From ded7dcd4cc3851023248bd40d6bc9873241dbec4 Mon Sep 17 00:00:00 2001 From: Jeremy Olliver Date: Wed, 23 Oct 2019 14:06:27 +1300 Subject: [PATCH 1/3] Add haml CVE-2017-1002201 --- gems/haml/CVE-2017-1002201.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 gems/haml/CVE-2017-1002201.yml diff --git a/gems/haml/CVE-2017-1002201.yml b/gems/haml/CVE-2017-1002201.yml new file mode 100644 index 0000000000..e27fb966cb --- /dev/null +++ b/gems/haml/CVE-2017-1002201.yml @@ -0,0 +1,19 @@ +--- +gem: haml +cve: 2017-1002201 +url: https://nvd.nist.gov/vuln/detail/CVE-2017-1002201 +title: haml failure to escape single quotes +date: 2017-05-08 +description: | + In haml versions prior to version 5.0.0.beta.2, when using user input to + perform tasks on the server, characters like < > " ' must be escaped properly. + In this case, the ' character was missed. An attacker can manipulate the input + to introduce additional attributes, potentially executing code. +cvss_v2: 4.3 +patched_versions: + - ">= 5.0.0.beta.2" + +related: + url: + - https://github.com/haml/haml/commit/18576ae6e9bdcb4303fdbe6b3199869d289d67c2 + - https://snyk.io/vuln/SNYK-RUBY-HAML-20362 From 4100a6962c319c35b2e8352f30f50a8db8d94ef3 Mon Sep 17 00:00:00 2001 From: Jeremy Olliver Date: Wed, 23 Oct 2019 14:13:07 +1300 Subject: [PATCH 2/3] Add cvss_v3 to CVE-2017-1002201 --- gems/haml/CVE-2017-1002201.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/gems/haml/CVE-2017-1002201.yml b/gems/haml/CVE-2017-1002201.yml index e27fb966cb..0d18273ac0 100644 --- a/gems/haml/CVE-2017-1002201.yml +++ b/gems/haml/CVE-2017-1002201.yml @@ -10,6 +10,7 @@ description: | In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code. cvss_v2: 4.3 +cvss_v3: 6.1 patched_versions: - ">= 5.0.0.beta.2" From d529e86a0ab9e27773af65209026a093e931188f Mon Sep 17 00:00:00 2001 From: Reed Loden Date: Wed, 23 Oct 2019 19:44:14 -0700 Subject: [PATCH 3/3] Update CVE-2017-1002201.yml --- gems/haml/CVE-2017-1002201.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/gems/haml/CVE-2017-1002201.yml b/gems/haml/CVE-2017-1002201.yml index 0d18273ac0..1842fdd4dc 100644 --- a/gems/haml/CVE-2017-1002201.yml +++ b/gems/haml/CVE-2017-1002201.yml @@ -1,7 +1,7 @@ --- gem: haml cve: 2017-1002201 -url: https://nvd.nist.gov/vuln/detail/CVE-2017-1002201 +url: https://github.com/haml/haml/commit/18576ae6e9bdcb4303fdbe6b3199869d289d67c2 title: haml failure to escape single quotes date: 2017-05-08 description: | @@ -16,5 +16,4 @@ patched_versions: related: url: - - https://github.com/haml/haml/commit/18576ae6e9bdcb4303fdbe6b3199869d289d67c2 - https://snyk.io/vuln/SNYK-RUBY-HAML-20362