Publish GHSA-8jhx-9gf4-hhf5

advisories/github-reviewed/2019/09/GHSA-8jhx-9gf4-hhf5/GHSA-8jhx-9gf4-hhf5.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8jhx-9gf4-hhf5",
-  "modified": "2023-01-25T22:47:06Z",
+  "modified": "2023-08-29T11:51:45Z",
   "published": "2019-09-27T20:01:00Z",
   "aliases": [
     "CVE-2019-16377"
   ],
-  "summary": "Improper Access Control in consul",
-  "details": "The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.",
+  "summary": "Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly",
+  "details": "With the consul ruby gem before 1.0.3, if a controller checks multiple powers  using `:if` or `:except` conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -20,6 +20,11 @@
         "ecosystem": "RubyGems",
         "name": "consul"
       },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
       "ranges": [
         {
           "type": "ECOSYSTEM",
@@ -52,6 +57,10 @@
       "type": "WEB",
       "url": "https://github.com/rubysec/ruby-advisory-db/blob/c26fbc13435b8be448ad59131428538049d165e4/gems/consul/CVE-2019-16377.yml"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/consul/CVE-2019-16377.yml"
+    },
     {
       "type": "WEB",
       "url": "https://rubygems.org/gems/consul"