Merge pull request #1166 from jasnow/add-cve-ghsa-urls

Added GHSA and NVD.NIST.GOV URLs to 13 existing advisories; Added to ignore file

@simi - thanks for reviewing/approving my PR.

Author: jasnow

gems/addressable/CVE-2021-32740.yml

@@ -18,3 +18,7 @@ unaffected_versions:
   - "< 2.3.0"
 patched_versions:
   - ">= 2.8.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-32740
+    - https://github.com/sporkmonger/addressable/security/advisories/GHSA-jxhc-q857-3j6g

gems/devise-two-factor/CVE-2021-43177.yml

@@ -24,4 +24,6 @@ related:
   cve:
     - 2015-7225
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-43177
     - https://github.com/tinfoil/devise-two-factor/issues/106
+    - https://github.com/devise-two-factor/devise-two-factor/security/advisories/GHSA-jm35-h8q2-73mp

gems/doorkeeper/CVE-2023-34246.yml

@@ -32,4 +32,5 @@ related:
     - https://github.com/doorkeeper-gem/doorkeeper/pull/1646
     - https://github.com/doorkeeper-gem/doorkeeper/issues/1589
     - https://www.rfc-editor.org/rfc/rfc8252#section-8.6
+    - https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-789w
     - https://github.com/advisories/GHSA-7w2c-w47h-789w

gems/jquery-rails/CVE-2020-11023.yml

@@ -23,4 +23,6 @@ patched_versions:
   - ">= 4.4.0"
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-11023
     - https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440
+    - https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6

gems/phlex/CVE-2024-28199.yml

@@ -82,4 +82,5 @@ related:
     - https://github.com/phlex-ruby/phlex/commit/aa50c604cdee1d0ce7ef068a4c66cbd5d43f96a1
     - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
     - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
+    - https://github.com/yippee-fun/phlex/security/advisories/GHSA-242p-4v39-2v8g
     - https://github.com/advisories/GHSA-242p-4v39-2v8g

gems/phlex/CVE-2024-32463.yml

@@ -52,4 +52,5 @@ related:
     - https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb
     - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
     - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
+    - https://github.com/yippee-fun/phlex/security/advisories/GHSA-g7xq-xv8c-h98c
     - https://github.com/advisories/GHSA-g7xq-xv8c-h98c

gems/phlex/CVE-2024-32970.yml

@@ -72,4 +72,5 @@ related:
     - https://github.com/payloadbox/xss-payload-list
     - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
     - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
+    - https://github.com/yippee-fun/phlex/security/advisories/GHSA-9p57-h987-4vgx
     - https://github.com/advisories/GHSA-9p57-h987-4vgx

gems/rexml/CVE-2024-41123.yml

@@ -34,4 +34,6 @@ patched_versions:
   - ">= 3.3.3"
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-41123
     - https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123
+    - https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6

gems/rexml/CVE-2024-41946.yml

@@ -34,4 +34,6 @@ patched_versions:
   - ">= 3.3.3"
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-41946
     - https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946
+    - https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4

gems/sanitize/CVE-2023-36823.yml

@@ -45,4 +45,5 @@ related:
     - https://nvd.nist.gov/vuln/detail/CVE-2023-36823
     - https://github.com/rgrove/sanitize/releases/tag/v6.0.2
     - https://github.com/rgrove/sanitize/commit/76ed46e6dc70820f38efe27de8dabd54dddb5220
+    - https://github.com/rgrove/sanitize/security/advisories/GHSA-f5ww-cq3m-q3g7
     - https://github.com/advisories/GHSA-f5ww-cq3m-q3g7