diff --git a/advisories/github-reviewed/2019/09/GHSA-8jhx-9gf4-hhf5/GHSA-8jhx-9gf4-hhf5.json b/advisories/github-reviewed/2019/09/GHSA-8jhx-9gf4-hhf5/GHSA-8jhx-9gf4-hhf5.json index cdc721d9c8a..6685dc80cba 100644 --- a/advisories/github-reviewed/2019/09/GHSA-8jhx-9gf4-hhf5/GHSA-8jhx-9gf4-hhf5.json +++ b/advisories/github-reviewed/2019/09/GHSA-8jhx-9gf4-hhf5/GHSA-8jhx-9gf4-hhf5.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-8jhx-9gf4-hhf5", - "modified": "2023-01-25T22:47:06Z", + "modified": "2023-08-29T11:51:45Z", "published": "2019-09-27T20:01:00Z", "aliases": [ "CVE-2019-16377" ], - "summary": "Improper Access Control in consul", - "details": "The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.", + "summary": "Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly", + "details": "With the consul ruby gem before 1.0.3, if a controller checks multiple powers using `:if` or `:except` conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions.", "severity": [ { "type": "CVSS_V3", @@ -20,6 +20,11 @@ "ecosystem": "RubyGems", "name": "consul" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", @@ -52,6 +57,10 @@ "type": "WEB", "url": "https://github.com/rubysec/ruby-advisory-db/blob/c26fbc13435b8be448ad59131428538049d165e4/gems/consul/CVE-2019-16377.yml" }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/consul/CVE-2019-16377.yml" + }, { "type": "WEB", "url": "https://rubygems.org/gems/consul"