netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-69p6-wvmq-27gg
GHSA-7m2w-9gw7-c3xp
This commit is contained in:
advisory-database[bot]
2023-07-03 23:14:27 +00:00
parent 0686d6a165
commit ed9a00ee1e
2 changed files with 13 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/04/GHSA-69p6-wvmq-27gg/GHSA-69p6-wvmq-27gg.json
+6 -6
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-69p6-wvmq-27gg",
"modified": "2022-04-28T21:13:22Z",
"modified": "2023-07-03T23:11:16Z",
"published": "2022-04-20T00:00:33Z",
"aliases": [
"CVE-2022-25648"
],
"summary": "Command injection in ruby-git",
"details": "The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.",
"details": "The package prior to v1.11.0 is vulnerable to Command Injection via git argument injection. When calling the `fetch(remote = 'origin', opts = {})` function, the remote parameter is passed to the `git fetch` subcommand in a way such that additional flags can be set. The additional flags can be used to perform a command injection.",
"severity": [
{
"type": "CVSS_V3",
@@ -45,12 +45,12 @@
"url": "https://github.com/ruby-git/ruby-git/pull/569"
},
{
"type": "PACKAGE",
"url": "https://github.com/ruby-git/ruby-git"
"type": "WEB",
"url": "https://github.com/ruby-git/ruby-git/commit/291ca0946bec7164b90ad5c572ac147f512c7159"
},
{
"type": "WEB",
"url": "https://github.com/ruby-git/ruby-git/releases/tag/v1.11.0"
"type": "PACKAGE",
"url": "https://github.com/ruby-git/ruby-git"
},
{
"type": "WEB",
advisories/github-reviewed/2022/05/GHSA-7m2w-9gw7-c3xp/GHSA-7m2w-9gw7-c3xp.json
+7 -11
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7m2w-9gw7-c3xp",
"modified": "2023-06-09T23:05:43Z",
"modified": "2023-07-03T23:13:40Z",
"published": "2022-05-13T01:13:48Z",
"aliases": [
"CVE-2015-3649"
],
"summary": "open-uri-cached Gem for Ruby Unsafe Temporary File Creation Local Privilege Escalation",
"details": "The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing \"openuri-\" followed by a crafted UID, and putting Ruby code in said directory once a meta file is created.",
"summary": "open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution",
"details": "The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing \"openuri-\" followed by a crafted UID, and putting Ruby code in said directory once a metafile is created.",
"severity": [
{
"type": "CVSS_V3",
@@ -49,16 +49,16 @@
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/open-uri-cached/CVE-2015-3649.yml"
},
{
"type": "WEB",
"url": "https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb#L115"
"type": "PACKAGE",
"url": "https://github.com/tigris/open-uri-cached"
},
{
"type": "WEB",
"url": "https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb#L25"
"url": "https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb"
},
{
"type": "WEB",
"url": "https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb#L39"
"url": "https://web.archive.org/web/20210119122105/http://www.securityfocus.com/bid/74469"
},
{
"type": "WEB",
@@ -71,10 +71,6 @@
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/05/06/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/74469"
}
],
"database_specific": {