search

rubysec / ruby-advisory-db

A database of vulnerable Ruby Gems
https://rubysec.com
Other
1.02k stars 219 forks source link

Add missing rubies advisories, if any #184

Closed phillmv closed 9 years ago

phillmv commented 9 years ago

per #166, to quote @jeremyolliver from what I believe are the relevant comments:

I also found today some extra sources (http://www.cvedetails.com/version-list/7252/12215/1/Ruby-lang-Ruby.html), which may or may not be easier to categorize existing CVE information from, than the existing ruby-lang security page. I don't think it's an appropriate target for scraping, but it's at least easier to read for humans than other places I've seen.

In regards to other categories such as libs - rubygems of course stands out, though there are some oddities, with some things in stdlib like minitest (can't think of other examples right now) which are both packaged with ruby, and upgradeable as a gem. I expect any vulnerabilities in stdlib are going to be issued as CVE against a ruby-lang version - even if you can workaround by installing a newer gem instead of upgrading ruby.

jeremyolliver commented 9 years ago

The most recent CVE I can see in the recently merged dataset is (OSVDB-100113) CVE-2013-4164 dated 2013-11-22. Looks like there's only 7 new CVE's on https://www.ruby-lang.org/en/security/ to add at this point.

reedloden commented 9 years ago

Turns out to be quite a few more than 7. OSVDB is sorely lacking in staying on top of ruby vulns. http://www.cvedetails.com turned out to be super useful for tracking down vulns, and I even ran into a few that require more details...