Skip to content

Commit c3f65e5

Browse files
maxjacobsonmaxjacobson
authored
Update database (#43)
Pulls in: rubysec/ruby-advisory-db@599408b...6b88736 I may have done something kind of gnarly to make this have a clean diff ``` issues = analyze_directory(directory).map { |h| f= Hash[h.sort] f["location"] = Hash[f["location"].sort] f } File.open("./tmp", "w") { |f| f.puts JSON.pretty_generate(issues, indent: " ") } ```
1 parent e8e4693 commit c3f65e5

File tree

2 files changed

+79
-16
lines changed

2 files changed

+79
-16
lines changed

‎DATABASE_VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
Wed Feb 8 16:07:01 EST 2017
1+
Fri Feb 24 11:39:21 EST 2017

‎spec/fixtures/unpatched_versions/issues.json

Lines changed: 78 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
],
66
"check_name": "Insecure Dependency",
77
"content": {
8-
"body": "**Advisory**: CVE-2015-7581\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/dthJ5wL69JE\n\n**Solution**: upgrade to >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14"
8+
"body": "**Advisory**: CVE-2016-0751\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc\n\n**Solution**: upgrade to >= 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1"
99
},
10-
"description": "Object leak vulnerability for wildcard controller routes in Action Pack",
11-
"fingerprint": "06ae795b91e09069846af543d755b9e1",
10+
"description": "Possible Object Leak and Denial of Service attack in Action Pack",
11+
"fingerprint": "fb0889d061f06c4203ed27b43aca68b2",
1212
"location": {
1313
"lines": {
1414
"begin": 18,
@@ -26,10 +26,10 @@
2626
],
2727
"check_name": "Insecure Dependency",
2828
"content": {
29-
"body": "**Advisory**: CVE-2015-7576\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/ANv0HDHEC3k\n\n**Solution**: upgrade to ~> 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1"
29+
"body": "**Advisory**: CVE-2016-2098\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q\n\n**Solution**: upgrade to ~> 3.2.22.2, >= 4.2.5.2, ~> 4.2.5, >= 4.1.14.2, ~> 4.1.14"
3030
},
31-
"description": "Timing attack vulnerability in basic authentication in Action Controller.",
32-
"fingerprint": "98b8ca0112bff7bf79c1a85a829cf948",
31+
"description": "Possible remote code execution vulnerability in Action Pack",
32+
"fingerprint": "464176078b0d3514fdf527afe2f93315",
3333
"location": {
3434
"lines": {
3535
"begin": 18,
@@ -47,10 +47,10 @@
4747
],
4848
"check_name": "Insecure Dependency",
4949
"content": {
50-
"body": "**Advisory**: CVE-2016-2098\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q\n\n**Solution**: upgrade to ~> 3.2.22.2, >= 4.2.5.2, ~> 4.2.5, >= 4.1.14.2, ~> 4.1.14"
50+
"body": "**Advisory**: CVE-2015-7576\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/ANv0HDHEC3k\n\n**Solution**: upgrade to >= 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1"
5151
},
52-
"description": "Possible remote code execution vulnerability in Action Pack",
53-
"fingerprint": "464176078b0d3514fdf527afe2f93315",
52+
"description": "Timing attack vulnerability in basic authentication in Action Controller.",
53+
"fingerprint": "98b8ca0112bff7bf79c1a85a829cf948",
5454
"location": {
5555
"lines": {
5656
"begin": 18,
@@ -68,10 +68,10 @@
6868
],
6969
"check_name": "Insecure Dependency",
7070
"content": {
71-
"body": "**Advisory**: CVE-2016-0751\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc\n\n**Solution**: upgrade to ~> 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1"
71+
"body": "**Advisory**: CVE-2015-7581\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/dthJ5wL69JE\n\n**Solution**: upgrade to >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14"
7272
},
73-
"description": "Possible Object Leak and Denial of Service attack in Action Pack",
74-
"fingerprint": "fb0889d061f06c4203ed27b43aca68b2",
73+
"description": "Object leak vulnerability for wildcard controller routes in Action Pack",
74+
"fingerprint": "06ae795b91e09069846af543d755b9e1",
7575
"location": {
7676
"lines": {
7777
"begin": 18,
@@ -89,7 +89,28 @@
8989
],
9090
"check_name": "Insecure Dependency",
9191
"content": {
92-
"body": "**Advisory**: CVE-2016-0752\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00\n\n**Solution**: upgrade to ~> 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14"
92+
"body": "**Advisory**: CVE-2016-6316\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk\n\n**Solution**: upgrade to ~> 4.2.7.1, ~> 4.2.8, >= 5.0.0.1"
93+
},
94+
"description": "Possible XSS Vulnerability in Action View",
95+
"fingerprint": "f49fdfa41c42d6b18c17913156307c51",
96+
"location": {
97+
"lines": {
98+
"begin": 25,
99+
"end": 25
100+
},
101+
"path": "Gemfile.lock"
102+
},
103+
"remediation_points": 500000,
104+
"severity": "normal",
105+
"type": "Issue"
106+
},
107+
{
108+
"categories": [
109+
"Security"
110+
],
111+
"check_name": "Insecure Dependency",
112+
"content": {
113+
"body": "**Advisory**: CVE-2016-0752\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00\n\n**Solution**: upgrade to >= 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14"
93114
},
94115
"description": "Possible Information Leak Vulnerability in Action View",
95116
"fingerprint": "f26c202060c497fd32f90c538c543445",
@@ -110,7 +131,7 @@
110131
],
111132
"check_name": "Insecure Dependency",
112133
"content": {
113-
"body": "**Advisory**: CVE-2016-0753\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/6jQVC1geukQ\n\n**Solution**: upgrade to ~> 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14"
134+
"body": "**Advisory**: CVE-2016-0753\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/6jQVC1geukQ\n\n**Solution**: upgrade to >= 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14"
114135
},
115136
"description": "Possible Input Validation Circumvention in Active Model",
116137
"fingerprint": "723fd12f6da25240ffbf2f3312b8e33d",
@@ -131,7 +152,7 @@
131152
],
132153
"check_name": "Insecure Dependency",
133154
"content": {
134-
"body": "**Advisory**: CVE-2015-7577\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/cawsWcQ6c8g\n\n**Solution**: upgrade to ~> 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1"
155+
"body": "**Advisory**: CVE-2015-7577\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/cawsWcQ6c8g\n\n**Solution**: upgrade to >= 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1"
135156
},
136157
"description": "Nested attributes rejection proc bypass in Active Record",
137158
"fingerprint": "2441a69a4af613e9235af4024ff21b30",
@@ -146,6 +167,27 @@
146167
"severity": "normal",
147168
"type": "Issue"
148169
},
170+
{
171+
"categories": [
172+
"Security"
173+
],
174+
"check_name": "Insecure Dependency",
175+
"content": {
176+
"body": "**Advisory**: CVE-2016-6317\n\n**URL**: https://groups.google.com/forum/#!topic/rubyonrails-security/rgO20zYW33s\n\n**Solution**: upgrade to >= 4.2.7.1"
177+
},
178+
"description": "Unsafe Query Generation Risk in Active Record",
179+
"fingerprint": "1e32b91522fc8bdf4def84929a11d4b6",
180+
"location": {
181+
"lines": {
182+
"begin": 37,
183+
"end": 37
184+
},
185+
"path": "Gemfile.lock"
186+
},
187+
"remediation_points": 500000,
188+
"severity": "normal",
189+
"type": "Issue"
190+
},
149191
{
150192
"categories": [
151193
"Security"
@@ -188,6 +230,27 @@
188230
"severity": "normal",
189231
"type": "Issue"
190232
},
233+
{
234+
"categories": [
235+
"Security"
236+
],
237+
"check_name": "Insecure Dependency",
238+
"content": {
239+
"body": "**Advisory**: CVE-2015-8806\n\n**URL**: https://github.com/sparklemotion/nokogiri/issues/1473\n\n**Solution**: upgrade to >= 1.6.8"
240+
},
241+
"description": "Denial of service or RCE from libxml2 and libxslt",
242+
"fingerprint": "2675b3a139ad320ff6843f7dc5b9937e",
243+
"location": {
244+
"lines": {
245+
"begin": 74,
246+
"end": 74
247+
},
248+
"path": "Gemfile.lock"
249+
},
250+
"remediation_points": 500000,
251+
"severity": "normal",
252+
"type": "Issue"
253+
},
191254
{
192255
"categories": [
193256
"Security"

0 commit comments

Comments
 (0)