diff --git a/Gemfile b/Gemfile index b547f12aa6..a05e730aaa 100644 --- a/Gemfile +++ b/Gemfile @@ -5,6 +5,7 @@ gem 'faraday', '~> 2.0' gem 'kwalify', '~> 0.1' gem 'json_schemer', '~> 2.0' gem 'rspec', '~> 3.0' +gem 'base64' group :development do gem 'pry' diff --git a/gems/resolv/CVE-2026-80212.yml b/gems/resolv/CVE-2026-80212.yml index 5a99ef862b..2862c0c3e5 100644 --- a/gems/resolv/CVE-2026-80212.yml +++ b/gems/resolv/CVE-2026-80212.yml @@ -1,6 +1,7 @@ --- gem: resolv cve: 2026-80212 +ghsa: x2vh-ff4w-v64c url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-80212 title: CVE-2026-80212 - Memory exhaustion through malicious DNS responses date: 2026-08-27 @@ -15,11 +16,13 @@ description: | ## Credits Thanks to dalifit for discovering these issues. +cvss_v3: 7.5 patched_versions: - "~> 0.3.2" - ">= 0.7.2" related: url: + - https://nvd.nist.gov/vuln/detail/cve-2026-80212 - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-80212 - https://rubygems.org/gems/resolv/versions/0.7.2 - https://github.com/ruby/resolv/releases/tag/v0.7.2 @@ -27,9 +30,9 @@ related: - https://github.com/ruby/resolv/releases/tag/v0.3.2 - https://www.ruby-lang.org/en/security - https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv + - https://github.com/advisories/GHSA-x2vh-ff4w-v64c notes: | - - CVE is reserved, but not published. - - No GHSA values and no cvss values + - GHSA from nvd.nist.gov URL. - Text from "multiple-vulnerabilities-in-resolv" URL - "Affected versions - resolv gem 0.4.0 through 0.7.1 diff --git a/gems/resolv/CVE-2026-80213.yml b/gems/resolv/CVE-2026-80213.yml index 565bf45669..d1585e72ca 100644 --- a/gems/resolv/CVE-2026-80213.yml +++ b/gems/resolv/CVE-2026-80213.yml @@ -1,6 +1,7 @@ --- gem: resolv cve: 2026-80213 +ghsa: jr95-x3fr-rcg4 url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-80213 title: CVE-2026-80213 - Hostname validation bypass date: 2026-08-27 @@ -17,11 +18,13 @@ description: | ## Credits Thanks to dalifit for discovering these issues. +cvss_v3: 4.0 patched_versions: - "~> 0.3.2" - ">= 0.7.2" related: url: + - https://nvd.nist.gov/vuln/detail/cve-2026-80213 - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-80213 - https://rubygems.org/gems/resolv/versions/0.7.2 - https://github.com/ruby/resolv/releases/tag/v0.7.2 @@ -29,9 +32,9 @@ related: - https://github.com/ruby/resolv/releases/tag/v0.3.2 - https://www.ruby-lang.org/en/security - https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv + - https://github.com/advisories/GHSA-jr95-x3fr-rcg4 notes: | - - CVE is reserved, but not published. - - No GHSA values and no cvss values + - cvss_v3 from nvd.nist.gov URL. - Text from "multiple-vulnerabilities-in-resolv" URL - "Affected versions - resolv gem 0.4.0 through 0.7.1 diff --git a/lib/rad-ignores.sh b/lib/rad-ignores.sh index 4d962bd10f..d71dfd037b 100755 --- a/lib/rad-ignores.sh +++ b/lib/rad-ignores.sh @@ -298,3 +298,6 @@ rm -f gems/nokogiri/CVE-2026-79772.yml # nokogiri | https://github.com/advisories/GHSA-rh9x-7xjc-vwx2 (duplicate) # paperclip | https://github.com/advisories/GHSA-phmw-pv3f-vvx7 (withdrawn) # sprockets | https://github.com/advisories/GHSA-r4x3-g983-9g48 (withdrawn) + +# 9/9/2026: +# Rubygmems | https://github.com/advisories/GHSA-mq4m-44x6-6r2v (not a gem)