MAL-2023-1429 Malicious code in modified_bayes (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1c5711b3c10ba19ca7c68581b9cd246029ba621b35c0371e4a043d69050b9363 The OpenSSF Package Analysis project identified 'modifiedbayes' @ 10.1.0 rubygems as malicious. It is considered malicious because: - The packag...

Malicious code in modified_bayes (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1c5711b3c10ba19ca7c68581b9cd246029ba621b35c0371e4a043d69050b9363 The OpenSSF Package Analysis project identified 'modifiedbayes' @ 10.1.0 rubygems as malicious. It is considered malicious because: - The packag...

MAL-2023-11 Malicious code in microsoft_kiota_http (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1aea1a60f074d92d58e8e1644f08af16097bc4fc496a7acc2b60f586ce504017 The OpenSSF Package Analysis project identified 'microsoftkiotahttp' @ 6.0.1 rubygems as malicious. It is considered malicious because: - The...

MAL-2023-12 Malicious code in tzinfo-i18n (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 80d76ff3efd3a37e90d86c31f34ad01633504eb17709869928335523c66a2a55 The OpenSSF Package Analysis project identified 'tzinfo-i18n' @ 0.1.0 rubygems as malicious. It is considered malicious because: - The package...

MAL-2023-1424 Malicious code in fluent-plugin-enhance-k8s-metadata (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 537d9d482d3e99b2757022edbff8c81e9a9bd9bf73f272f10634d355c813e635 The OpenSSF Package Analysis project identified 'fluent-plugin-enhance-k8s-metadata' @ 5.0.1 rubygems as malicious. It is considered malicious...

CVE-2023-28846

Unpoly is a JavaScript framework for server-side web applications. There is a possible Denial of Service DoS vulnerability in the unpoly-rails gem that implements the Unpoly server protocol for Rails applications. This issues affects Rails applications that operate as an upstream of a load...

Design/Logic Flaw

Unpoly is a JavaScript framework for server-side web applications. There is a possible Denial of Service DoS vulnerability in the unpoly-rails gem that implements the Unpoly server protocol for Rails applications. This issues affects Rails applications that operate as an upstream of a load...

CVE-2023-28846 Denial of Service in unpoly-rails

Unpoly is a JavaScript framework for server-side web applications. There is a possible Denial of Service DoS vulnerability in the unpoly-rails gem that implements the Unpoly server protocol for Rails applications. This issues affects Rails applications that operate as an upstream of a load...

CVE-2023-28102

discordrb is an implementation of the Discord API using Ruby. In discordrb before commit 91e13043ffa the encoder.rb file unsafely constructs a shell string using the file parameter, which can potentially leave clients of discordrb vulnerable to command injection. The library is not directly...

pcs security update

0.11.3-4.el91.2 - Updated bundled rubygems: mustermann, rack, rackprotection, sinatra, tilt - Added license for rubygem ruby2keywords - Resolves: rhbz2159426...

pcs security update

0.10.14-5.0.1 - Replace HAM-logo.png with a generic one 0.10.14-5.el87.2 - Updated bundled rubygems: mustermann, rack, rackprotection, sinatra, tilt - Added license for rubygem ruby2keywords - Resolves: rhbz2159424...

K30272432: RubyGems vulnerability CVE-2021-41817

Security Advisory Description Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS regular expression Denial of Service via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1. CVE-2021-41817 Impact There is no impact; F5 products are not affected by this vulnerability...

K81674333: Ruby vulnerabilities CVE-2019-8322 CVE-2019-8323 CVE-2019-8324 CVE-2019-8325

Security Advisory Description CVE-2019-8322 An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur. CVE-2019-8323 An issue was...

K91125274: RubyGems vulnerability CVE-2017-0903

Security Advisory Description RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code...

K84262603: Multiple Ruby vulnerabilities

Security Advisory Description CVE-2018-1000073 RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in...

K01730454: Ruby vulnerabilities CVE-2017-0899, CVE-2017-0900, CVE-2017-0901, and CVE-2017-0902

Security Advisory Description CVE-2017-0899 RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences. CVE-2017-0900 RubyGems version 2.6.12 and earlie...

K52952871: Multiple RubyGems vulnerabilities

Security Advisory Description CVE-2018-1000073 RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in...

SUSE CVE-2012-2126

RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack...

SUSE CVE-2012-2125

RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack...

SUSE CVE-2013-4363

Algorithmic complexity vulnerability in Gem::Version::ANCHOREDVERSIONPATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service CP...