From 040cad541bc72dbd670a2d9f2d3a8bf5bc94de04 Mon Sep 17 00:00:00 2001 From: Darren Cheng Date: Mon, 3 Sep 2018 20:16:11 -0700 Subject: [PATCH 1/2] Add CVE-2018-1000201 for ffi. --- gems/ffi/CVE-2018-1000201.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 gems/ffi/CVE-2018-1000201.yml diff --git a/gems/ffi/CVE-2018-1000201.yml b/gems/ffi/CVE-2018-1000201.yml new file mode 100644 index 0000000000..474efba6b3 --- /dev/null +++ b/gems/ffi/CVE-2018-1000201.yml @@ -0,0 +1,23 @@ +--- +gem: ffi +cve: 2018-1000201 +url: https://nvd.nist.gov/vuln/detail/CVE-2018-1000201 +title: ruby-ffi DDL loading issue on Windows OS +date: 2018-06-22 + +description: | + ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be + hijacked on Windows OS, when a Symbol is used as DLL name instead of a String + This vulnerability appears to have been fixed in v1.9.24 and later. + +cvss_v2: 6.8 +cvss_v3: 7.8 + +patched_versions: + - '>= 1.9.24' + +related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2018-1000201 + - https://github.com/ffi/ffi/commit/09e0c6076466b4383da7fa4e13f714311109945a + - https://github.com/ffi/ffi/commit/e0fe486df0e117ed67b0282b6ada04b7214ca05c From 79418d9556650faeed5a5d4527a23cdc1dcaec89 Mon Sep 17 00:00:00 2001 From: Reed Loden Date: Mon, 10 Sep 2018 11:32:02 -0700 Subject: [PATCH 2/2] Modify URLs --- gems/ffi/CVE-2018-1000201.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/gems/ffi/CVE-2018-1000201.yml b/gems/ffi/CVE-2018-1000201.yml index 474efba6b3..cd8826964d 100644 --- a/gems/ffi/CVE-2018-1000201.yml +++ b/gems/ffi/CVE-2018-1000201.yml @@ -1,7 +1,7 @@ --- gem: ffi cve: 2018-1000201 -url: https://nvd.nist.gov/vuln/detail/CVE-2018-1000201 +url: https://github.com/ffi/ffi/releases/tag/1.9.24 title: ruby-ffi DDL loading issue on Windows OS date: 2018-06-22 @@ -14,10 +14,9 @@ cvss_v2: 6.8 cvss_v3: 7.8 patched_versions: - - '>= 1.9.24' + - ">= 1.9.24" related: url: - - https://nvd.nist.gov/vuln/detail/CVE-2018-1000201 - https://github.com/ffi/ffi/commit/09e0c6076466b4383da7fa4e13f714311109945a - https://github.com/ffi/ffi/commit/e0fe486df0e117ed67b0282b6ada04b7214ca05c