From 9fa7c593baa6f2d639f7211598d47376bff0986a Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Wed, 9 Sep 2026 12:18:03 -0400 Subject: [PATCH 1/2] One new and 2 updated advisories; 1 added to rad-ignores.sh script; one gem added to Gemfile --- Gemfile | 1 + gems/resolv/CVE-2026-80212.yml | 7 +++++-- gems/resolv/CVE-2026-80213.yml | 7 +++++-- lib/rad-ignores.sh | 3 +++ rubies/mruby/CVE-2022-4996.yml | 33 +++++++++++++++++++++++++++++++++ 5 files changed, 47 insertions(+), 4 deletions(-) create mode 100644 rubies/mruby/CVE-2022-4996.yml diff --git a/Gemfile b/Gemfile index b547f12aa6..a05e730aaa 100644 --- a/Gemfile +++ b/Gemfile @@ -5,6 +5,7 @@ gem 'faraday', '~> 2.0' gem 'kwalify', '~> 0.1' gem 'json_schemer', '~> 2.0' gem 'rspec', '~> 3.0' +gem 'base64' group :development do gem 'pry' diff --git a/gems/resolv/CVE-2026-80212.yml b/gems/resolv/CVE-2026-80212.yml index 5a99ef862b..2862c0c3e5 100644 --- a/gems/resolv/CVE-2026-80212.yml +++ b/gems/resolv/CVE-2026-80212.yml @@ -1,6 +1,7 @@ --- gem: resolv cve: 2026-80212 +ghsa: x2vh-ff4w-v64c url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-80212 title: CVE-2026-80212 - Memory exhaustion through malicious DNS responses date: 2026-08-27 @@ -15,11 +16,13 @@ description: | ## Credits Thanks to dalifit for discovering these issues. +cvss_v3: 7.5 patched_versions: - "~> 0.3.2" - ">= 0.7.2" related: url: + - https://nvd.nist.gov/vuln/detail/cve-2026-80212 - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-80212 - https://rubygems.org/gems/resolv/versions/0.7.2 - https://github.com/ruby/resolv/releases/tag/v0.7.2 @@ -27,9 +30,9 @@ related: - https://github.com/ruby/resolv/releases/tag/v0.3.2 - https://www.ruby-lang.org/en/security - https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv + - https://github.com/advisories/GHSA-x2vh-ff4w-v64c notes: | - - CVE is reserved, but not published. - - No GHSA values and no cvss values + - GHSA from nvd.nist.gov URL. - Text from "multiple-vulnerabilities-in-resolv" URL - "Affected versions - resolv gem 0.4.0 through 0.7.1 diff --git a/gems/resolv/CVE-2026-80213.yml b/gems/resolv/CVE-2026-80213.yml index 565bf45669..d1585e72ca 100644 --- a/gems/resolv/CVE-2026-80213.yml +++ b/gems/resolv/CVE-2026-80213.yml @@ -1,6 +1,7 @@ --- gem: resolv cve: 2026-80213 +ghsa: jr95-x3fr-rcg4 url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-80213 title: CVE-2026-80213 - Hostname validation bypass date: 2026-08-27 @@ -17,11 +18,13 @@ description: | ## Credits Thanks to dalifit for discovering these issues. +cvss_v3: 4.0 patched_versions: - "~> 0.3.2" - ">= 0.7.2" related: url: + - https://nvd.nist.gov/vuln/detail/cve-2026-80213 - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-80213 - https://rubygems.org/gems/resolv/versions/0.7.2 - https://github.com/ruby/resolv/releases/tag/v0.7.2 @@ -29,9 +32,9 @@ related: - https://github.com/ruby/resolv/releases/tag/v0.3.2 - https://www.ruby-lang.org/en/security - https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv + - https://github.com/advisories/GHSA-jr95-x3fr-rcg4 notes: | - - CVE is reserved, but not published. - - No GHSA values and no cvss values + - cvss_v3 from nvd.nist.gov URL. - Text from "multiple-vulnerabilities-in-resolv" URL - "Affected versions - resolv gem 0.4.0 through 0.7.1 diff --git a/lib/rad-ignores.sh b/lib/rad-ignores.sh index 4d962bd10f..d71dfd037b 100755 --- a/lib/rad-ignores.sh +++ b/lib/rad-ignores.sh @@ -298,3 +298,6 @@ rm -f gems/nokogiri/CVE-2026-79772.yml # nokogiri | https://github.com/advisories/GHSA-rh9x-7xjc-vwx2 (duplicate) # paperclip | https://github.com/advisories/GHSA-phmw-pv3f-vvx7 (withdrawn) # sprockets | https://github.com/advisories/GHSA-r4x3-g983-9g48 (withdrawn) + +# 9/9/2026: +# Rubygmems | https://github.com/advisories/GHSA-mq4m-44x6-6r2v (not a gem) diff --git a/rubies/mruby/CVE-2022-4996.yml b/rubies/mruby/CVE-2022-4996.yml new file mode 100644 index 0000000000..4d18207216 --- /dev/null +++ b/rubies/mruby/CVE-2022-4996.yml @@ -0,0 +1,33 @@ +--- +engine: mruby +cve: 2022-4996 +ghsa: rm4w-cfgf-329j +url: https://nvd.nist.gov/vuln/detail/CVE-2022-4996 +title: bigint.c udiv floating point comparison with incorrect operator +date: 2026-08-20 +description: | + A flaw has been found in mruby 3.1.0. Affected is the function udiv + of the file bigint.c. Executing a manipulation can lead to floating + point comparison with incorrect operator. It is possible to launch + the attack remotely. The exploit has been published and may be + used. It is best practice to apply a patch to resolve this issue. +cvss_v2: 5.0 +cvss_v3: 5.3 +cvss_v4: 5.5 +patched_versions: + - ">= 3.2.0" +related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2022-4996 + - https://github.com/mruby/mruby + - https://huntr.com/bounties/5a5092df-1699-4497-a8b2-38318bce0c4e + - https://vuldb.com/cve/CVE-2022-4996 + - https://vuldb.com/submit/877513 + - https://vuldb.com/vuln/391391 + - https://vuldb.com/vuln/391391/cti + - https://github.com/advisories/GHSA-rm4w-cfgf-329j +notes: | + - cvss_v[345] and date from nvd.nist.gov URL. + - huntr URL: commit : b83285697888abbcb2286462da070d49f413ab24 + - Used "git tag --contains b83285697888abbcb2286462da070d49f413ab24" + to find release version on https://github.com/mruby/mruby. From 76c7ce0819b042f05f02aa967828608f6dcc516b Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Thu, 10 Sep 2026 10:09:12 -0400 Subject: [PATCH 2/2] Delete rubies/mruby/CVE-2022-4996.yml --- rubies/mruby/CVE-2022-4996.yml | 33 --------------------------------- 1 file changed, 33 deletions(-) delete mode 100644 rubies/mruby/CVE-2022-4996.yml diff --git a/rubies/mruby/CVE-2022-4996.yml b/rubies/mruby/CVE-2022-4996.yml deleted file mode 100644 index 4d18207216..0000000000 --- a/rubies/mruby/CVE-2022-4996.yml +++ /dev/null @@ -1,33 +0,0 @@ ---- -engine: mruby -cve: 2022-4996 -ghsa: rm4w-cfgf-329j -url: https://nvd.nist.gov/vuln/detail/CVE-2022-4996 -title: bigint.c udiv floating point comparison with incorrect operator -date: 2026-08-20 -description: | - A flaw has been found in mruby 3.1.0. Affected is the function udiv - of the file bigint.c. Executing a manipulation can lead to floating - point comparison with incorrect operator. It is possible to launch - the attack remotely. The exploit has been published and may be - used. It is best practice to apply a patch to resolve this issue. -cvss_v2: 5.0 -cvss_v3: 5.3 -cvss_v4: 5.5 -patched_versions: - - ">= 3.2.0" -related: - url: - - https://nvd.nist.gov/vuln/detail/CVE-2022-4996 - - https://github.com/mruby/mruby - - https://huntr.com/bounties/5a5092df-1699-4497-a8b2-38318bce0c4e - - https://vuldb.com/cve/CVE-2022-4996 - - https://vuldb.com/submit/877513 - - https://vuldb.com/vuln/391391 - - https://vuldb.com/vuln/391391/cti - - https://github.com/advisories/GHSA-rm4w-cfgf-329j -notes: | - - cvss_v[345] and date from nvd.nist.gov URL. - - huntr URL: commit : b83285697888abbcb2286462da070d49f413ab24 - - Used "git tag --contains b83285697888abbcb2286462da070d49f413ab24" - to find release version on https://github.com/mruby/mruby.