Merge pull request #1198 from jasnow/aug-6a-advs

Enhanced  7/add ghsa field/value; Deleted 1 advisory

@flavorjones - Thanks for reviewing and approving the PR.

Author: jasnow

gems/activerecord/CVE-2012-2660.yml

@@ -2,6 +2,7 @@
 gem: activerecord
 framework: rails
 cve: 2012-2660
+ghsa: hgpp-pp89-4fgf
 osvdb: 82610
 url: https://nvd.nist.gov/vuln/detail/CVE-2012-2660
 title: "CVE-2012-2660 rubygem-actionpack: Unsafe query generation"
@@ -15,6 +16,12 @@ description: |
   a related issue to CVE-2012-2694.
 cvss_v2: 7.5
 patched_versions:
+  - "~> 2.3.16"
   - "~> 3.0.13"
   - "~> 3.1.5"
   - ">= 3.2.4"
+related:
+  url:
+    - https://github.com/advisories/GHSA-hgpp-pp89-4fgf
+notes: |
+  - Added GHSA data plus 2.3.16 patch from GHSA.

gems/brakeman/CVE-2019-18409.yml

@@ -1,23 +1,31 @@
 ---
 gem: brakeman
 cve: 2019-18409
+ghsa: hhwc-8g49-j8jx
 date: 2019-10-24
-url: https://brakemanscanner.org/blog/2019/10/14/brakeman-4-dot-7-dot-1-released
+url: https://nvd.nist.gov/vuln/detail/CVE-2019-18409
 title: brakeman world writable files allow local privilege escalation
 description: |
-  The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local
-  privilege escalation because of world-writable files. For example,
-  if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used,
-  a local user can insert malicious code into the
+  If the brakeman gem (which has a legacy dependency) 4.5.0 through
+  4.7.0 is used, a local user can insert malicious code into the
   ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.
+
+  The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows
+  local privilege escalation because of world-writable files
 cvss_v2: 4.6
 cvss_v3: 7.8
 patched_versions:
   - ">= 4.7.1"
-
 unaffected_versions:
   - "<= 4.4.0"
-
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-18409
+    - https://brakemanscanner.org/blog/2019/10/14/brakeman-4-dot-7-dot-1-released
+    - https://rubygems.org/gems/brakeman
+    - https://rubygems.org/gems/ruby_parser-legacy
+    - https://github.com/zenspider/ruby_parser-legacy/releases/tag/v1.0.0
     - https://github.com/zenspider/ruby_parser-legacy/issues/1
+    - https://github.com/advisories/GHSA-hhwc-8g49-j8jx
+notes: |
+  - cvss_v3 and cvss_v2 from nvd.nist.go URL.

gems/concurrent-ruby/CVE-2026-54904.yml

@@ -51,5 +51,5 @@ related:
     - https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-h8w8-99g7-qmvj
     - https://github.com/advisories/GHSA-h8w8-99g7-qmvj
 notes: |
-  - cvss_v4 from GHSA and nvd.nist.gov URL
-  - cvss_v3 from nvd.nist.gov URL
+  - cvss_v4 from GHSA and nvd.hist.gov URLs.
+  - cvss_v3 from nvd.hist.gov URL.

gems/dragonfly/CVE-2013-1756.yml

@@ -1,8 +1,8 @@
 ---
 gem: dragonfly
 cve: 2013-1756
-osvdb: 90647
 ghsa: p463-639r-q9g9
+osvdb: 90647
 url: https://nvd.nist.gov/vuln/detail/CVE-2013-1756
 title: Dragonfly Gem for Ruby Crafted Request Parsing Remote Code Execution
 date: 2013-02-19
@@ -14,4 +14,34 @@ cvss_v2: 7.5
 unaffected_versions:
   - "< 0.7.0"
 patched_versions:
-  - ">= 0.9.13"
+  - "~> 0.8.6"
+  - ">= 0.9.15"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-1756
+    - https://rubygems.org/gems/dragonfly/versions/0.9.15
+    - https://github.com/markevans/dragonfly/releases/tag/v0.9.15
+    - https://github.com/markevans/dragonfly/compare/v0.9.14...v0.9.15
+    - https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo
+    - https://github.com/markevans/dragonfly/releases/tag/security_fix
+    - https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277
+    - https://rubygems.org/gems/dragonfly/versions/0.8.6
+    - https://github.com/markevans/dragonfly/releases/tag/v0.8.6
+    - https://github.com/markevans/dragonfly/compare/v0.8.5...v0.8.6
+    - https://github.com/markevans/dragonfly/commit/6825722c57be49b29742a37dd1acdcf9cfb097fe
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/82476
+    - https://web.archive.org/web/20200229103538/http://www.securityfocus.com/bid/58225
+    - https://github.com/advisories/GHSA-p463-639r-q9g9
+notes: |
+  - Based on History.md (their ChangeLog) file and GHSA advisory:
+    - 2013-01-30: 0.9.13 released.
+    - 2013-02-13: 0.9.14 released.
+    - 2013-02-19: "security_fix" committed.
+      - https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277
+    - 2013-02-19: Thread starts: https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo
+      - Titled "Important Security Update - Dragonfly 0.9.14 released [CVE-2013-1756]"
+        but inside they say there is still a bug associatged with patch.
+    - 2013-03-26: 0.8.6 released (Patch was backported to "0.8.6").
+    - 2013-05-04: 0.9.15 released. Found "security_fix" commit in 0.9.15.
+      - https://github.com/markevans/dragonfly/compare/v0.9.14...v0.9.15
+  - cvss_v2 from nvd.nist.gov URL.

gems/fog-dragonfly/CVE-2013-1756.yml

@@ -1,6 +1,7 @@
 ---
 gem: fog-dragonfly
 cve: 2013-1756
+ghsa: p463-639r-q9g9
 osvdb: 90647
 url: https://nvd.nist.gov/vuln/detail/CVE-2013-1756
 title: Dragonfly Gem for Ruby Crafted Request Parsing Remote Code Execution
@@ -15,4 +16,24 @@ cvss_v2: 7.5
 unaffected_versions:
   - "< 0.7.0"
 patched_versions:
+  - "~> 0.8.6"
   - ">= 0.9.14"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-1756
+    - https://rubygems.org/gems/dragonfly/versions/0.9.14
+    - https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo
+    - https://github.com/markevans/dragonfly/releases/tag/v0.9.14
+    - https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277
+    - https://github.com/markevans/dragonfly/releases/tag/security_fix
+    - https://rubygems.org/gems/dragonfly/versions/0.8.6
+    - https://github.com/markevans/dragonfly/releases/tag/v0.8.6
+    - https://github.com/markevans/dragonfly/compare/v0.8.5...v0.8.6
+    - https://rubygems.org/gems/fog-dragonfly
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/82476
+    - https://web.archive.org/web/20200229103538/http://www.securityfocus.com/bid/58225
+    - https://github.com/advisories/GHSA-p463-639r-q9g9
+notes: |
+  - See commit URL for patch note in repo's README file.
+  - Patch was backported to "0.8.6".
+  - cvss_v2 from nvd.nist.gov URL.

gems/gollum-grit_adapter/CVE-2014-9489.yml

@@ -1,7 +1,8 @@
 ---
 gem: gollum-grit_adapter
 cve: 2014-9489
-url: https://github.com/gollum/gollum/issues/913
+ghsa: q97v-764g-r2rp
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-9489
 title:
   gollum-grit_adapter Search Functionality Allows Arbitrary Command
   Execution
@@ -19,5 +20,17 @@ description: |
   Note that the grep result must find the string 'master' (or
   whatever is the default branch that gollum uses) in any of the wiki's
   documents for this to succeed.
+cvss_v2: 6.5
+cvss_v3: 8.8
 patched_versions:
   - ">= 0.1.1"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-9489
+    - https://github.com/gollum/grit_adapter/commit/4520d973c81fecfebbeacd2ef2f1849d763951c7
+    - https://github.com/gollum/gollum/issues/913
+    - http://www.openwall.com/lists/oss-security/2015/01/03/19
+    - https://web.archive.org/web/20200229041306/http://www.securityfocus.com/bid/71499
+    - https://github.com/advisories/GHSA-q97v-764g-r2rp
+notes: |
+  - cvss_v2 and cvss_v3 from nvd.nist.gov URL.

gems/rack-protection/CVE-2018-7212.yml

@@ -2,7 +2,7 @@
 gem: sinatra
 cve: 2018-7212
 ghsa: h29f-7f56-j8wh
-url: https://github.com/sinatra/sinatra/pull/1379
+url: https://nvd.nist.gov/vuln/detail/CVE-2018-7212
 title: sinatra ruby gem path traversal via backslash characters on Windows
 date: 2018-01-09
 description: |
@@ -15,3 +15,14 @@ unaffected_versions:
   - "< 2.0.0"
 patched_versions:
   - ">= 2.0.1"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-7212
+    - https://rubygems.org/gems/sinatra/versions/2.0.1
+    - https://github.com/sinatra/sinatra/pull/1379
+    - https://github.com/sinatra/sinatra/commit/6ad721abcfe36334108dcdd05d046c361e1b7a9c
+    - https://github.com/advisories/GHSA-h29f-7f56-j8wh
+notes: |
+  - cvss_v2 and cvss_v3 from nvd.nist.gov URL.
+  - "patched_versions" to "sinatra" gem verified in commit URL.
+  - "unaffected_versions" from global GHSA.