From 2dce2778a70536631c810b415c0e29314d768ccb Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Thu, 26 Mar 2026 14:09:37 -0400 Subject: [PATCH 1/2] Fixed indent issues for existing advisories --- gems/alchemy_cms/CVE-2018-18307.yml | 20 ++++++++--------- gems/ckeditor/CVE-2020-27193.yml | 18 +++++++-------- gems/ckeditor/CVE-2020-9281.yml | 24 ++++++++++---------- gems/ckeditor/CVE-2021-26272.yml | 16 ++++++------- gems/ckeditor/CVE-2021-32808.yml | 22 +++++++++--------- gems/ckeditor/CVE-2021-32809.yml | 20 ++++++++--------- gems/ckeditor/CVE-2021-33829.yml | 26 +++++++++++----------- gems/ckeditor/CVE-2021-37695.yml | 22 +++++++++--------- gems/ckeditor/CVE-2021-41164.yml | 22 +++++++++--------- gems/ckeditor/CVE-2021-41165.yml | 18 +++++++-------- gems/ckeditor/CVE-2022-24728.yml | 22 +++++++++--------- gems/ckeditor/CVE-2023-4771.yml | 10 ++++----- gems/ckeditor/CVE-2024-24815.yml | 16 ++++++------- gems/ckeditor/CVE-2024-24816.yml | 10 ++++----- gems/ckeditor/CVE-2024-43407.yml | 10 ++++----- gems/ckeditor/CVE-2024-43411.yml | 8 +++---- gems/commonmarker/CVE-2024-22051.yml | 2 +- gems/omniauth-saml/GHSA-hw46-3hmr-x9xv.yml | 20 ++++++++--------- gems/rack/CVE-2025-27610.yml | 12 +++++----- gems/webrick/CVE-2009-4492.yml | 24 ++++++++++---------- 20 files changed, 171 insertions(+), 171 deletions(-) diff --git a/gems/alchemy_cms/CVE-2018-18307.yml b/gems/alchemy_cms/CVE-2018-18307.yml index ce79b501a7..8a58df8a40 100644 --- a/gems/alchemy_cms/CVE-2018-18307.yml +++ b/gems/alchemy_cms/CVE-2018-18307.yml @@ -10,16 +10,16 @@ description: | via the /admin/pictures image filename field. cvss_v3: 5.9 unaffected_versions: -- "< 4.1.0" + - "< 4.1.0" patched_versions: -- ">= 7.4.10" + - ">= 7.4.10" related: url: - - https://nvd.nist.gov/vuln/detail/CVE-2018-18307 - - http://packetstormsecurity.com/files/149787/Alchemy-CMS-4.1-Stable-Cross-Site-Scripting.html - - https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/base_controller.rb#L15 - - https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/pictures_controller.rb#L5 - - https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/resources_controller.rb#L21 - - https://github.com/AlchemyCMS/alchemy_cms/pull/3375 - - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.10 - - https://github.com/advisories/GHSA-7mj4-2984-955f + - https://nvd.nist.gov/vuln/detail/CVE-2018-18307 + - http://packetstormsecurity.com/files/149787/Alchemy-CMS-4.1-Stable-Cross-Site-Scripting.html + - https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/base_controller.rb#L15 + - https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/pictures_controller.rb#L5 + - https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/resources_controller.rb#L21 + - https://github.com/AlchemyCMS/alchemy_cms/pull/3375 + - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.10 + - https://github.com/advisories/GHSA-7mj4-2984-955f diff --git a/gems/ckeditor/CVE-2020-27193.yml b/gems/ckeditor/CVE-2020-27193.yml index 927a09358a..b6f8fed11f 100644 --- a/gems/ckeditor/CVE-2020-27193.yml +++ b/gems/ckeditor/CVE-2020-27193.yml @@ -11,14 +11,14 @@ description: | a user to copy and paste crafted HTML code into one of editor inputs. cvss_v3: 6.1 patched_versions: -- ">= 5.1.2" + - ">= 5.1.2" related: url: - - https://nvd.nist.gov/vuln/detail/CVE-2020-27193 - - https://ckeditor.com/blog/CKEditor-4.15.1-with-a-security-patch-released/ - - https://ckeditor.com/cke4/release/CKEditor-4.15.1 - - https://ckeditor.com/ckeditor-4/download/ - - https://www.oracle.com//security-alerts/cpujul2021.html - - https://www.oracle.com/security-alerts/cpuApr2021.html - - https://www.oracle.com/security-alerts/cpuoct2021.html - - https://github.com/advisories/GHSA-4m44-5j2g-xf64 + - https://nvd.nist.gov/vuln/detail/CVE-2020-27193 + - https://ckeditor.com/blog/CKEditor-4.15.1-with-a-security-patch-released/ + - https://ckeditor.com/cke4/release/CKEditor-4.15.1 + - https://ckeditor.com/ckeditor-4/download/ + - https://www.oracle.com//security-alerts/cpujul2021.html + - https://www.oracle.com/security-alerts/cpuApr2021.html + - https://www.oracle.com/security-alerts/cpuoct2021.html + - https://github.com/advisories/GHSA-4m44-5j2g-xf64 diff --git a/gems/ckeditor/CVE-2020-9281.yml b/gems/ckeditor/CVE-2020-9281.yml index 741d204ae8..996ac6e280 100644 --- a/gems/ckeditor/CVE-2020-9281.yml +++ b/gems/ckeditor/CVE-2020-9281.yml @@ -11,17 +11,17 @@ description: | through a crafted "protected" comment (with the cke_protected syntax). cvss_v3: 6.1 patched_versions: -- ">= 5.1.2" + - ">= 5.1.2" related: url: - - https://nvd.nist.gov/vuln/detail/CVE-2020-9281 - - https://github.com/ckeditor/ckeditor4 - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO/ - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE/ - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4HHYQ6N452XTCIROFMJOTYEUWSB6FR4/ - - https://www.oracle.com/security-alerts/cpujan2021.html - - https://www.oracle.com/security-alerts/cpuoct2020.html - - https://www.oracle.com/security-alerts/cpuApr2021.html - - https://www.oracle.com/security-alerts/cpuoct2021.html - - https://www.oracle.com/security-alerts/cpujan2022.html - - https://github.com/advisories/GHSA-vcjf-mgcg-jxjq + - https://nvd.nist.gov/vuln/detail/CVE-2020-9281 + - https://github.com/ckeditor/ckeditor4 + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4HHYQ6N452XTCIROFMJOTYEUWSB6FR4/ + - https://www.oracle.com/security-alerts/cpujan2021.html + - https://www.oracle.com/security-alerts/cpuoct2020.html + - https://www.oracle.com/security-alerts/cpuApr2021.html + - https://www.oracle.com/security-alerts/cpuoct2021.html + - https://www.oracle.com/security-alerts/cpujan2022.html + - https://github.com/advisories/GHSA-vcjf-mgcg-jxjq diff --git a/gems/ckeditor/CVE-2021-26272.yml b/gems/ckeditor/CVE-2021-26272.yml index 1652040356..62d828c0ec 100644 --- a/gems/ckeditor/CVE-2021-26272.yml +++ b/gems/ckeditor/CVE-2021-26272.yml @@ -11,13 +11,13 @@ description: | then press Enter or Space (in the Autolink plugin). cvss_v3: 6.5 patched_versions: -- ">= 5.1.2" + - ">= 5.1.2" related: url: - - https://nvd.nist.gov/vuln/detail/CVE-2021-26272 - - https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-first - - https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416 - - https://www.oracle.com//security-alerts/cpujul2021.html - - https://www.oracle.com/security-alerts/cpuoct2021.html - - https://www.oracle.com/security-alerts/cpujan2022.html - - https://github.com/advisories/GHSA-wpvm-wqr4-p7cw + - https://nvd.nist.gov/vuln/detail/CVE-2021-26272 + - https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-first + - https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416 + - https://www.oracle.com//security-alerts/cpujul2021.html + - https://www.oracle.com/security-alerts/cpuoct2021.html + - https://www.oracle.com/security-alerts/cpujan2022.html + - https://github.com/advisories/GHSA-wpvm-wqr4-p7cw diff --git a/gems/ckeditor/CVE-2021-32808.yml b/gems/ckeditor/CVE-2021-32808.yml index f1b3b3252e..6c27b887a9 100644 --- a/gems/ckeditor/CVE-2021-32808.yml +++ b/gems/ckeditor/CVE-2021-32808.yml @@ -23,17 +23,17 @@ description: | The CKEditor 4 team would like to thank Anton Subbotin ([skavans](https://github.com/skavans)) for recognizing and reporting this vulnerability. cvss_v3: 7.6 unaffected_versions: -- "< 5.1.2" + - "< 5.1.2" patched_versions: -- ">= 5.1.2" + - ">= 5.1.2" related: url: - - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c - - https://nvd.nist.gov/vuln/detail/CVE-2021-32808 - - https://github.com/ckeditor/ckeditor4/releases/tag/4.16.2 - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/ - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/ - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/ - - https://www.oracle.com/security-alerts/cpuoct2021.html - - https://www.oracle.com/security-alerts/cpujan2022.html - - https://github.com/advisories/GHSA-6226-h7ff-ch6c + - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c + - https://nvd.nist.gov/vuln/detail/CVE-2021-32808 + - https://github.com/ckeditor/ckeditor4/releases/tag/4.16.2 + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/ + - https://www.oracle.com/security-alerts/cpuoct2021.html + - https://www.oracle.com/security-alerts/cpujan2022.html + - https://github.com/advisories/GHSA-6226-h7ff-ch6c diff --git a/gems/ckeditor/CVE-2021-32809.yml b/gems/ckeditor/CVE-2021-32809.yml index aa035cb051..1e4032ee20 100644 --- a/gems/ckeditor/CVE-2021-32809.yml +++ b/gems/ckeditor/CVE-2021-32809.yml @@ -31,16 +31,16 @@ description: | The CKEditor 4 team would like to thank Anton Subbotin ([skavans](https://github.com/skavans)) for recognizing and reporting this vulnerability. cvss_v3: 4.6 unaffected_versions: -- "< 4.1.2" + - "< 4.1.2" patched_versions: -- ">= 5.1.2" + - ">= 5.1.2" related: url: - - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg - - https://nvd.nist.gov/vuln/detail/CVE-2021-32809 - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/ - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/ - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/ - - https://www.oracle.com/security-alerts/cpuoct2021.html - - https://www.oracle.com/security-alerts/cpujan2022.html - - https://github.com/advisories/GHSA-7889-rm5j-hpgg + - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg + - https://nvd.nist.gov/vuln/detail/CVE-2021-32809 + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/ + - https://www.oracle.com/security-alerts/cpuoct2021.html + - https://www.oracle.com/security-alerts/cpujan2022.html + - https://github.com/advisories/GHSA-7889-rm5j-hpgg diff --git a/gems/ckeditor/CVE-2021-33829.yml b/gems/ckeditor/CVE-2021-33829.yml index 1fe4acd49b..1ab0a4f876 100644 --- a/gems/ckeditor/CVE-2021-33829.yml +++ b/gems/ckeditor/CVE-2021-33829.yml @@ -11,19 +11,19 @@ description: | executable JavaScript code through a crafted comment because `--!>` is mishandled. cvss_v3: 6.1 unaffected_versions: -- "< 5.1.1" + - "< 5.1.1" patched_versions: -- ">= 5.1.2" + - ">= 5.1.2" related: url: - - https://nvd.nist.gov/vuln/detail/CVE-2021-33829 - - https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-parser - - https://www.npmjs.com/package/ckeditor4 - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/ - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/ - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/ - - https://www.drupal.org/sa-core-2021-003 - - https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html - - https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2021-33829.yaml - - https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2021-33829.yaml - - https://github.com/advisories/GHSA-rgx6-rjj4-c388 + - https://nvd.nist.gov/vuln/detail/CVE-2021-33829 + - https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-parser + - https://www.npmjs.com/package/ckeditor4 + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/ + - https://www.drupal.org/sa-core-2021-003 + - https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html + - https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2021-33829.yaml + - https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2021-33829.yaml + - https://github.com/advisories/GHSA-rgx6-rjj4-c388 diff --git a/gems/ckeditor/CVE-2021-37695.yml b/gems/ckeditor/CVE-2021-37695.yml index 71cc6e0dee..5ae4895dfa 100644 --- a/gems/ckeditor/CVE-2021-37695.yml +++ b/gems/ckeditor/CVE-2021-37695.yml @@ -30,16 +30,16 @@ description: | The CKEditor 4 team would like to thank Mika Kulmala ([kulmik](https://github.com/kulmik)) for recognizing and reporting this vulnerability. cvss_v3: 7.3 patched_versions: -- ">= 5.1.2" + - ">= 5.1.2" related: url: - - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc - - https://nvd.nist.gov/vuln/detail/CVE-2021-37695 - - https://github.com/ckeditor/ckeditor4/commit/de3c001540715f9c3801aaa38a1917de46cfcf58 - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/ - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/ - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/ - - https://www.oracle.com/security-alerts/cpuoct2021.html - - https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html - - https://www.oracle.com/security-alerts/cpujan2022.html - - https://github.com/advisories/GHSA-m94c-37g6-cjhc + - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc + - https://nvd.nist.gov/vuln/detail/CVE-2021-37695 + - https://github.com/ckeditor/ckeditor4/commit/de3c001540715f9c3801aaa38a1917de46cfcf58 + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/ + - https://www.oracle.com/security-alerts/cpuoct2021.html + - https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html + - https://www.oracle.com/security-alerts/cpujan2022.html + - https://github.com/advisories/GHSA-m94c-37g6-cjhc diff --git a/gems/ckeditor/CVE-2021-41164.yml b/gems/ckeditor/CVE-2021-41164.yml index 0db9409fd8..d32a089a1c 100644 --- a/gems/ckeditor/CVE-2021-41164.yml +++ b/gems/ckeditor/CVE-2021-41164.yml @@ -23,16 +23,16 @@ description: | The CKEditor 4 team would like to thank Maurice Dauer ([laytonctf](https://twitter.com/laytonctf)) for recognizing and reporting this vulnerability. cvss_v3: 8.2 patched_versions: -- ">= 5.1.2" + - ">= 5.1.2" related: url: - - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprj - - https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417 - - https://nvd.nist.gov/vuln/detail/CVE-2021-41164 - - https://www.drupal.org/sa-core-2021-011 - - https://www.oracle.com/security-alerts/cpujan2022.html - - https://www.oracle.com/security-alerts/cpuapr2022.html - - https://www.oracle.com/security-alerts/cpujul2022.html - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/ - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/ - - https://github.com/advisories/GHSA-pvmx-g8h5-cprj + - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprj + - https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417 + - https://nvd.nist.gov/vuln/detail/CVE-2021-41164 + - https://www.drupal.org/sa-core-2021-011 + - https://www.oracle.com/security-alerts/cpujan2022.html + - https://www.oracle.com/security-alerts/cpuapr2022.html + - https://www.oracle.com/security-alerts/cpujul2022.html + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/ + - https://github.com/advisories/GHSA-pvmx-g8h5-cprj diff --git a/gems/ckeditor/CVE-2021-41165.yml b/gems/ckeditor/CVE-2021-41165.yml index 0e47b923bb..5e51975f65 100644 --- a/gems/ckeditor/CVE-2021-41165.yml +++ b/gems/ckeditor/CVE-2021-41165.yml @@ -22,14 +22,14 @@ description: | The CKEditor 4 team would like to thank William Bowling ([wbowling](https://github.com/wbowling)) for recognizing and reporting this vulnerability. cvss_v3: 8.2 patched_versions: -- ">= 5.1.2" + - ">= 5.1.2" related: url: - - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2 - - https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417 - - https://nvd.nist.gov/vuln/detail/CVE-2021-41165 - - https://www.drupal.org/sa-core-2021-011 - - https://www.oracle.com/security-alerts/cpujan2022.html - - https://www.oracle.com/security-alerts/cpuapr2022.html - - https://www.oracle.com/security-alerts/cpujul2022.html - - https://github.com/advisories/GHSA-7h26-63m7-qhf2 + - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2 + - https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417 + - https://nvd.nist.gov/vuln/detail/CVE-2021-41165 + - https://www.drupal.org/sa-core-2021-011 + - https://www.oracle.com/security-alerts/cpujan2022.html + - https://www.oracle.com/security-alerts/cpuapr2022.html + - https://www.oracle.com/security-alerts/cpujul2022.html + - https://github.com/advisories/GHSA-7h26-63m7-qhf2 diff --git a/gems/ckeditor/CVE-2022-24728.yml b/gems/ckeditor/CVE-2022-24728.yml index b868c81973..5c0c4b7ba9 100644 --- a/gems/ckeditor/CVE-2022-24728.yml +++ b/gems/ckeditor/CVE-2022-24728.yml @@ -22,18 +22,18 @@ description: |- The CKEditor 4 team would like to thank GHSL team member Kevin Backhouse ([@kevinbackhouse](https://github.com/kevinbackhouse)) for recognizing and reporting this vulnerability. cvss_v3: 5.4 patched_versions: -- ">= 5.1.2" + - ">= 5.1.2" related: url: - - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89 - - https://github.com/ckeditor/ckeditor4/commit/d158413449692d920a778503502dcb22881bc949 - - https://ckeditor.com/cke4/release/CKEditor-4.18.0 - - https://www.drupal.org/sa-core-2022-005 - - https://nvd.nist.gov/vuln/detail/CVE-2022-24728 - - https://securitylab.github.com/advisories/GHSL-2022-009_ckeditor4/ - - https://www.oracle.com/security-alerts/cpujul2022.html - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/ - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/ - - https://github.com/advisories/GHSA-4fc4-4p5g-6w89 + - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89 + - https://github.com/ckeditor/ckeditor4/commit/d158413449692d920a778503502dcb22881bc949 + - https://ckeditor.com/cke4/release/CKEditor-4.18.0 + - https://www.drupal.org/sa-core-2022-005 + - https://nvd.nist.gov/vuln/detail/CVE-2022-24728 + - https://securitylab.github.com/advisories/GHSL-2022-009_ckeditor4/ + - https://www.oracle.com/security-alerts/cpujul2022.html + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/ + - https://github.com/advisories/GHSA-4fc4-4p5g-6w89 # GitHub advisory data below - **Remove this data before committing** # Use this data to write patched_versions (and potentially unaffected_versions) above diff --git a/gems/ckeditor/CVE-2023-4771.yml b/gems/ckeditor/CVE-2023-4771.yml index 66dc3d1fc5..38a09e5490 100644 --- a/gems/ckeditor/CVE-2023-4771.yml +++ b/gems/ckeditor/CVE-2023-4771.yml @@ -24,8 +24,8 @@ description: |- cvss_v3: 6.1 related: url: - - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-wh5w-82f3-wrxh - - https://nvd.nist.gov/vuln/detail/CVE-2023-4771 - - https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb - - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cksource-ckeditor - - https://github.com/advisories/GHSA-wh5w-82f3-wrxh + - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-wh5w-82f3-wrxh + - https://nvd.nist.gov/vuln/detail/CVE-2023-4771 + - https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb + - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cksource-ckeditor + - https://github.com/advisories/GHSA-wh5w-82f3-wrxh diff --git a/gems/ckeditor/CVE-2024-24815.yml b/gems/ckeditor/CVE-2024-24815.yml index 45552fb69f..e2eb89d9d0 100644 --- a/gems/ckeditor/CVE-2024-24815.yml +++ b/gems/ckeditor/CVE-2024-24815.yml @@ -26,11 +26,11 @@ description: |- cvss_v3: 6.1 related: url: - - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qqvm - - https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb - - https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S-cdata - - https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html - - https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filter.html - - https://nvd.nist.gov/vuln/detail/CVE-2024-24815 - - https://www.drupal.org/sa-contrib-2024-009 - - https://github.com/advisories/GHSA-fq6h-4g8v-qqvm + - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qqvm + - https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb + - https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S-cdata + - https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html + - https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filter.html + - https://nvd.nist.gov/vuln/detail/CVE-2024-24815 + - https://www.drupal.org/sa-contrib-2024-009 + - https://github.com/advisories/GHSA-fq6h-4g8v-qqvm diff --git a/gems/ckeditor/CVE-2024-24816.yml b/gems/ckeditor/CVE-2024-24816.yml index dc6fb1d41b..7f392ccff1 100644 --- a/gems/ckeditor/CVE-2024-24816.yml +++ b/gems/ckeditor/CVE-2024-24816.yml @@ -30,8 +30,8 @@ description: |- cvss_v3: 6.1 related: url: - - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-mw2c-vx6j-mg76 - - https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb - - https://ckeditor.com/cke4/addon/preview - - https://nvd.nist.gov/vuln/detail/CVE-2024-24816 - - https://github.com/advisories/GHSA-mw2c-vx6j-mg76 + - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-mw2c-vx6j-mg76 + - https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb + - https://ckeditor.com/cke4/addon/preview + - https://nvd.nist.gov/vuln/detail/CVE-2024-24816 + - https://github.com/advisories/GHSA-mw2c-vx6j-mg76 diff --git a/gems/ckeditor/CVE-2024-43407.yml b/gems/ckeditor/CVE-2024-43407.yml index 83b24b3e77..ffe238854c 100644 --- a/gems/ckeditor/CVE-2024-43407.yml +++ b/gems/ckeditor/CVE-2024-43407.yml @@ -33,8 +33,8 @@ description: |- cvss_v3: 6.1 related: url: - - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7r32-vfj5-c2jv - - https://nvd.nist.gov/vuln/detail/CVE-2024-43407 - - https://github.com/ckeditor/ckeditor4/commit/71072c9f7f263329841bd38e7e5309074c82ef94 - - https://github.com/ckeditor/ckeditor4/commit/951e7d75fcbcaa2590b0719fb0bb0dd0539ca6fa - - https://github.com/advisories/GHSA-7r32-vfj5-c2jv + - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7r32-vfj5-c2jv + - https://nvd.nist.gov/vuln/detail/CVE-2024-43407 + - https://github.com/ckeditor/ckeditor4/commit/71072c9f7f263329841bd38e7e5309074c82ef94 + - https://github.com/ckeditor/ckeditor4/commit/951e7d75fcbcaa2590b0719fb0bb0dd0539ca6fa + - https://github.com/advisories/GHSA-7r32-vfj5-c2jv diff --git a/gems/ckeditor/CVE-2024-43411.yml b/gems/ckeditor/CVE-2024-43411.yml index aabb5bfd43..2c45c5f78d 100644 --- a/gems/ckeditor/CVE-2024-43411.yml +++ b/gems/ckeditor/CVE-2024-43411.yml @@ -27,7 +27,7 @@ description: |- cvss_v3: 3.1 related: url: - - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6v96-m24v-f58j - - https://github.com/ckeditor/ckeditor4/commit/b5069c9cb769ea22eae1cbd7200f22b1cf2e3a7f - - https://nvd.nist.gov/vuln/detail/CVE-2024-43411 - - https://github.com/advisories/GHSA-6v96-m24v-f58j + - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6v96-m24v-f58j + - https://github.com/ckeditor/ckeditor4/commit/b5069c9cb769ea22eae1cbd7200f22b1cf2e3a7f + - https://nvd.nist.gov/vuln/detail/CVE-2024-43411 + - https://github.com/advisories/GHSA-6v96-m24v-f58j diff --git a/gems/commonmarker/CVE-2024-22051.yml b/gems/commonmarker/CVE-2024-22051.yml index b821fd013a..ba4089e85f 100644 --- a/gems/commonmarker/CVE-2024-22051.yml +++ b/gems/commonmarker/CVE-2024-22051.yml @@ -35,7 +35,7 @@ description: | ### References - - https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x + - https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x ### Acknowledgements diff --git a/gems/omniauth-saml/GHSA-hw46-3hmr-x9xv.yml b/gems/omniauth-saml/GHSA-hw46-3hmr-x9xv.yml index 15823f8d72..fb12183220 100644 --- a/gems/omniauth-saml/GHSA-hw46-3hmr-x9xv.yml +++ b/gems/omniauth-saml/GHSA-hw46-3hmr-x9xv.yml @@ -17,15 +17,15 @@ description: |- Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. cvss_v4: 9.3 patched_versions: -- "~> 1.10.6" -- "~> 2.1.3" -- ">= 2.2.3" + - "~> 1.10.6" + - "~> 2.1.3" + - ">= 2.2.3" related: url: - - https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv - - https://github.com/omniauth/omniauth-saml/commit/0d5eaa0d808acb2ac96deadf5c750ac1cf2d92b5 - - https://github.com/omniauth/omniauth-saml/commit/2c8a482801808bbcb0188214bde74680b8018a35 - - https://github.com/omniauth/omniauth-saml/commit/7a348b49083462a566af41a5ae85e9f3af15b985 - - https://github.com/omniauth/omniauth-saml/blob/master/omniauth-saml.gemspec#L16 - - https://rubygems.org/gems/omniauth-saml/versions/2.2.3 - - https://github.com/advisories/GHSA-hw46-3hmr-x9xv + - https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv + - https://github.com/omniauth/omniauth-saml/commit/0d5eaa0d808acb2ac96deadf5c750ac1cf2d92b5 + - https://github.com/omniauth/omniauth-saml/commit/2c8a482801808bbcb0188214bde74680b8018a35 + - https://github.com/omniauth/omniauth-saml/commit/7a348b49083462a566af41a5ae85e9f3af15b985 + - https://github.com/omniauth/omniauth-saml/blob/master/omniauth-saml.gemspec#L16 + - https://rubygems.org/gems/omniauth-saml/versions/2.2.3 + - https://github.com/advisories/GHSA-hw46-3hmr-x9xv diff --git a/gems/rack/CVE-2025-27610.yml b/gems/rack/CVE-2025-27610.yml index 4615bc93ca..6b0197bdc6 100644 --- a/gems/rack/CVE-2025-27610.yml +++ b/gems/rack/CVE-2025-27610.yml @@ -27,11 +27,11 @@ description: |- It is likely that a CDN or similar static file server would also mitigate the issue. cvss_v3: 7.5 patched_versions: -- "~> 2.2.13" -- "~> 3.0.14" -- ">= 3.1.12" + - "~> 2.2.13" + - "~> 3.0.14" + - ">= 3.1.12" related: url: - - https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v - - https://github.com/rack/rack/commit/50caab74fa01ee8f5dbdee7bb2782126d20c6583 - - https://github.com/advisories/GHSA-7wqh-767x-r66v + - https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v + - https://github.com/rack/rack/commit/50caab74fa01ee8f5dbdee7bb2782126d20c6583 + - https://github.com/advisories/GHSA-7wqh-767x-r66v diff --git a/gems/webrick/CVE-2009-4492.yml b/gems/webrick/CVE-2009-4492.yml index 2bac49f55e..577195a668 100644 --- a/gems/webrick/CVE-2009-4492.yml +++ b/gems/webrick/CVE-2009-4492.yml @@ -13,17 +13,17 @@ description: | files, via an HTTP request containing an escape sequence for a terminal emulator. cvss_v2: 7.5 patched_versions: -- ">= 1.4.0" + - ">= 1.4.0" related: url: - - https://nvd.nist.gov/vuln/detail/CVE-2009-4492 - - https://github.com/advisories/GHSA-6mq2-37j5-w6r6 - - http://www.redhat.com/support/errata/RHSA-2011-0908.html - - http://www.redhat.com/support/errata/RHSA-2011-0909.html - - http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection - - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt - - https://web.archive.org/web/20100113155532/http://www.vupen.com/english/advisories/2010/0089 - - https://web.archive.org/web/20100815010948/http://secunia.com/advisories/37949 - - https://web.archive.org/web/20170402100552/http://securitytracker.com/id?1023429 - - https://web.archive.org/web/20170908140655/http://www.securityfocus.com/archive/1/508830/100/0/threaded - - https://web.archive.org/web/20200228145937/http://www.securityfocus.com/bid/37710 + - https://nvd.nist.gov/vuln/detail/CVE-2009-4492 + - https://github.com/advisories/GHSA-6mq2-37j5-w6r6 + - http://www.redhat.com/support/errata/RHSA-2011-0908.html + - http://www.redhat.com/support/errata/RHSA-2011-0909.html + - http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection + - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt + - https://web.archive.org/web/20100113155532/http://www.vupen.com/english/advisories/2010/0089 + - https://web.archive.org/web/20100815010948/http://secunia.com/advisories/37949 + - https://web.archive.org/web/20170402100552/http://securitytracker.com/id?1023429 + - https://web.archive.org/web/20170908140655/http://www.securityfocus.com/archive/1/508830/100/0/threaded + - https://web.archive.org/web/20200228145937/http://www.securityfocus.com/bid/37710 From 8430608f6140ed4a1030dab8595b47e995869e0b Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Thu, 26 Mar 2026 14:15:11 -0400 Subject: [PATCH 2/2] Unfixed indentation. --- gems/commonmarker/CVE-2024-22051.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gems/commonmarker/CVE-2024-22051.yml b/gems/commonmarker/CVE-2024-22051.yml index ba4089e85f..b821fd013a 100644 --- a/gems/commonmarker/CVE-2024-22051.yml +++ b/gems/commonmarker/CVE-2024-22051.yml @@ -35,7 +35,7 @@ description: | ### References - - https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x + - https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x ### Acknowledgements