Added CVE-2013-4457

Roadmap.md

@@ -100,6 +100,7 @@ able to scan something. It deserves a special release.
 ## Version 0.80
 
 * adding test for CVE-2013-4164
+* adding test for CVE-2013-4457
 * adding test for CVE-2013-4562
 
 * detect sinks for XSS in Padrino applications

lib/codesake/dawn/kb/cve_2013_4457.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-11-26
+			class CVE_2013_4457
+				include DependencyCheck
+
+				def initialize
+          message="The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation."
+          super({
+            :name=>"CVE-2013-4457",
+            :cvss=>"not assigned",
+            :release_date => Date.new(2013, 10, 22),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"You must upgrade to cocain gem version 0.5.3 or later",
+            :aux_links=>["https://groups.google.com/forum/#!topic/ruby-security-ann/3XTGFbAJoTg"]
+          })
+
+          self.safe_dependencies = [{:name=>"cocaine", :version=>['0.5.3', '0.4.9999']}]
+
+
+				end
+			end
+		end
+	end
+end

lib/codesake/dawn/knowledge_base.rb

@@ -81,6 +81,7 @@
 require "codesake/dawn/kb/cve_2013_3221"
 require "codesake/dawn/kb/cve_2013_4164"
 require "codesake/dawn/kb/cve_2013_4389"
+require "codesake/dawn/kb/cve_2013_4457"
 require "codesake/dawn/kb/cve_2013_4562"
 
 
@@ -211,7 +212,9 @@ def self.load_security_checks
           Codesake::Dawn::Kb::CVE_2013_3221.new, 
           Codesake::Dawn::Kb::CVE_2013_4164.new, 
           Codesake::Dawn::Kb::CVE_2013_4389.new, 
+          Codesake::Dawn::Kb::CVE_2013_4457.new,
           Codesake::Dawn::Kb::CVE_2013_4562.new, 
+
         ]
       end
     end

spec/lib/dawn/codesake_knowledgebase_spec.rb

@@ -382,4 +382,9 @@
     sc.should_not   be_nil
     sc.class.should == Codesake::Dawn::Kb::CVE_2013_4562
   end
+  it "must have test for CVE-2013-4457" do
+    sc = kb.find("CVE-2013-4457")
+    sc.should_not   be_nil
+    sc.class.should == Codesake::Dawn::Kb::CVE_2013_4457
+  end
 end