Updated advisory posts against rubysec/ruby-advisory-db@719c456

Author: jasnow

advisories/_posts/2013-09-03-CVE-2013-5671.md

@@ -18,8 +18,25 @@ advisory:
     failing to properly sanitize input passed via the imagemagickutils.rb script.
     This may allow a remote attacker to execute arbitrary commands.
 
-    This gem has been renamed. Please use "dragonfly" from now on.
+    lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2
+    for Ruby allows remote attackers to execute arbitrary commands
+    via unspecified vectors.
+
+    NOTE: This gem has been renamed. Please use "dragonfly" 1.0.0 from now on.
   cvss_v2: 7.5
   patched_versions:
   - ">= 0.8.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-5671
+    - https://rubygems.org/gems/dragonfly/versions/1.0
+    - http://seclists.org/fulldisclosure/2013/Sep/18
+    - http://seclists.org/oss-sec/2013/q3/526
+    - http://seclists.org/oss-sec/2013/q3/528
+    - http://www.vapid.dhs.org/advisories/fog-dragonfly-0.8.2-cmd-inj.html
+    - https://github.com/advisories/GHSA-qrgf-jqqm-x7xv
+  notes: |
+    - cvss_v2 from nvd.nist.gov URL.
+    - https://rubygems.org/gems/fog-dragonfly has only 0.8.1 and 0.8.2
+      releases. Now use (renamed) "dragonfly" from now on.
 ---

advisories/_posts/2019-07-31-CVE-2019-14281.md

@@ -8,14 +8,31 @@ advisory:
   gem: datagrid
   cve: 2019-14281
   ghsa: rqp5-pg7w-832p
-  url: https://github.com/rubygems/rubygems.org/issues/2072
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-14281
   date: 2019-07-31
   title: Code execution backdoor in datagrid
   description: |-
-    The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included
-    a code-execution backdoor inserted by a third party.
+    The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org,
+    included a code-execution backdoor inserted by a third party.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
   unaffected_versions:
   - "< 1.0.6"
-  - "> 1.0.6"
-  cvss_v3: 9.8
+  - "> 1.0.6, < 1.5.10"
+  patched_versions:
+  - "> 1.5.10"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-14281
+    - https://rubygems.org/gems/datagrid/versions/1.6.0
+    - https://rubygems.org/gems/datagrid/versions
+    - https://github.com/rubygems/rubygems.org/issues/2072
+    - https://github.com/advisories/GHSA-rqp5-pg7w-832p
+  notes: |
+    - cvss_v2 and cvss_v3 (also GHSA URL) from nvd.nist.gov URL.
+    - https://rubygems.org/gems/datagrid/versions/1.5.10 was yanked.
+    - https://rubygems.org/gems/datagrid/versions/1.0.6 was yanked.
+    - https://github.com/rubygems/rubygems.org/issues/2072 (please yank 1.0.6)
+    - https://rubygems.org/gems/data_grid has only 0.0.1 and 0.0.2 release.
+    - https://github.com/kkempin/data_grid has only 0.0.1.
 ---

advisories/_posts/2022-12-27-CVE-2019-25088.md

@@ -8,19 +8,35 @@ advisory:
   gem: oxidized-web
   cve: 2019-25088
   ghsa: 8qwh-rm6c-jv96
-  url: https://github.com/ytti/oxidized-web/pull/195
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-25088
   title: Oxidized Web vulnerable to Cross-site Scripting
   date: 2022-12-27
   description: |-
     A vulnerability was found in ytti Oxidized Web. It has been classified
-    as problematic. Affected is an unknown function of the file `lib/oxidized/web/views/conf_search.haml`.
-    The manipulation of the argument `to_research` leads to cross site scripting. It
-    is possible to launch the attack remotely. The name of the patch is 55ab9bdc68b03ebce9280b8746ef31d7fdedcc45.
-    It is recommended to apply a patch to fix this issue. VDB-216870 is the identifier
-    assigned to this vulnerability.
+    as problematic. Affected is an unknown function of the file
+    `lib/oxidized/web/views/conf_search.haml`.
+
+    The manipulation of the argument `to_research` leads to cross site
+    scripting. It is possible to launch the attack remotely.
+    The name of the patch is 55ab9bdc68b03ebce9280b8746ef31d7fdedcc45.
+
+    It is recommended to apply a patch to fix this issue.
+    VDB-216870 is the identifier assigned to this vulnerability.
   cvss_v3: 5.4
+  patched_versions:
+  - ">= 0.14.0"
   related:
     url:
-    - https://github.com/ytti/oxidized-web/commit/55ab9bdc68b03ebce9280b8746ef31d7fdedcc45
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-25088
+    - https://rubygems.org/gems/oxidized-web/versions/0.14.0
+    - https://github.com/ytti/oxidized-web/releases#release-0.14.0
+    - https://github.com/ytti/oxidized-web/compare/0.13.1...0.14.0
+    - https://github.com/ytti/oxidized-web/pull/195
+    - https://github.com/ytti/oxidized-web/pull/195/changes/12c07e69168bb5b4dfd4dbfed857491ed095dfd0
     - https://vuldb.com/?id.216870
+    - https://github.com/advisories/GHSA-8qwh-rm6c-jv96
+  notes: |
+    - cvss_v3 from GHSA URL.
+    - PR#195: [escape user input to fix XSS "vulnerability"]
+    - See /changes/ UR (fix)L in /compare/ URL.
 ---

advisories/_posts/2024-07-25-CVE-2024-7106.md

@@ -30,13 +30,20 @@ advisory:
   cvss_v2: 5.0
   cvss_v3: 4.3
   cvss_v4: 6.9
-  notes: Never patched
+  patched_versions:
+  - ">= 2.21.0"
   related:
     url:
     - https://nvd.nist.gov/vuln/detail/CVE-2024-7106
+    - https://github.com/SpinaCMS/Spina/compare/v2.21.0...main
+    - https://github.com/SpinaCMS/Spina/commit/ccc3f5d2f76423561d17acf522baddb5c3fa8d43
+    - https://github.com/SpinaCMS/Spina/pull/1441/changes/a22b1d6530d8166e0de7117ce3885100b2dbe461
+    - https://github.com/SpinaCMS/Spina/pull/1441
+    - https://github.com/SpinaCMS/Spina/issues/1381
     - https://github.com/topsky979/Security-Collections/blob/main/cve3/README.md
     - https://vuldb.com/?ctiid.272431
     - https://vuldb.com/?id.272431
     - https://vuldb.com/?submit.376769
     - https://github.com/advisories/GHSA-wqw3-p83g-r24v
+  notes: "- See CVE reference in /compare/v2.21.0 URL.\n"
 ---

advisories/_posts/2025-06-13-CVE-2025-28382.md

@@ -9,7 +9,7 @@ advisory:
   gem: openc3-cosmos-tool-iframe
   cve: 2025-28382
   ghsa: cf8v-5mrc-jv7f
-  url: https://github.com/advisories/GHSA-cf8v-5mrc-jv7f
+  url: https://nvd.nist.gov/vuln/detail/CVE-2025-28382
   title: OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint
   date: 2025-06-13
   description: |-
@@ -18,11 +18,19 @@ advisory:
   cvss_v3: 7.5
   unaffected_versions:
   - "< 6.0.0"
-  notes: Never patched
+  patched_versions:
+  - ">= 6.1.0"
   related:
     url:
     - https://nvd.nist.gov/vuln/detail/CVE-2025-28382
+    - https://rubygems.org/gems/openc3-cosmos-tool-iframe/versions/6.1.0
+    - https://github.com/OpenC3/cosmos/releases/tag/v6.1.0
+    - https://github.com/OpenC3/cosmos/pull/1828/changes/fc7e11310a7cdf9f1939886e1b29009db4d4b718
     - https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework
     - https://openc3.com
     - https://github.com/advisories/GHSA-cf8v-5mrc-jv7f
+  notes: |
+    - cvss_v3 from GHSA URL.
+    - NOTE: gem name is "openc3-cosmos-tool-iframe" and repo name is "cosmos".
+    - /tag/ URL has reference to CVE-2025-28382.
 ---

advisories/_posts/2025-06-13-CVE-2025-28384.md

@@ -9,7 +9,7 @@ advisory:
   gem: openc3-cosmos-tool-iframe
   cve: 2025-28384
   ghsa: p67j-387g-75wc
-  url: https://github.com/advisories/GHSA-p67j-387g-75wc
+  url: https://nvd.nist.gov/vuln/detail/CVE-2025-28384
   title: OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/
     endpoint
   date: 2025-06-13
@@ -19,11 +19,19 @@ advisory:
   cvss_v3: 9.1
   unaffected_versions:
   - "< 6.0.0"
-  notes: Never patched
+  patched_versions:
+  - ">= 6.1.0"
   related:
     url:
     - https://nvd.nist.gov/vuln/detail/CVE-2025-28384
+    - https://rubygems.org/gems/openc3-cosmos-tool-iframe/versions/6.1.0
+    - https://github.com/OpenC3/cosmos/releases/tag/v6.1.0
+    - https://github.com/OpenC3/cosmos/pull/1828/changes/fc7e11310a7cdf9f1939886e1b29009db4d4b718
     - https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework
     - https://openc3.com
     - https://github.com/advisories/GHSA-p67j-387g-75wc
+  notes: |
+    - cvss_v3 from GHSA URL.
+    - NOTE: gem name is "openc3-cosmos-tool-iframe" and repo name is "cosmos".
+    - /tag/ URL has reference to CVE-2025-28384.
 ---

advisories/_posts/2026-04-14-CVE-2026-41146.md

@@ -265,15 +265,19 @@ advisory:
       - The gem vendors a copy of the vulnerable parser in
         `ext/iodine/fio_json_parser.h`
   cvss_v4: 8.7
+  patched_versions:
+  - ">= 0.7.59"
   related:
     url:
     - https://nvd.nist.gov/vuln/detail/CVE-2026-41146
-    - https://github.com/boazsegev/iodine/releases/tag/v0.7.58
+    - https://rubygems.org/gems/iodine/versions/0.7.59
+    - https://github.com/boazsegev/iodine/releases/tag/v0.7.59
+    - https://github.com/boazsegev/iodine/compare/v0.7.58...v0.7.59
     - https://github.com/boazsegev/iodine/commit/0855989d74098d838b972520835cfc256bc479bc
     - https://github.com/boazsegev/facil.io/commit/5128747363055201d3ecf0e29bf0a961703c9fa0
     - https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm
     - https://github.com/advisories/GHSA-2x79-gwq3-vxxm
   notes: |
-    - FYI: iodine commit above contains the unreleased patch.
-    - Found GHSA's `patched_versions:` field is "0.7.59" but never released.
+    - cvss_v4 from nvd.nist.gov URL.
+    - FYI: iodine commit above in 0.7.59 release.
 ---

advisories/_posts/2026-07-01-GHSA-mjgf-xj26-9qf9.md

@@ -50,12 +50,14 @@ advisory:
   related:
     url:
     - https://advisories.gitlab.com/gem/pay/GHSA-mjgf-xj26-9qf9
+    - https://rubygems.org/gems/pay/versions/11.6.2
+    - https://github.com/pay-rails/pay/releases/tag/v11.6.2
+    - https://github.com/pay-rails/pay/commit/ba6494109d88209fba2a4df2d9d6373fe81ed805
+    - https://github.com/pay-rails/pay/issues/1232
+    - https://github.com/rubysec/ruby-advisory-db/pull/1158
     - https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9
     - https://github.com/advisories/GHSA-mjgf-xj26-9qf9
   notes: |
-    - Fixed in 11.6.2.
-      - https://github.com/pay-rails/pay/releases/tag/v11.6.2
-      - https://rubygems.org/gems/pay/versions/11.6.2
-    - cvss_v3 value comes from project advisory.
-    - No cve value, so missing cvss_v2 and cvss_v4 values.
+    - cvss_v3 from GHSA URL.
+    - No cve in GHSA URL.
 ---