || >=2.1.0.0, <2.1.4.2 || >=2.2.0.0, <2.2.6.2 || >=3.0.0.0, <3.0.4.1 · fixed in 2.0.9.2, 2.1.4.2, 2.2.6.2, 3.0.4.1

Denial of service via multipart parsing in Rack

• Denial of service

>=2.0.0, <2.0.9.2 || >=2.1.0.0, <2.1.4.2 || >=2.2.0.0, <2.2.6.1 || >=3.0.0.0, <3.0.4.1 · fixed in 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1

ReDoS based DoS vulnerability in GlobalID

• Denial of service

>=0.2.1, <1.0.1 · fixed in 1.0.1

Sisimai Inefficient Regular Expression Complexity vulnerability

• Denial of service

<4.25.14p12 · fixed in 4.25.14p12

Code injection in ruby git

• Code injection

<1.13.0 · fixed in 1.13.0

curupira is vulnerable to SQL injection

• SQL injection

<0.1.4 · fixed in 0.1.4

Integer overflow in publify_core

• Memory corruption

<9.2.10 · fixed in 9.2.10

Publify Improper Input Validation vulnerability

• CWE-20

<9.2.10 · fixed in 9.2.10

Publify Core does not strip metadata from images

• Information disclosure

<9.2.10 · fixed in 9.2.10

ruby-git has potential remote code execution vulnerability

• Code injection

>=1.2.0, <1.13.0 · fixed in 1.13.0

Inline SVG vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

<1.7.2 · fixed in 1.7.2

PgHero Allows Information Disclosure Through EXPLAIN Feature

• Information disclosure

<3.1.0 · fixed in 3.1.0

httparty has multipart/form-data request tampering vulnerability

• CWE-472

<0.21.0 · fixed in 0.21.0

keynote Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<1.0.0 · fixed in 1.0.0

Oxidized Web vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

<=0.13.1 · no fixed version yet

text_helpers uses web link to untrusted target with window.opener access

• Privilege escalation
• CWE-1022

>=1.1.0, <1.2.0 · fixed in 1.2.0

active_attr Improper Resource Shutdown or Release vulnerability

• Denial of service

<0.15.4 · fixed in 0.15.4

Possible XSS vulnerability with certain configurations of rails-html-sanitizer

• Cross-site scripting (XSS)

<1.4.4 · fixed in 1.4.4

Possible XSS vulnerability with certain configurations of rails-html-sanitizer

• Cross-site scripting (XSS)

<1.4.4 · fixed in 1.4.4

Improper neutralization of data URIs may allow XSS in rails-html-sanitizer

• Cross-site scripting (XSS)

>=1.0.3, <1.4.4 · fixed in 1.4.4

Inefficient Regular Expression Complexity in rails-html-sanitizer

• Denial of service

<1.4.4 · fixed in 1.4.4

Uncontrolled Recursion in Loofah

• Denial of service

>=2.2.0, <2.19.1 · fixed in 2.19.1

Improper neutralization of data URIs may allow XSS in Loofah

• Cross-site scripting (XSS)

>=2.1.0, <2.19.1 · fixed in 2.19.1

Inefficient Regular Expression Complexity in Loofah

• Denial of service

<2.19.1 · fixed in 2.19.1

Duplicate Advisory: Resque Scheduler Reflected XSS In Delayed Jobs View

• Cross-site scripting (XSS)

>=1.27.4, <4.10.2 · fixed in 4.10.2

Unchecked return value from xmlTextReaderExpand

• Memory corruption
• CWE-252

>=1.13.8, <1.13.10 · fixed in 1.13.10

Sinatra vulnerable to Reflected File Download attack

• CWE-494

>=2.0.0, <2.2.3 || >=3.0, <3.0.4 · fixed in 2.2.3, 3.0.4

Unsanitized input leading to code injection in Dalli

• Other injection
• CWE-707

<3.2.3 · fixed in 3.2.3

HTTP response splitting in CGI

• Other injection
• CWE-436

<0.1.0.2 || >=0.2.0, <0.2.2 || >=0.3.0, <0.3.5 · fixed in 0.1.0.2, 0.2.2, 0.3.5

fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)

• Insecure deserialization

>=1.13.2, <1.15.3 · fixed in 1.15.3

Cross-site Scripting in actionpack

• Cross-site scripting (XSS)
• CWE-707

<=7.0.4 · no fixed version yet

Update bundled libxml2 to v2.10.3 to resolve multiple CVEs

<1.13.9 · fixed in 1.13.9

Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint

• CWE-20

<0.20.1 · fixed in 0.20.1

protobuf-java has a potential Denial of Service issue

• CWE-20

>=3.21.0-rc-1, <3.21.7 || >=3.20.0-rc-1, <3.20.3 || >=3.17.0-rc-1, <3.19.6 || <3.16.3 · fixed in 3.21.7, 3.20.3, 3.19.6, 3.16.3

SQLite3 addresses vulnerability in packaged version of libsqlite

>=1.5.0, <1.5.1 · fixed in 1.5.1

Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service

• Denial of service

<0.23.6 · fixed in 0.23.6

arr-pm vulnerable to arbitrary shell execution when extracting or listing files contained in a malicious rpm.

• Command injection

<0.0.12 · fixed in 0.0.12

Pageflow vulnerable to insecure direct object reference in membership update endpoint

<14.5.2 || >=15.0.0, <15.7.1 · fixed in 14.5.2, 15.7.1

Pageflow vulnerable to sensitive user data extraction via Ransack query injection

<14.5.2 || >=15.0.0, <15.7.1 · fixed in 14.5.2, 15.7.1