almalinux/rubygem-mongo-doc

Vulnerabilities (30)

• CVE-2020-25613HigOct 6, 2020
  affected < 2.11.3-1.module_el8.3.0+6147+d0dfc1e4fixed 2.11.3-1.module_el8.3.0+6147+d0dfc1e4

  An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (w

• CVE-2019-3881HigSep 4, 2020
  affected < 2.8.0-1.module_el8.5.0+250+ba22dbf7fixed 2.8.0-1.module_el8.5.0+250+ba22dbf7

  Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an a

• CVE-2020-10933MedMay 4, 2020
  affected < 2.5.1-2.module_el8.5.0+2625+ec418553fixed 2.5.1-2.module_el8.5.0+2625+ec418553

  An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string prov

• CVE-2020-10663HigApr 28, 2020
  affected < 2.5.1-2.module_el8.5.0+2625+ec418553fixed 2.5.1-2.module_el8.5.0+2625+ec418553

  The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically,

• CVE-2019-16255HigNov 26, 2019
  affected < 2.5.1-2.module_el8.5.0+2625+ec418553fixed 2.5.1-2.module_el8.5.0+2625+ec418553

  Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.

• CVE-2019-16254MedNov 26, 2019
  affected < 2.5.1-2.module_el8.5.0+2625+ec418553fixed 2.5.1-2.module_el8.5.0+2625+ec418553

  Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content t

• CVE-2019-16201HigNov 26, 2019
  affected < 2.5.1-2.module_el8.5.0+2625+ec418553fixed 2.5.1-2.module_el8.5.0+2625+ec418553

  WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.

• CVE-2019-15845MedNov 26, 2019
  affected < 2.5.1-2.module_el8.5.0+2625+ec418553fixed 2.5.1-2.module_el8.5.0+2625+ec418553

  Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

• CVE-2019-19012CriNov 17, 2019
  affected < 2.5.1-2.module_el8.5.0+2625+ec418553fixed 2.5.1-2.module_el8.5.0+2625+ec418553

  An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a d

• CVE-2019-8324HigJun 17, 2019
  affected < 2.5.1-2.module_el8.5.0+2625+ec418553fixed 2.5.1-2.module_el8.5.0+2625+ec418553

  An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall c