Skip to content

Commit 4b6766f

Browse files
jasnowpostmodern
authored andcommitted
3 brand new non-GHSA advisories
1 parent deb44c6 commit 4b6766f

File tree

3 files changed

+112
-0
lines changed

3 files changed

+112
-0
lines changed

gems/cgi/CVE-2025-27219.yml

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
gem: cgi
3+
cve: 2025-27219
4+
url: https://www.cve.org/CVERecord?id=CVE-2025-27219
5+
title: CVE-2025-27219 - Denial of Service in CGI::Cookie.parse
6+
date: 2025-02-26
7+
description: |
8+
There is a possibility for DoS by in the cgi gem.
9+
This vulnerability has been assigned the CVE identifier
10+
CVE-2025-27219. We recommend upgrading the cgi gem.
11+
12+
## Details
13+
14+
CGI::Cookie.parse took super-linear time to parse a cookie string
15+
in some cases. Feeding a maliciously crafted cookie string into
16+
the method could lead to a Denial of Service.
17+
18+
Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.
19+
20+
## Affected versions
21+
22+
cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.
23+
24+
## Credits
25+
26+
Thanks to lio346 for discovering this issue.
27+
Also thanks to mame for fixing this vulnerability.
28+
patched_versions:
29+
- "~> 0.3.5.1"
30+
- "~> 0.3.7"
31+
- ">= 0.4.2"
32+
related:
33+
url:
34+
- https://www.cve.org/CVERecord?id=CVE-2025-27219
35+
- https://www.suse.com/security/cve/CVE-2025-27219.html
36+
- https://www.ruby-lang.org/en/news/2025/02/26/security-advisories

gems/cgi/CVE-2025-27220.yml

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
gem: cgi
3+
cve: 2025-27220
4+
url: https://www.cve.org/CVERecord?id=CVE-2025-27220
5+
title: CVE-2025-27220 - ReDoS in CGI::Util#escapeElement.
6+
date: 2025-02-26
7+
description: |
8+
There is a possibility for Regular expression Denial of Service (ReDoS)
9+
by in the cgi gem. This vulnerability has been assigned the CVE
10+
identifier CVE-2025-27220. We recommend upgrading the cgi gem.
11+
12+
## Details
13+
14+
The regular expression used in CGI::Util#escapeElement is vulnerable
15+
to ReDoS. The crafted input could lead to a high CPU consumption.
16+
17+
This vulnerability only affects Ruby 3.1 and 3.2. If you
18+
are using these versions, please update CGI gem to version
19+
0.3.5.1, 0.3.7, 0.4.2 or later.
20+
21+
## Affected versions
22+
23+
cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.
24+
25+
## Credits
26+
27+
Thanks to svalkanov for discovering this issue.
28+
Also thanks to nobu for fixing this vulnerability.
29+
patched_versions:
30+
- "~> 0.3.5.1"
31+
- "~> 0.3.7"
32+
- ">= 0.4.2"
33+
related:
34+
url:
35+
- https://www.cve.org/CVERecord?id=CVE-2025-27220
36+
- https://www.ruby-lang.org/en/news/2025/02/26/security-advisories

gems/uri/CVE-2025-27221.yml

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
gem: uri
3+
cve: 2025-27221
4+
url: https://www.cve.org/CVERecord?id=CVE-2025-27221
5+
title: CVE-2025-27221 - userinfo leakage in URI#join, URI#merge and URI#+.
6+
date: 2025-02-26
7+
description: |
8+
9+
There is a possibility for userinfo leakage by in the uri gem.
10+
This vulnerability has been assigned the CVE identifier
11+
CVE-2025-27221. We recommend upgrading the uri gem.
12+
13+
## Details
14+
15+
The methods URI#join, URI#merge, and URI#+ retained userinfo, such
16+
as user:password, even after the host is replaced. When generating
17+
a URL to a malicious host from a URL containing secret userinfo
18+
using these methods, and having someone access that URL, an
19+
unintended userinfo leak could occur.
20+
21+
Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later.
22+
23+
## Affected versions
24+
25+
uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and
26+
1.0.0 to 1.0.2.
27+
28+
## Credits
29+
30+
Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue.
31+
Also thanks to nobu for additional fixes of this vulnerability.
32+
patched_versions:
33+
- "~> 0.11.3"
34+
- "~> 0.12.4"
35+
- "~> 0.13.2"
36+
- ">= 1.0.3"
37+
related:
38+
url:
39+
- https://www.cve.org/CVERecord?id=CVE-2025-27221
40+
- https://www.ruby-lang.org/en/news/2025/02/26/security-advisories

0 commit comments

Comments
 (0)