Updated advisory posts against rubysec/ruby-advisory-db@ae227fa

Author: jasnow

advisories/_posts/2012-05-31-CVE-2012-2660.md

@@ -10,6 +10,7 @@ advisory:
   gem: activerecord
   framework: rails
   cve: 2012-2660
+  ghsa: hgpp-pp89-4fgf
   osvdb: 82610
   url: https://nvd.nist.gov/vuln/detail/CVE-2012-2660
   title: 'CVE-2012-2660 rubygem-actionpack: Unsafe query generation'
@@ -23,7 +24,12 @@ advisory:
     a related issue to CVE-2012-2694.
   cvss_v2: 7.5
   patched_versions:
+  - "~> 2.3.16"
   - "~> 3.0.13"
   - "~> 3.1.5"
   - ">= 3.2.4"
+  related:
+    url:
+    - https://github.com/advisories/GHSA-hgpp-pp89-4fgf
+  notes: "- Added GHSA data plus 2.3.16 patch from GHSA.\n"
 ---

advisories/_posts/2013-02-19-CVE-2013-1756.md

@@ -8,6 +8,7 @@ categories:
 advisory:
   gem: fog-dragonfly
   cve: 2013-1756
+  ghsa: p463-639r-q9g9
   osvdb: 90647
   url: https://nvd.nist.gov/vuln/detail/CVE-2013-1756
   title: Dragonfly Gem for Ruby Crafted Request Parsing Remote Code Execution
@@ -22,5 +23,25 @@ advisory:
   unaffected_versions:
   - "< 0.7.0"
   patched_versions:
+  - "~> 0.8.6"
   - ">= 0.9.14"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-1756
+    - https://rubygems.org/gems/dragonfly/versions/0.9.14
+    - https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo
+    - https://github.com/markevans/dragonfly/releases/tag/v0.9.14
+    - https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277
+    - https://github.com/markevans/dragonfly/releases/tag/security_fix
+    - https://rubygems.org/gems/dragonfly/versions/0.8.6
+    - https://github.com/markevans/dragonfly/releases/tag/v0.8.6
+    - https://github.com/markevans/dragonfly/compare/v0.8.5...v0.8.6
+    - https://rubygems.org/gems/fog-dragonfly
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/82476
+    - https://web.archive.org/web/20200229103538/http://www.securityfocus.com/bid/58225
+    - https://github.com/advisories/GHSA-p463-639r-q9g9
+  notes: |
+    - See commit URL for patch note in repo's README file.
+    - Patch was backported to "0.8.6".
+    - cvss_v2 from nvd.nist.gov URL.
 ---

advisories/_posts/2014-12-04-CVE-2014-9489.md

@@ -8,7 +8,8 @@ categories:
 advisory:
   gem: gollum-grit_adapter
   cve: 2014-9489
-  url: https://github.com/gollum/gollum/issues/913
+  ghsa: q97v-764g-r2rp
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-9489
   title: gollum-grit_adapter Search Functionality Allows Arbitrary Command Execution
   date: 2014-12-04
   description: |-
@@ -24,6 +25,17 @@ advisory:
     Note that the grep result must find the string 'master' (or
     whatever is the default branch that gollum uses) in any of the wiki's
     documents for this to succeed.
+  cvss_v2: 6.5
+  cvss_v3: 8.8
   patched_versions:
   - ">= 0.1.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-9489
+    - https://github.com/gollum/grit_adapter/commit/4520d973c81fecfebbeacd2ef2f1849d763951c7
+    - https://github.com/gollum/gollum/issues/913
+    - http://www.openwall.com/lists/oss-security/2015/01/03/19
+    - https://web.archive.org/web/20200229041306/http://www.securityfocus.com/bid/71499
+    - https://github.com/advisories/GHSA-q97v-764g-r2rp
+  notes: "- cvss_v2 and cvss_v3 from nvd.nist.gov URL.\n"
 ---

advisories/_posts/2018-01-09-CVE-2018-7212.md

@@ -9,7 +9,7 @@ advisory:
   gem: sinatra
   cve: 2018-7212
   ghsa: h29f-7f56-j8wh
-  url: https://github.com/sinatra/sinatra/pull/1379
+  url: https://nvd.nist.gov/vuln/detail/CVE-2018-7212
   title: sinatra ruby gem path traversal via backslash characters on Windows
   date: 2018-01-09
   description: |-
@@ -22,4 +22,15 @@ advisory:
   - "< 2.0.0"
   patched_versions:
   - ">= 2.0.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-7212
+    - https://rubygems.org/gems/sinatra/versions/2.0.1
+    - https://github.com/sinatra/sinatra/pull/1379
+    - https://github.com/sinatra/sinatra/commit/6ad721abcfe36334108dcdd05d046c361e1b7a9c
+    - https://github.com/advisories/GHSA-h29f-7f56-j8wh
+  notes: |
+    - cvss_v2 and cvss_v3 from nvd.nist.gov URL.
+    - "patched_versions" to "sinatra" gem verified in commit URL.
+    - "unaffected_versions" from global GHSA.
 ---

advisories/_posts/2026-06-19-CVE-2026-54904.md

@@ -58,6 +58,6 @@ advisory:
     - https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-h8w8-99g7-qmvj
     - https://github.com/advisories/GHSA-h8w8-99g7-qmvj
   notes: |
-    - cvss_v4 from GHSA and nvd.nist.gov URL
-    - cvss_v3 from nvd.nist.gov URL
+    - cvss_v4 from GHSA and nvd.hist.gov URLs.
+    - cvss_v3 from nvd.hist.gov URL.
 ---