Threats Tagged 'rubygems'

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.

In Rails versions prior to 7.2.3.2, 8.0.5.1, and 8.1.3.1, Active Storage does not disable unsafe libvips operations for untrusted content. This allows crafted image uploads to invoke unsafe operations. Applications using libvips and accepting uploads from untrusted users are vulnerable. An unauthenticated attacker can read arbitrary files accessible to the Rails process, including environment variables and secrets. Exposure of credentials like secret_key_base may lead to remote code execution or lateral movement. The issue is fixed in versions 7.2.3.2, 8.0.5.1, and 8.1.3.1.

Active Record Tenanted versions prior to 0.7.0 contain a vulnerability in the override of Active Storage's DiskService#path_for method. This vulnerability allows path traversal by not validating that the resolved filesystem path remains within the storage root directory. If an attacker can supply a blob key with path traversal sequences, they could potentially read, write, or delete arbitrary files on the server. The issue arises when untrusted user input is used as blob keys, which are expected to be trusted strings. The vulnerability has a low severity rating and no known exploits in the wild. Upgrading to version 0.7.0 or later mitigates the issue.

Loofah's HTML5 sanitizer did not restrict the SVG plain href attribute on certain elements, allowing references to arbitrary external documents. This bypasses the intended local-reference restriction applied only to the deprecated xlink:href attribute. The vulnerability affects applications sanitizing user-supplied SVG with Loofah versions prior to 2.25.2. Exploitation could lead to loading and rendering external SVG content with potential script execution in the context of the sanitized document or tracking via external images. Modern browsers limit cross-origin fetches, reducing but not eliminating risk. Upgrading to Loofah 2.25.2 or later mitigates this issue.

Loofah's allowed_uri? method fails to detect javascript: or vbscript: URIs when the scheme is split by numeric character references without trailing semicolons. Browsers decode these references and execute the URI, but allowed_uri? incorrectly marks them as safe. This affects callers that validate user-controlled URLs with allowed_uri? and then render them into browser-interpreted URI attributes, potentially enabling cross-site scripting (XSS). The default sanitize() method is not affected. The issue is fixed in Loofah version 2.25.2.

A possible cross-site scripting (XSS) vulnerability exists in rails-html-sanitizer versions 1.0.3 through before 1.7.1 when configured to allow certain SVG reference elements such as <use> or <feImage>. The vulnerability arises because the sanitizer restricts local references only on the xlink:href attribute but not on the plain href attribute, which browsers accept per the SVG 2 specification. This can allow external SVG content or images to be loaded and potentially execute scripts in the context of the sanitized document. Applications using the default sanitizer configuration are not affected because these SVG elements are not allowed by default.

### Impact If this library is used to implement a WebSocket server on top of a TCP server, by using the `WebSocket::Driver.server()` method, then a client can cause the server to crash by sending a `Host` header that is not a valid `host[:port]` string. When this happens, a `URI::InvalidURIError` exception is raised which is not caught, and this can cause the server process to crash if the application does not catch the error from the `parse()` method itself. ### Patches The issue has been patched in version 0.8.2 by making the request parser catch `URI::InvalidURIError` and enter an error state if the `Host` header is malformed. This means the request is considered invalid and should not establish a WebSocket connection. ### Workarounds No known workarounds exist. ### Acknowledgements This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

decidim-meetings versions 0.28.0 up to but not including 0.28.3 contain a cross-site scripting (XSS) vulnerability in the meeting embeds feature used for online or hybrid meetings. This vulnerability can be triggered through a malformed URL, potentially allowing an attacker to execute malicious scripts in the context of the affected application. No official patch is currently available. A recommended workaround is to disable the creation of meetings by participants in the meeting component to mitigate the risk.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (e9fd46792b36c0206d194f0c8176d2f8354804f23a7ac3d07f2399f4ed5d4d57) ## Source: ossf-package-analysis (004ba0a87bf93fad7e23fc134ea62c1fad90d2917fff3ad6ca64a87adf16f69d) The OpenSSF Package Analysis project identified 'att-codekit' @ 5.1.0 (rubygems) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. --- Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/att-codekit/MAL-2023-1423.json)) ## Source: ossf-package-analysis (004ba0a87bf93fad7e23fc134ea62c1fad90d2917fff3ad6ca64a87adf16f69d) The OpenSSF Package Analysis project identified 'att-codekit' @ 5.1.0 (rubygems) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.