diff --git a/advisories/github-reviewed/2022/04/GHSA-69p6-wvmq-27gg/GHSA-69p6-wvmq-27gg.json b/advisories/github-reviewed/2022/04/GHSA-69p6-wvmq-27gg/GHSA-69p6-wvmq-27gg.json index 07d28ee0a57..d62b3158045 100644 --- a/advisories/github-reviewed/2022/04/GHSA-69p6-wvmq-27gg/GHSA-69p6-wvmq-27gg.json +++ b/advisories/github-reviewed/2022/04/GHSA-69p6-wvmq-27gg/GHSA-69p6-wvmq-27gg.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-69p6-wvmq-27gg", - "modified": "2022-04-28T21:13:22Z", + "modified": "2023-07-03T23:11:16Z", "published": "2022-04-20T00:00:33Z", "aliases": [ "CVE-2022-25648" ], "summary": "Command injection in ruby-git", - "details": "The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.", + "details": "The package prior to v1.11.0 is vulnerable to Command Injection via git argument injection. When calling the `fetch(remote = 'origin', opts = {})` function, the remote parameter is passed to the `git fetch` subcommand in a way such that additional flags can be set. The additional flags can be used to perform a command injection.", "severity": [ { "type": "CVSS_V3", @@ -45,12 +45,12 @@ "url": "https://github.com/ruby-git/ruby-git/pull/569" }, { - "type": "PACKAGE", - "url": "https://github.com/ruby-git/ruby-git" + "type": "WEB", + "url": "https://github.com/ruby-git/ruby-git/commit/291ca0946bec7164b90ad5c572ac147f512c7159" }, { - "type": "WEB", - "url": "https://github.com/ruby-git/ruby-git/releases/tag/v1.11.0" + "type": "PACKAGE", + "url": "https://github.com/ruby-git/ruby-git" }, { "type": "WEB", diff --git a/advisories/github-reviewed/2022/05/GHSA-7m2w-9gw7-c3xp/GHSA-7m2w-9gw7-c3xp.json b/advisories/github-reviewed/2022/05/GHSA-7m2w-9gw7-c3xp/GHSA-7m2w-9gw7-c3xp.json index 73661736547..9b79f1d1f87 100644 --- a/advisories/github-reviewed/2022/05/GHSA-7m2w-9gw7-c3xp/GHSA-7m2w-9gw7-c3xp.json +++ b/advisories/github-reviewed/2022/05/GHSA-7m2w-9gw7-c3xp/GHSA-7m2w-9gw7-c3xp.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-7m2w-9gw7-c3xp", - "modified": "2023-06-09T23:05:43Z", + "modified": "2023-07-03T23:13:40Z", "published": "2022-05-13T01:13:48Z", "aliases": [ "CVE-2015-3649" ], - "summary": "open-uri-cached Gem for Ruby Unsafe Temporary File Creation Local Privilege Escalation", - "details": "The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing \"openuri-\" followed by a crafted UID, and putting Ruby code in said directory once a meta file is created.", + "summary": "open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution", + "details": "The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing \"openuri-\" followed by a crafted UID, and putting Ruby code in said directory once a metafile is created.", "severity": [ { "type": "CVSS_V3", @@ -49,16 +49,16 @@ "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/open-uri-cached/CVE-2015-3649.yml" }, { - "type": "WEB", - "url": "https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb#L115" + "type": "PACKAGE", + "url": "https://github.com/tigris/open-uri-cached" }, { "type": "WEB", - "url": "https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb#L25" + "url": "https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb" }, { "type": "WEB", - "url": "https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb#L39" + "url": "https://web.archive.org/web/20210119122105/http://www.securityfocus.com/bid/74469" }, { "type": "WEB", @@ -71,10 +71,6 @@ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2015/05/06/2" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/74469" } ], "database_specific": {