Updating advisories with osvdb.org in "url:" field

[jasnow]

Updating advisories with osvdb.org in "url:" field

• Updated "url:" field with non-osvdb reference since osvdb.org is no longer available.
• Added "ghsa:" field value for advisories with "cve:" values.
• Added "related:" references as evidence for further work (for advisories with "cve": values, usually only 4 refs; check NVD reference for full list).
• Changed quotes to or adding double-quotes as needed.
• Added "notes:" as needed to be more explicit.
• Line wrapped text fields as needed.
• Merged one duplicate OSVDB-78119 advisory into CVE-2012-5372 advisory.

Special Notes

• No new files/advisories in this PR.
• Will delete rubies/rbx/OSVDB-78119.yml file in separate PR.

Checks

• internal "morechks" script (all clean)
• yamlint (green)
• rake (green)

[postmodern]

The primary url: should ideally point to a web page with the advisory information, that explains the impact. how to upgrade, etc. It's probably not very user-friendly to link to raw GitHub code or commit diffs. If no other suitable URL exists for the advisory, perhaps we could link to the https://rubysec.com page for the advisory?

[jasnow]

The primary url: should ideally point to a web page with the advisory information, that explains the impact. how to upgrade, etc. It's probably not very user-friendly to link to raw GitHub code or commit diffs. If no other suitable URL exists for the advisory, perhaps we could link to the https://rubysec.com page for the advisory?

I agree that sometimes is was hard to find the right one for the main "url:" field. My approach was to pick the public announcement of the vulnerability by the project if possible or proof that the vulnerability was real. I will review your feedback and try to improve my selection.

[jasnow]

Found 2 more files needing similar changes.

[postmodern]

LGTM

[jasnow]

Thanks