Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Investigate Ubuntu libxslt patches in USN-3947-1 and USN-3947-2 #1892

Closed
flavorjones opened this issue Apr 16, 2019 · 7 comments
Closed

Investigate Ubuntu libxslt patches in USN-3947-1 and USN-3947-2 #1892

flavorjones opened this issue Apr 16, 2019 · 7 comments
Labels
topic/security vendored/libxslt
Milestone
v1.10.x patch rel...

Comments

@flavorjones
Copy link
Member

flavorjones commented Apr 16, 2019 •
edited
Loading

This issue is to drive investigation and potential action around a set of upstream patches that Canonical judged valuable enough to port to their distributions.

References:

Summary (updated 2019-04-22):

The patch addressing this vulnerability is not yet available in an upstream libxslt release, and so Your Humble Maintainer has cut v1.10.3 of Nokogiri that includes this patch in the vendored library.

Interpretation:

To the best of my (@flavorjones) understanding of the vulnerability, an application should not be vulnerable unless it is doing both of the following things:

  1. explicitly performing XSLT transformations using methods and classes in the Nokogiri::XSLT module
  2. and doing so using untrusted stylesheets or untrusted documents

If your code is not doing both of those things, then I believe you can treat this as a lower priority.

History of editing this issue:

  • 2019-04-15: issue created
  • 2019-04-22: updated with USN/CVE background and note indicating Nokogiri v1.10.3 has been released
  • 2019-04-23: added link to NVD entry, and replaced Debian's reported severity with the one in NVD (which Debian points to).
  • 2019-04-23: added an interpretation to help guide individual teams' priorities.
@flavorjones
Copy link
Member Author

flavorjones commented Apr 22, 2019 •
edited
Loading

USNs

https://usn.ubuntu.com/3947-1/ which addresses CVE-2019-11068

https://usn.ubuntu.com/3947-2/ which also addresses CVE-2019-11068

CVEs

CVE-2019-11068

Permalinks

Severity

  • Canonical rates this as "Priority: Medium".
  • NVD indicates that this is a CVSS v3.0 severity "9.8: Critical".

Description

libxslt through 1.1.33 allows bypass of a protection mechanism
because callers of xsltCheckRead and xsltCheckWrite permit access
even upon receiving a -1 error code. xsltCheckRead can return -1 for
a crafted URL that is not actually invalid and is subsequently
loaded.

Upstream

The Debian bug report indicates this as the upstream commit addressing the vulnerability:

https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6

Looking at upstream source for libxslt:

$ git tag --contains e035536

... we see this commit is not yet in a libxslt release.

flavorjones added a commit that referenced this issue Apr 22, 2019
@flavorjones
Backport libxslt patch for CVE-2019-11068
fe034ae 
related to USN-3947-1 and USN-3947-2.

addresses #1892
@flavorjones flavorjones mentioned this issue Apr 22, 2019
Merged
@flavorjones
Copy link
Member Author

Backported patch is in a PR at #1898

@flavorjones
Copy link
Member Author

flavorjones commented Apr 22, 2019 •
edited
Loading

TODO for releasing v1.10.3:

  • builds are complete
  • CI goes green
  • update nokogiri.org
  • gems uploaded
  • update nokogiri release on github
  • email nokogiri-talk, ruby-talk, [email protected], [email protected]
  • update TideLift

@flavorjones flavorjones added this to the v1.10.x patch releases milestone Apr 22, 2019
@flavorjones
Copy link
Member Author

Email to Tidelift support versions being out of sync. Will handle once that's synced.

hpjaj added a commit to department-of-veterans-affairs/vets-api that referenced this issue Apr 22, 2019
@hpjaj
Resolves gem vulnerability issues
ce1b0bb 
Stems from:

A CVE for Nokogiri and all vets-api builds will fail until we upgrade nokogiri:

sparklemotion/nokogiri#1892
@hpjaj hpjaj mentioned this issue Apr 22, 2019
Merged
7 tasks
@nporteschaikin
Copy link

@flavorjones Hi! 👋 Are you also going to backport this fix to the minor version 1.9?

hpjaj added a commit to department-of-veterans-affairs/vets-api that referenced this issue Apr 22, 2019
@hpjaj
Resolves gem vulnerability issues with Nokogiri (#2989)
8bb1e0d 
* Resolves gem vulnerability issues

Stems from:

A CVE for Nokogiri and all vets-api builds will fail until we upgrade nokogiri:

sparklemotion/nokogiri#1892
@flavorjones
Copy link
Member Author

@nporteschaikin No, was not intending to backport to v1.9.x.

va-bot pushed a commit to department-of-veterans-affairs/caseflow that referenced this issue Apr 22, 2019
@lomaxap
Upgrade Nokogiri (#10500)
21b1454 
CircleCI reported security vulnerability for version 1.8.5. Upgrades Nokogiri to version 1.10.3

```
Name: nokogiri
Version: 1.8.5
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Solution: upgrade to >= 1.10.3

Vulnerabilities found!

Failed. Security vulnerabilities were found. Find the dependency in Gemfile.lock, then specify a safe version of the dependency in the Gemfile (preferred) or snooze the CVE in security.rake for a week.
```
This was referenced Apr 22, 2019
Merged
Merged
phallstrom added a commit to railslink/railslink that referenced this issue Apr 23, 2019
@phallstrom
update nokogiri gem due to CVE-2019-11068
ef207e2 
Name: nokogiri
Version: 1.8.5
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Solution: upgrade to >= 1.10.3
@phallstrom phallstrom mentioned this issue Apr 23, 2019
Merged
phallstrom added a commit to railslink/railslink that referenced this issue Apr 23, 2019
@phallstrom
update nokogiri gem due to CVE-2019-11068 (#96)
02df5ef 
Name: nokogiri
Version: 1.8.5
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Solution: upgrade to >= 1.10.3
@JunichiIto JunichiIto mentioned this issue Apr 23, 2019
Closed
@guentr guentr mentioned this issue Apr 23, 2019
Closed
@flavorjones
Copy link
Member Author

flavorjones commented Apr 23, 2019 •
edited
Loading

I've added an "interpretation" note in the description to help people understand whether it's likely (or not) that their code is susceptible to this vulnerability. It says the following:

To the best of my (@flavorjones) understanding of the vulnerability, an application should not be vulnerable unless it is doing both of the following things:

  1. explicitly performing XSLT transformations using methods and classes in the Nokogiri::XSLT module
  2. and doing so using untrusted stylesheets or untrusted documents

If your code is not doing both of those things, then I believe you can treat this as a lower priority.

david-a-wheeler added a commit to coreinfrastructure/best-practices-badge that referenced this issue Apr 24, 2019
@david-a-wheeler
Update gem nokogiri (1.10.1->1.10.3)
5ccd4aa 
Update nokogi gem per CVE-2019-11068,
URL: sparklemotion/nokogiri#1892
"Nokogiri gem, via libxslt, is affected by
improper access control vulnerability".

Signed-off-by: David A. Wheeler <[email protected]>
dannyvanderheiden added a commit to digidentity/libsaml that referenced this issue Apr 26, 2019
@dannyvanderheiden
Add support for “nokogiri” gem > 1.8 regarding CVE-2019-11068:
f3fa584 
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Solution: upgrade to >= 1.10.3
Kagemaru added a commit to puzzle/puzzletime that referenced this issue Apr 30, 2019
@Kagemaru
Update Nokogiri to fix vulnerability
ea7bc91 
Name: nokogiri
Version: 1.10.1
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Solution: upgrade to >= 1.10.3
Kagemaru added a commit to puzzle/puzzletime that referenced this issue Apr 30, 2019
@Kagemaru
Update Nokogiri to fix vulnerability
71ee0de 
Name: nokogiri
Version: 1.10.1
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Solution: upgrade to >= 1.10.3
@rmkanda rmkanda mentioned this issue May 1, 2019
Closed
rokumatsumoto added a commit to rokumatsumoto/boyutluseyler that referenced this issue May 1, 2019
@rokumatsumoto
Update nokogiri gem due to CVE-2019-11068
3961d91 
Name: nokogiri
Version: 1.10.2
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Solution: upgrade to >= 1.10.3
dentarg added a commit to twingly/feedbag.herokuapp.com that referenced this issue May 2, 2019
@dentarg
Update nokogiri (CVE-2019-11068)
29662bf 
From https://travis-ci.com/twingly/audit/jobs/197170353

Name: nokogiri
Version: 1.10.1
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Solution: upgrade to >= 1.10.3
dentarg added a commit to twingly/feedjira.herokuapp.com that referenced this issue May 2, 2019
@dentarg
Update nokogiri (CVE-2019-11068)
16c9f1e 
From https://travis-ci.com/twingly/audit/jobs/197170353

Name: nokogiri
Version: 1.10.1
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Solution: upgrade to >= 1.10.3
azul pushed a commit to riseuplabs/crabgrass-core that referenced this issue Jun 2, 2019
@azul
Fix: security update for nokogiri
7a703e0 
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Kagemaru added a commit to puzzle/puzzletime that referenced this issue Jun 3, 2019
@Kagemaru
Update Nokogiri to fix vulnerability
7a6e56d 
Name: nokogiri
Version: 1.10.1
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Solution: upgrade to >= 1.10.3
@sebastienbeau sebastienbeau mentioned this issue Jun 5, 2019
Merged
netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this issue Jun 22, 2019
@tsutsui
ruby-nokogiri: update to 1.10.3.
9be932c 
Upstream changelog (from CHANGELOG.md):

## 1.10.3 / 2019-04-22

### Security Notes

[MRI] Pulled in upstream patch from libxslt that addresses CVE-2019-11068. Full details are available in [#1892](sparklemotion/nokogiri#1892). Note that this patch is not yet (as of 2019-04-22) in an upstream release of libxslt.


## 1.10.2 / 2019-03-24

### Security

* [MRI] Remove support from vendored libxml2 for future script macros. [#1871]
* [MRI] Remove support from vendored libxml2 for server-side includes within attributes. [#1877]


### Bug fixes

* [JRuby] Fix node ownership in duplicated documents. [#1060]
* [JRuby] Rethrow exceptions caught by Java SAX handler. [#1847, #1872] (Thanks, @adjam!)
alexdean added a commit to alexdean/focus_group that referenced this issue Jun 25, 2019
@alexdean
update dependencies for multiple CVEs
dc656df 
$ bundle exec bundle-audit check

Name: actionview
Version: 5.2.1
Advisory: CVE-2019-5419
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI
Title: Denial of Service Vulnerability in Action View
Solution: upgrade to >= 6.0.0.beta3, >= 5.2.2.1, ~> 5.2.2, >= 5.1.6.2, ~> 5.1.6, >= 5.0.7.2, ~> 5.0.7, >= 4.2.11.1, ~> 4.2.11

Name: actionview
Version: 5.2.1
Advisory: CVE-2019-5418
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q
Title: File Content Disclosure in Action View
Solution: upgrade to >= 4.2.11.1, ~> 4.2.11, >= 5.0.7.2, ~> 5.0.7, >= 5.1.6.2, ~> 5.1.6, >= 5.2.2.1, ~> 5.2.2, >= 6.0.0.beta3

Name: activejob
Version: 5.2.1
Advisory: CVE-2018-16476
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw
Title: Broken Access Control vulnerability in Active Job
Solution: upgrade to ~> 4.2.11, ~> 5.0.7.1, ~> 5.1.6.1, ~> 5.1.7, >= 5.2.1.1

Name: activestorage
Version: 5.2.1
Advisory: CVE-2018-16477
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/3KQRnXDIuLg
Title: Bypass vulnerability in Active Storage
Solution: upgrade to >= 5.2.1.1

Name: loofah
Version: 2.2.2
Advisory: CVE-2018-16468
Criticality: Unknown
URL: flavorjones/loofah#154
Title: Loofah XSS Vulnerability
Solution: upgrade to >= 2.2.3

Name: nokogiri
Version: 1.8.4
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Solution: upgrade to >= 1.10.3

Name: nokogiri
Version: 1.8.4
Advisory: CVE-2018-14404
Criticality: Unknown
URL: sparklemotion/nokogiri#1785
Title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities
Solution: upgrade to >= 1.8.5

Name: rack
Version: 2.0.5
Advisory: CVE-2018-16470
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/ruby-security-ann/Dz4sRl-ktKk
Title: Possible DoS vulnerability in Rack
Solution: upgrade to >= 2.0.6

Name: rack
Version: 2.0.5
Advisory: CVE-2018-16471
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/ruby-security-ann/NAalCee8n6o
Title: Possible XSS vulnerability in Rack
Solution: upgrade to ~> 1.6.11, >= 2.0.6

Name: railties
Version: 5.2.1
Advisory: CVE-2019-5420
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/IsQKvDqZdKw
Title: Possible Remote Code Execution Exploit in Rails Development Mode
Solution: upgrade to >= 5.2.2.1, ~> 5.2.2, >= 6.0.0.beta3

Vulnerabilities found!
notalex added a commit to blackducksoftware/ohloh-ui that referenced this issue Aug 19, 2019
@notalex
OTWO-5708: Upgrade nokogiri to address vulnerability
df0024c 
sparklemotion/nokogiri#1892

We had to downgrade bundler as rails 4.2 depends on bundler <2
@notalex notalex mentioned this issue Aug 19, 2019
Merged
Koronen added a commit to Koronen/koronen.github.io that referenced this issue Aug 20, 2019
@Koronen
Bump gems
ee3c31e 
Address two `nokogiri` CVEs (as reported by `bundler-audit`).

    Name: nokogiri
    Version: 1.10.1
    Advisory: CVE-2019-5477
    Criticality: Unknown
    URL: sparklemotion/nokogiri#1915
    Title: Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file
    Solution: upgrade to >= 1.10.4

    Name: nokogiri
    Version: 1.10.1
    Advisory: CVE-2019-11068
    Criticality: Unknown
    URL: sparklemotion/nokogiri#1892
    Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
    Solution: upgrade to >= 1.10.3
@johnsyweb johnsyweb mentioned this issue Aug 21, 2019
Merged
@typeoneerror typeoneerror mentioned this issue Nov 11, 2019
Open
schleuderrr pushed a commit to schleuder/schleuder-web that referenced this issue Jan 4, 2020
@sssggr
Update dependencies
564e369 
This also includes an upgrade of the nokogiri version to fix the
following vulnerability:

Name: nokogiri
Version: 1.10.1
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
azul pushed a commit to riseuplabs/crabgrass-core that referenced this issue Feb 28, 2020
@azul
Fix: security update for nokogiri
4d4b4fe 
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
tasmo pushed a commit to prototypefund/crabgrass that referenced this issue Apr 17, 2020
@azul
Fix: security update for nokogiri
cd6dc45 
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
@AdrianCann AdrianCann mentioned this issue Oct 10, 2020
Merged
senid231 added a commit to senid231/didww-v3-rails-sample that referenced this issue Feb 10, 2021
@senid231
fix vulnerabilities
adc1382 
Name: actionpack
Version: 5.1.4
Advisory: CVE-2020-8166
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw
Title: Ability to forge per-form CSRF tokens given a global CSRF token
Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1

Name: actionpack
Version: 5.1.4
Advisory: CVE-2020-8164
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY
Title: Possible Strong Parameters Bypass in ActionPack
Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1

Name: actionview
Version: 5.1.4
Advisory: CVE-2020-15169
Criticality: Unknown
URL: https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc
Title: Potential XSS vulnerability in Action View
Solution: upgrade to ~> 5.2.4, >= 5.2.4.4, >= 6.0.3.3

Name: actionview
Version: 5.1.4
Advisory: CVE-2020-8167
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0
Title: CSRF Vulnerability in rails-ujs
Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1

Name: actionview
Version: 5.1.4
Advisory: CVE-2019-5418
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q
Title: File Content Disclosure in Action View
Solution: upgrade to ~> 4.2.11, >= 4.2.11.1, ~> 5.0.7, >= 5.0.7.2, ~> 5.1.6, >= 5.1.6.2, ~> 5.2.2, >= 5.2.2.1, >= 6.0.0.beta3

Name: actionview
Version: 5.1.4
Advisory: CVE-2020-5267
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8
Title: Possible XSS vulnerability in ActionView
Solution: upgrade to ~> 5.2.4, >= 5.2.4.2, >= 6.0.2.2

Name: actionview
Version: 5.1.4
Advisory: CVE-2019-5419
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI
Title: Denial of Service Vulnerability in Action View
Solution: upgrade to >= 6.0.0.beta3, ~> 5.2.2, >= 5.2.2.1, ~> 5.1.6, >= 5.1.6.2, ~> 5.0.7, >= 5.0.7.2, ~> 4.2.11, >= 4.2.11.1

Name: activejob
Version: 5.1.4
Advisory: CVE-2018-16476
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw
Title: Broken Access Control vulnerability in Active Job
Solution: upgrade to ~> 4.2.11, ~> 5.0.7.1, ~> 5.1.6.1, ~> 5.1.7, >= 5.2.1.1

Name: activesupport
Version: 5.1.4
Advisory: CVE-2020-8165
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c
Title: Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1

Name: ffi
Version: 1.9.18
Advisory: CVE-2018-1000201
Criticality: High
URL: https://github.com/ffi/ffi/releases/tag/1.9.24
Title: ruby-ffi DDL loading issue on Windows OS
Solution: upgrade to >= 1.9.24

Name: jquery-rails
Version: 4.3.1
Advisory: CVE-2019-11358
Criticality: Medium
URL: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
Title: Prototype pollution attack through jQuery $.extend
Solution: upgrade to >= 4.3.4

Name: loofah
Version: 2.1.1
Advisory: CVE-2018-8048
Criticality: Unknown
URL: flavorjones/loofah#144
Title: Loofah XSS Vulnerability
Solution: upgrade to >= 2.2.1

Name: loofah
Version: 2.1.1
Advisory: CVE-2018-16468
Criticality: Medium
URL: flavorjones/loofah#154
Title: Loofah XSS Vulnerability
Solution: upgrade to >= 2.2.3

Name: loofah
Version: 2.1.1
Advisory: CVE-2019-15587
Criticality: Medium
URL: flavorjones/loofah#171
Title: Loofah XSS Vulnerability
Solution: upgrade to >= 2.3.1

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2017-15412
Criticality: Unknown
URL: sparklemotion/nokogiri#1714
Title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities
Solution: upgrade to >= 1.8.2

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2018-8048
Criticality: Unknown
URL: sparklemotion/nokogiri#1746
Title: Revert libxml2 behavior in Nokogiri gem that could cause XSS
Solution: upgrade to >= 1.8.3

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2020-26247
Criticality: Low
URL: GHSA-vr8q-g5c7-m54m
Title: Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability
Solution: upgrade to >= 1.11.0.rc4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2018-14404
Criticality: Unknown
URL: sparklemotion/nokogiri#1785
Title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities
Solution: upgrade to >= 1.8.5

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Solution: upgrade to >= 1.10.3

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2020-7595
Criticality: High
URL: sparklemotion/nokogiri#1992
Title: libxml2 2.9.10 has an infinite loop in a certain end-of-file situation
Solution: upgrade to >= 1.10.8

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2019-5477
Criticality: Critical
URL: sparklemotion/nokogiri#1915
Title: Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file
Solution: upgrade to >= 1.10.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2019-13117
Criticality: Unknown
URL: sparklemotion/nokogiri#1943
Title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities
Solution: upgrade to >= 1.10.5

Name: rack
Version: 2.0.8
Advisory: CVE-2020-8161
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA
Title: Directory traversal in Rack::Directory app bundled with Rack
Solution: upgrade to ~> 2.1.3, >= 2.2.0

Name: rack
Version: 2.0.8
Advisory: CVE-2020-8184
Criticality: Unknown
URL: https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak
Title: Percent-encoded cookies can be used to overwrite existing prefixed cookie names
Solution: upgrade to ~> 2.1.4, >= 2.2.3

Name: rails-html-sanitizer
Version: 1.0.3
Advisory: CVE-2018-3741
Criticality: Unknown
URL: https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ
Title: XSS vulnerability in rails-html-sanitizer
Solution: upgrade to >= 1.0.4

Name: sprockets
Version: 3.7.1
Advisory: CVE-2018-3760
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/ruby-security-ann/2S9Pwz2i16k
Title: Path Traversal in Sprockets
Solution: upgrade to >= 2.12.5, < 3.0.0, >= 3.7.2, < 4.0.0, >= 4.0.0.beta8
mediafinger added a commit to mediafinger/wahlgenial-webapp that referenced this issue Apr 19, 2022
@mediafinger
Make rake bundle:audit available to detect known security issues (C…
0739429 
…VEs)

It found the following 53 vulnerabilities:

Name: actionpack
Version: 5.1.4
Advisory: CVE-2021-22885
Criticality: High
URL: https://groups.google.com/g/rubyonrails-security/c/NiQl-48cXYI
Title: Possible Information Disclosure / Unintended Method Execution in Action Pack
Solution: upgrade to ~> 5.2.4.6, ~> 5.2.6, ~> 6.0.3, >= 6.0.3.7, >= 6.1.3.2

Name: actionpack
Version: 5.1.4
Advisory: CVE-2020-8166
Criticality: Medium
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw
Title: Ability to forge per-form CSRF tokens given a global CSRF token
Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1

Name: actionpack
Version: 5.1.4
Advisory: CVE-2020-8164
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY
Title: Possible Strong Parameters Bypass in ActionPack
Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1

Name: actionpack
Version: 5.1.4
Advisory: CVE-2021-22904
Criticality: High
URL: https://groups.google.com/g/rubyonrails-security/c/Pf1TjkOBdyQ
Title: Possible DoS Vulnerability in Action Controller Token Authentication
Solution: upgrade to ~> 5.2.4.6, ~> 5.2.6, ~> 6.0.3, >= 6.0.3.7, >= 6.1.3.2

Name: actionpack
Version: 5.1.4
Advisory: CVE-2022-23633
Criticality: High
URL: https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ
Title: Possible exposure of information vulnerability in Action Pack
Solution: upgrade to ~> 5.2.6, >= 5.2.6.2, ~> 6.0.4, >= 6.0.4.6, ~> 6.1.4, >= 6.1.4.6, >= 7.0.2.2

Name: actionview
Version: 5.1.4
Advisory: CVE-2020-15169
Criticality: Medium
URL: https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc
Title: Potential XSS vulnerability in Action View
Solution: upgrade to ~> 5.2.4, >= 5.2.4.4, >= 6.0.3.3

Name: actionview
Version: 5.1.4
Advisory: CVE-2020-5267
Criticality: Medium
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8
Title: Possible XSS vulnerability in ActionView
Solution: upgrade to ~> 5.2.4, >= 5.2.4.2, >= 6.0.2.2

Name: actionview
Version: 5.1.4
Advisory: CVE-2020-8167
Criticality: Medium
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0
Title: CSRF Vulnerability in rails-ujs
Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1

Name: actionview
Version: 5.1.4
Advisory: CVE-2019-5419
Criticality: High
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI
Title: Denial of Service Vulnerability in Action View
Solution: upgrade to >= 6.0.0.beta3, ~> 5.2.2, >= 5.2.2.1, ~> 5.1.6, >= 5.1.6.2, ~> 5.0.7, >= 5.0.7.2, ~> 4.2.11, >= 4.2.11.1

Name: actionview
Version: 5.1.4
Advisory: CVE-2019-5418
Criticality: High
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q
Title: File Content Disclosure in Action View
Solution: upgrade to ~> 4.2.11, >= 4.2.11.1, ~> 5.0.7, >= 5.0.7.2, ~> 5.1.6, >= 5.1.6.2, ~> 5.2.2, >= 5.2.2.1, >= 6.0.0.beta3

Name: activejob
Version: 5.1.4
Advisory: CVE-2018-16476
Criticality: High
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw
Title: Broken Access Control vulnerability in Active Job
Solution: upgrade to ~> 4.2.11, ~> 5.0.7.1, ~> 5.1.6.1, ~> 5.1.7, >= 5.2.1.1

Name: activerecord
Version: 5.1.4
Advisory: CVE-2021-22880
Criticality: Medium
URL: https://groups.google.com/g/rubyonrails-security/c/ZzUqCh9vyhI
Title: Possible DoS Vulnerability in Active Record PostgreSQL adapter
Solution: upgrade to ~> 5.2.4, >= 5.2.4.5, ~> 6.0.3, >= 6.0.3.5, >= 6.1.2.1

Name: activesupport
Version: 5.1.4
Advisory: CVE-2020-8165
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c
Title: Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1

Name: addressable
Version: 2.5.2
Advisory: CVE-2021-32740
Criticality: High
URL: GHSA-jxhc-q857-3j6g
Title: Regular Expression Denial of Service in Addressable templates
Solution: upgrade to >= 2.8.0

Name: carrierwave
Version: 1.2.1
Advisory: CVE-2021-21288
Criticality: Medium
URL: GHSA-fwcm-636p-68r5
Title: Server-side request forgery in CarrierWave
Solution: upgrade to ~> 1.3.2, >= 2.1.1

Name: carrierwave
Version: 1.2.1
Advisory: CVE-2021-21305
Criticality: High
URL: GHSA-cf3w-g86h-35x4
Title: Code Injection vulnerability in CarrierWave::RMagick
Solution: upgrade to ~> 1.3.2, >= 2.1.1

Name: ffi
Version: 1.9.18
Advisory: CVE-2018-1000201
Criticality: High
URL: https://github.com/ffi/ffi/releases/tag/1.9.24
Title: ruby-ffi DDL loading issue on Windows OS
Solution: upgrade to >= 1.9.24

Name: jquery-rails
Version: 4.3.1
Advisory: CVE-2020-11023
Criticality: Medium
URL: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released
Title: Potential XSS vulnerability in jQuery
Solution: upgrade to >= 4.4.0

Name: jquery-rails
Version: 4.3.1
Advisory: CVE-2019-11358
Criticality: Medium
URL: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
Title: Prototype pollution attack through jQuery $.extend
Solution: upgrade to >= 4.3.4

Name: jquery-ui-rails
Version: 5.0.5
Advisory: CVE-2016-7103
Criticality: Medium
URL: jquery/api.jqueryui.com#281
Title: XSS Vulnerability on closeText option of Dialog jQuery UI
Solution: upgrade to >= 6.0.0

Name: kaminari
Version: 1.1.1
Advisory: CVE-2020-11082
Criticality: Medium
URL: GHSA-r5jw-62xg-j433
Title: Cross-Site Scripting in Kaminari via `original_script_name` parameter
Solution: upgrade to >= 1.2.1

Name: loofah
Version: 2.1.1
Advisory: CVE-2019-15587
Criticality: Medium
URL: flavorjones/loofah#171
Title: Loofah XSS Vulnerability
Solution: upgrade to >= 2.3.1

Name: loofah
Version: 2.1.1
Advisory: CVE-2018-16468
Criticality: Medium
URL: flavorjones/loofah#154
Title: Loofah XSS Vulnerability
Solution: upgrade to >= 2.2.3

Name: loofah
Version: 2.1.1
Advisory: CVE-2018-8048
Criticality: Medium
URL: flavorjones/loofah#144
Title: Loofah XSS Vulnerability
Solution: upgrade to >= 2.2.1

Name: mini_magick
Version: 4.8.0
Advisory: CVE-2019-13574
Criticality: High
URL: https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4/
Title: Remote command execution via filename
Solution: upgrade to >= 4.9.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2019-5477
Criticality: Critical
URL: sparklemotion/nokogiri#1915
Title: Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file
Solution: upgrade to >= 1.10.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2021-41098
Criticality: High
URL: GHSA-2rr5-8q37-2w7h
Title: Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
Solution: upgrade to >= 1.12.5

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Solution: upgrade to >= 1.10.3

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2018-14404
Criticality: High
URL: sparklemotion/nokogiri#1785
Title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities
Solution: upgrade to >= 1.8.5

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2017-15412
Criticality: Unknown
URL: sparklemotion/nokogiri#1714
Title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities
Solution: upgrade to >= 1.8.2

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2022-24839
Criticality: High
URL: GHSA-9849-p7jc-9rmv
Title: Denial of Service (DoS) in Nokogiri on JRuby
Solution: upgrade to >= 1.13.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2022-23437
Criticality: Medium
URL: GHSA-xxx9-3xcr-gjj3
Title: XML Injection in Xerces Java affects Nokogiri
Solution: upgrade to >= 1.13.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2021-30560
Criticality: High
URL: GHSA-fq42-c5rg-92c2
Title: Update packaged libxml2 (2.9.12 → 2.9.13) and libxslt (1.1.34 → 1.1.35)
Solution: upgrade to >= 1.13.2

Name: nokogiri
Version: 1.8.1
Advisory: GHSA-7rrm-v45f-jp64
Criticality: High
URL: GHSA-7rrm-v45f-jp64
Title: Update packaged dependency libxml2 from 2.9.10 to 2.9.12
Solution: upgrade to >= 1.11.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2018-25032
Criticality: High
URL: GHSA-v6gp-9mmm-c6p5
Title: Out-of-bounds Write in zlib affects Nokogiri
Solution: upgrade to >= 1.13.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2018-8048
Criticality: Unknown
URL: sparklemotion/nokogiri#1746
Title: Revert libxml2 behavior in Nokogiri gem that could cause XSS
Solution: upgrade to >= 1.8.3

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2020-7595
Criticality: High
URL: sparklemotion/nokogiri#1992
Title: libxml2 2.9.10 has an infinite loop in a certain end-of-file situation
Solution: upgrade to >= 1.10.8

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2019-13117
Criticality: Unknown
URL: sparklemotion/nokogiri#1943
Title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities
Solution: upgrade to >= 1.10.5

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2022-24836
Criticality: High
URL: GHSA-crjr-9rc5-ghw8
Title: Inefficient Regular Expression Complexity in Nokogiri
Solution: upgrade to >= 1.13.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2020-26247
Criticality: Low
URL: GHSA-vr8q-g5c7-m54m
Title: Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability
Solution: upgrade to >= 1.11.0.rc4

Name: puma
Version: 4.3.3
Advisory: CVE-2021-29509
Criticality: High
URL: GHSA-q28m-8xjw-8vr5
Title: Keepalive Connections Causing Denial Of Service in puma
Solution: upgrade to ~> 4.3.8, >= 5.3.1

Name: puma
Version: 4.3.3
Advisory: CVE-2022-24790
Criticality: Critical
URL: GHSA-h99w-9q5r-gjq9
Title: HTTP Request Smuggling in puma
Solution: upgrade to ~> 4.3.12, >= 5.6.4

Name: puma
Version: 4.3.3
Advisory: CVE-2020-11076
Criticality: High
URL: GHSA-x7jg-6pwg-fx5h
Title: HTTP Smuggling via Transfer-Encoding Header in Puma
Solution: upgrade to ~> 3.12.5, >= 4.3.4

Name: puma
Version: 4.3.3
Advisory: CVE-2020-11077
Criticality: Medium
URL: GHSA-w64w-qqph-5gxm
Title: HTTP Smuggling via Transfer-Encoding Header in Puma
Solution: upgrade to ~> 3.12.6, >= 4.3.5

Name: puma
Version: 4.3.3
Advisory: CVE-2022-23634
Criticality: High
URL: GHSA-rmj8-8hhh-gv5h
Title: Information Exposure with Puma when used with Rails
Solution: upgrade to ~> 4.3.11, >= 5.6.2

Name: puma
Version: 4.3.3
Advisory: CVE-2021-41136
Criticality: Low
URL: GHSA-48w2-rm65-62xx
Title: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma
Solution: upgrade to ~> 4.3.9, >= 5.5.1

Name: rack
Version: 2.2.2
Advisory: CVE-2020-8184
Criticality: Unknown
URL: https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak
Title: Percent-encoded cookies can be used to overwrite existing prefixed cookie names
Solution: upgrade to ~> 2.1.4, >= 2.2.3

Name: rails-html-sanitizer
Version: 1.0.3
Advisory: CVE-2018-3741
Criticality: Unknown
URL: https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ
Title: XSS vulnerability in rails-html-sanitizer
Solution: upgrade to >= 1.0.4

Name: rails_admin
Version: 1.2.0
Advisory: CVE-2020-36190
Criticality: Medium
URL: railsadminteam/rails_admin@d72090e
Title: rails_admin ruby gem XSS vulnerability
Solution: upgrade to ~> 1.4.3, >= 2.0.2

Name: rails_admin
Version: 1.2.0
Advisory: CVE-2017-12098
Criticality: Medium
URL: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0450
Title: rails_admin ruby gem XSS vulnerability
Solution: upgrade to >= 1.3.0

Name: rake
Version: 12.3.0
Advisory: CVE-2020-8130
Criticality: High
URL: GHSA-jppv-gw3r-w3q8
Title: OS Command Injection in Rake
Solution: upgrade to >= 12.3.3

Name: redcarpet
Version: 3.4.0
Advisory: CVE-2020-26298
Criticality: Medium
URL: vmg/redcarpet@a699c82
Title: Injection/XSS in Redcarpet
Solution: upgrade to >= 3.5.1

Name: websocket-extensions
Version: 0.1.3
Advisory: CVE-2020-7663
Criticality: High
URL: GHSA-g6wq-qcwm-j5g2
Title: Regular Expression Denial of Service in websocket-extensions (RubyGem)
Solution: upgrade to >= 0.1.5
mediafinger added a commit to mediafinger/wahlgenial-webapp that referenced this issue Apr 19, 2022
@mediafinger
Make rake bundle:audit available to detect known security issues (C…
c623972 
…VEs)

It found the following 53 vulnerabilities:

Name: actionpack
Version: 5.1.4
Advisory: CVE-2021-22885
Criticality: High
URL: https://groups.google.com/g/rubyonrails-security/c/NiQl-48cXYI
Title: Possible Information Disclosure / Unintended Method Execution in Action Pack
Solution: upgrade to ~> 5.2.4.6, ~> 5.2.6, ~> 6.0.3, >= 6.0.3.7, >= 6.1.3.2

Name: actionpack
Version: 5.1.4
Advisory: CVE-2020-8166
Criticality: Medium
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw
Title: Ability to forge per-form CSRF tokens given a global CSRF token
Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1

Name: actionpack
Version: 5.1.4
Advisory: CVE-2020-8164
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY
Title: Possible Strong Parameters Bypass in ActionPack
Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1

Name: actionpack
Version: 5.1.4
Advisory: CVE-2021-22904
Criticality: High
URL: https://groups.google.com/g/rubyonrails-security/c/Pf1TjkOBdyQ
Title: Possible DoS Vulnerability in Action Controller Token Authentication
Solution: upgrade to ~> 5.2.4.6, ~> 5.2.6, ~> 6.0.3, >= 6.0.3.7, >= 6.1.3.2

Name: actionpack
Version: 5.1.4
Advisory: CVE-2022-23633
Criticality: High
URL: https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ
Title: Possible exposure of information vulnerability in Action Pack
Solution: upgrade to ~> 5.2.6, >= 5.2.6.2, ~> 6.0.4, >= 6.0.4.6, ~> 6.1.4, >= 6.1.4.6, >= 7.0.2.2

Name: actionview
Version: 5.1.4
Advisory: CVE-2020-15169
Criticality: Medium
URL: https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc
Title: Potential XSS vulnerability in Action View
Solution: upgrade to ~> 5.2.4, >= 5.2.4.4, >= 6.0.3.3

Name: actionview
Version: 5.1.4
Advisory: CVE-2020-5267
Criticality: Medium
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8
Title: Possible XSS vulnerability in ActionView
Solution: upgrade to ~> 5.2.4, >= 5.2.4.2, >= 6.0.2.2

Name: actionview
Version: 5.1.4
Advisory: CVE-2020-8167
Criticality: Medium
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0
Title: CSRF Vulnerability in rails-ujs
Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1

Name: actionview
Version: 5.1.4
Advisory: CVE-2019-5419
Criticality: High
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI
Title: Denial of Service Vulnerability in Action View
Solution: upgrade to >= 6.0.0.beta3, ~> 5.2.2, >= 5.2.2.1, ~> 5.1.6, >= 5.1.6.2, ~> 5.0.7, >= 5.0.7.2, ~> 4.2.11, >= 4.2.11.1

Name: actionview
Version: 5.1.4
Advisory: CVE-2019-5418
Criticality: High
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q
Title: File Content Disclosure in Action View
Solution: upgrade to ~> 4.2.11, >= 4.2.11.1, ~> 5.0.7, >= 5.0.7.2, ~> 5.1.6, >= 5.1.6.2, ~> 5.2.2, >= 5.2.2.1, >= 6.0.0.beta3

Name: activejob
Version: 5.1.4
Advisory: CVE-2018-16476
Criticality: High
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw
Title: Broken Access Control vulnerability in Active Job
Solution: upgrade to ~> 4.2.11, ~> 5.0.7.1, ~> 5.1.6.1, ~> 5.1.7, >= 5.2.1.1

Name: activerecord
Version: 5.1.4
Advisory: CVE-2021-22880
Criticality: Medium
URL: https://groups.google.com/g/rubyonrails-security/c/ZzUqCh9vyhI
Title: Possible DoS Vulnerability in Active Record PostgreSQL adapter
Solution: upgrade to ~> 5.2.4, >= 5.2.4.5, ~> 6.0.3, >= 6.0.3.5, >= 6.1.2.1

Name: activesupport
Version: 5.1.4
Advisory: CVE-2020-8165
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c
Title: Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1

Name: addressable
Version: 2.5.2
Advisory: CVE-2021-32740
Criticality: High
URL: GHSA-jxhc-q857-3j6g
Title: Regular Expression Denial of Service in Addressable templates
Solution: upgrade to >= 2.8.0

Name: carrierwave
Version: 1.2.1
Advisory: CVE-2021-21288
Criticality: Medium
URL: GHSA-fwcm-636p-68r5
Title: Server-side request forgery in CarrierWave
Solution: upgrade to ~> 1.3.2, >= 2.1.1

Name: carrierwave
Version: 1.2.1
Advisory: CVE-2021-21305
Criticality: High
URL: GHSA-cf3w-g86h-35x4
Title: Code Injection vulnerability in CarrierWave::RMagick
Solution: upgrade to ~> 1.3.2, >= 2.1.1

Name: ffi
Version: 1.9.18
Advisory: CVE-2018-1000201
Criticality: High
URL: https://github.com/ffi/ffi/releases/tag/1.9.24
Title: ruby-ffi DDL loading issue on Windows OS
Solution: upgrade to >= 1.9.24

Name: jquery-rails
Version: 4.3.1
Advisory: CVE-2020-11023
Criticality: Medium
URL: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released
Title: Potential XSS vulnerability in jQuery
Solution: upgrade to >= 4.4.0

Name: jquery-rails
Version: 4.3.1
Advisory: CVE-2019-11358
Criticality: Medium
URL: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
Title: Prototype pollution attack through jQuery $.extend
Solution: upgrade to >= 4.3.4

Name: jquery-ui-rails
Version: 5.0.5
Advisory: CVE-2016-7103
Criticality: Medium
URL: jquery/api.jqueryui.com#281
Title: XSS Vulnerability on closeText option of Dialog jQuery UI
Solution: upgrade to >= 6.0.0

Name: kaminari
Version: 1.1.1
Advisory: CVE-2020-11082
Criticality: Medium
URL: GHSA-r5jw-62xg-j433
Title: Cross-Site Scripting in Kaminari via `original_script_name` parameter
Solution: upgrade to >= 1.2.1

Name: loofah
Version: 2.1.1
Advisory: CVE-2019-15587
Criticality: Medium
URL: flavorjones/loofah#171
Title: Loofah XSS Vulnerability
Solution: upgrade to >= 2.3.1

Name: loofah
Version: 2.1.1
Advisory: CVE-2018-16468
Criticality: Medium
URL: flavorjones/loofah#154
Title: Loofah XSS Vulnerability
Solution: upgrade to >= 2.2.3

Name: loofah
Version: 2.1.1
Advisory: CVE-2018-8048
Criticality: Medium
URL: flavorjones/loofah#144
Title: Loofah XSS Vulnerability
Solution: upgrade to >= 2.2.1

Name: mini_magick
Version: 4.8.0
Advisory: CVE-2019-13574
Criticality: High
URL: https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4/
Title: Remote command execution via filename
Solution: upgrade to >= 4.9.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2019-5477
Criticality: Critical
URL: sparklemotion/nokogiri#1915
Title: Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file
Solution: upgrade to >= 1.10.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2021-41098
Criticality: High
URL: GHSA-2rr5-8q37-2w7h
Title: Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
Solution: upgrade to >= 1.12.5

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Solution: upgrade to >= 1.10.3

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2018-14404
Criticality: High
URL: sparklemotion/nokogiri#1785
Title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities
Solution: upgrade to >= 1.8.5

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2017-15412
Criticality: Unknown
URL: sparklemotion/nokogiri#1714
Title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities
Solution: upgrade to >= 1.8.2

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2022-24839
Criticality: High
URL: GHSA-9849-p7jc-9rmv
Title: Denial of Service (DoS) in Nokogiri on JRuby
Solution: upgrade to >= 1.13.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2022-23437
Criticality: Medium
URL: GHSA-xxx9-3xcr-gjj3
Title: XML Injection in Xerces Java affects Nokogiri
Solution: upgrade to >= 1.13.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2021-30560
Criticality: High
URL: GHSA-fq42-c5rg-92c2
Title: Update packaged libxml2 (2.9.12 → 2.9.13) and libxslt (1.1.34 → 1.1.35)
Solution: upgrade to >= 1.13.2

Name: nokogiri
Version: 1.8.1
Advisory: GHSA-7rrm-v45f-jp64
Criticality: High
URL: GHSA-7rrm-v45f-jp64
Title: Update packaged dependency libxml2 from 2.9.10 to 2.9.12
Solution: upgrade to >= 1.11.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2018-25032
Criticality: High
URL: GHSA-v6gp-9mmm-c6p5
Title: Out-of-bounds Write in zlib affects Nokogiri
Solution: upgrade to >= 1.13.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2018-8048
Criticality: Unknown
URL: sparklemotion/nokogiri#1746
Title: Revert libxml2 behavior in Nokogiri gem that could cause XSS
Solution: upgrade to >= 1.8.3

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2020-7595
Criticality: High
URL: sparklemotion/nokogiri#1992
Title: libxml2 2.9.10 has an infinite loop in a certain end-of-file situation
Solution: upgrade to >= 1.10.8

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2019-13117
Criticality: Unknown
URL: sparklemotion/nokogiri#1943
Title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities
Solution: upgrade to >= 1.10.5

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2022-24836
Criticality: High
URL: GHSA-crjr-9rc5-ghw8
Title: Inefficient Regular Expression Complexity in Nokogiri
Solution: upgrade to >= 1.13.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2020-26247
Criticality: Low
URL: GHSA-vr8q-g5c7-m54m
Title: Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability
Solution: upgrade to >= 1.11.0.rc4

Name: puma
Version: 4.3.3
Advisory: CVE-2021-29509
Criticality: High
URL: GHSA-q28m-8xjw-8vr5
Title: Keepalive Connections Causing Denial Of Service in puma
Solution: upgrade to ~> 4.3.8, >= 5.3.1

Name: puma
Version: 4.3.3
Advisory: CVE-2022-24790
Criticality: Critical
URL: GHSA-h99w-9q5r-gjq9
Title: HTTP Request Smuggling in puma
Solution: upgrade to ~> 4.3.12, >= 5.6.4

Name: puma
Version: 4.3.3
Advisory: CVE-2020-11076
Criticality: High
URL: GHSA-x7jg-6pwg-fx5h
Title: HTTP Smuggling via Transfer-Encoding Header in Puma
Solution: upgrade to ~> 3.12.5, >= 4.3.4

Name: puma
Version: 4.3.3
Advisory: CVE-2020-11077
Criticality: Medium
URL: GHSA-w64w-qqph-5gxm
Title: HTTP Smuggling via Transfer-Encoding Header in Puma
Solution: upgrade to ~> 3.12.6, >= 4.3.5

Name: puma
Version: 4.3.3
Advisory: CVE-2022-23634
Criticality: High
URL: GHSA-rmj8-8hhh-gv5h
Title: Information Exposure with Puma when used with Rails
Solution: upgrade to ~> 4.3.11, >= 5.6.2

Name: puma
Version: 4.3.3
Advisory: CVE-2021-41136
Criticality: Low
URL: GHSA-48w2-rm65-62xx
Title: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma
Solution: upgrade to ~> 4.3.9, >= 5.5.1

Name: rack
Version: 2.2.2
Advisory: CVE-2020-8184
Criticality: Unknown
URL: https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak
Title: Percent-encoded cookies can be used to overwrite existing prefixed cookie names
Solution: upgrade to ~> 2.1.4, >= 2.2.3

Name: rails-html-sanitizer
Version: 1.0.3
Advisory: CVE-2018-3741
Criticality: Unknown
URL: https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ
Title: XSS vulnerability in rails-html-sanitizer
Solution: upgrade to >= 1.0.4

Name: rails_admin
Version: 1.2.0
Advisory: CVE-2020-36190
Criticality: Medium
URL: railsadminteam/rails_admin@d72090e
Title: rails_admin ruby gem XSS vulnerability
Solution: upgrade to ~> 1.4.3, >= 2.0.2

Name: rails_admin
Version: 1.2.0
Advisory: CVE-2017-12098
Criticality: Medium
URL: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0450
Title: rails_admin ruby gem XSS vulnerability
Solution: upgrade to >= 1.3.0

Name: rake
Version: 12.3.0
Advisory: CVE-2020-8130
Criticality: High
URL: GHSA-jppv-gw3r-w3q8
Title: OS Command Injection in Rake
Solution: upgrade to >= 12.3.3

Name: redcarpet
Version: 3.4.0
Advisory: CVE-2020-26298
Criticality: Medium
URL: vmg/redcarpet@a699c82
Title: Injection/XSS in Redcarpet
Solution: upgrade to >= 3.5.1

Name: websocket-extensions
Version: 0.1.3
Advisory: CVE-2020-7663
Criticality: High
URL: GHSA-g6wq-qcwm-j5g2
Title: Regular Expression Denial of Service in websocket-extensions (RubyGem)
Solution: upgrade to >= 0.1.5
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
topic/security vendored/libxslt
Projects
None yet
Milestone
v1.10.x patch releases
Development

No branches or pull requests
2 participants
@flavorjones @nporteschaikin