From 13fe64ce6d89e534be88942e415e27045607f9ef Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Sat, 24 Oct 2026 18:24:38 -0400 Subject: [PATCH 1/5] New advisories for [datadog, mcp, sanitize, savon] gems --- gems/datadog/GHSA-p7cx-x3jr-jj6w.yml | 37 ++++++++++++++++++++ gems/mcp/GHSA-4m5j-jjfc-97gx.yml | 49 +++++++++++++++++++++++++++ gems/sanitize/GHSA-wgw9-qhqg-8hv5.yml | 46 +++++++++++++++++++++++++ gems/savon/GHSA-x99v-rwvj-g9p5.yml | 39 +++++++++++++++++++++ 4 files changed, 171 insertions(+) create mode 100644 gems/datadog/GHSA-p7cx-x3jr-jj6w.yml create mode 100644 gems/mcp/GHSA-4m5j-jjfc-97gx.yml create mode 100644 gems/sanitize/GHSA-wgw9-qhqg-8hv5.yml create mode 100644 gems/savon/GHSA-x99v-rwvj-g9p5.yml diff --git a/gems/datadog/GHSA-p7cx-x3jr-jj6w.yml b/gems/datadog/GHSA-p7cx-x3jr-jj6w.yml new file mode 100644 index 0000000000..a3c067f2c5 --- /dev/null +++ b/gems/datadog/GHSA-p7cx-x3jr-jj6w.yml @@ -0,0 +1,37 @@ +--- +gem: datadog +ghsa: p7cx-x3jr-jj6w +url: https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p7cx-x3jr-jj6w +title: ReDOS in URL query string obfuscation +date: 2026-10-13 +description: | + ## SUMMARY + + A regular expression used to obfuscate URL query strings can consume + excessive CPU when processing certain attacker-controlled input. + This can stall request processing and cause denial of service in + applications using affected HTTP tracing integrations. + + ## Impact + + Regular expression denial of service (ReDoS) affecting applications + that process attacker-controlled URL query strings through the + vulnerable obfuscation pattern. Successful exploitation can cause + excessive CPU consumption, prolonged request latency, and service + unavailability. + + The vulnerable processing is enabled by default for affected HTTP + integrations that include query strings in URL span tags. +cvss_v4: 8.7 +patched_versions: + - ">= 2.45.0" +related: + url: + - https://rubygems.org/gems/datadog/versions/2.45.0 + - https://github.com/DataDog/dd-trace-rb/releases/tag/v2.45.0 + - https://github.com/DataDog/dd-trace-rb/pull/6441 + - https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p7cx-x3jr-jj6w +notes: | + - No CVE from GHSA URL. + - cvss_v4 from GHSA URL. + - date from rubygems.org URL. diff --git a/gems/mcp/GHSA-4m5j-jjfc-97gx.yml b/gems/mcp/GHSA-4m5j-jjfc-97gx.yml new file mode 100644 index 0000000000..67c224d201 --- /dev/null +++ b/gems/mcp/GHSA-4m5j-jjfc-97gx.yml @@ -0,0 +1,49 @@ +--- +gem: mcp +ghsa: 4m5j-jjfc-97gx +url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-4m5j-jjfc-97gx +title: OAuth discovery security check allows SSRF to private hosts over HTTPS +date: 2026-08-14 +description: | + ## SUMMARY + + The OAuth client validates the server-controlled resource_metadata + URL before fetching it, but the check only requires HTTPS. It does + not block private, link-local, or cloud-metadata addresses. + A server can return 401 WWW-Authenticate: Bearer + resource_metadata="https://169.254.169.254/..." or an internal HTTPS + URL, and the client issues a GET to it during discovery. This is a + server-side request forgery against internal HTTPS services and + cloud metadata endpoints from the client's network position. + + The check also reads only the dotted-decimal spelling of an address, + so the same destinations stay reachable through the numeric forms + the resolver accepts. + + ## Impact + + Server-side request forgery (CWE-918), limited to HTTPS targets. A + server the client connects to can make the client send GET requests + to internal HTTPS services and cloud metadata endpoints it can route + to but the attacker cannot. The request fires automatically during + OAuth discovery, before the user approves anything. The response + is schema-validated, so this is closer to a blind SSRF than a direct + read of the target's body, but it still allows reaching internal + HTTPS services, probing reachability, and triggering GET-based side + effects. HTTP to non-loopback hosts is already blocked, so the gap + is specifically HTTPS to private and metadata addresses. + + A suggested fix is to extend the check so it also rejects URLs whose + host resolves to loopback, link-local, private, or cloud-metadata + ranges, and ideally require the URL to share an origin with the MCP + server. The scheme check alone does not prevent SSRF. +patched_versions: + - ">= 1.2.0" +related: + url: + - https://rubygems.org/gems/mcp/versions/1.2.0 + - https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v1.2.0 + - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-4m5j-jjfc-97gx +notes: | + - No CVE from GHSA URL. + - "moderate" severity on GHSA URL, but no cvss numbers. diff --git a/gems/sanitize/GHSA-wgw9-qhqg-8hv5.yml b/gems/sanitize/GHSA-wgw9-qhqg-8hv5.yml new file mode 100644 index 0000000000..4953350264 --- /dev/null +++ b/gems/sanitize/GHSA-wgw9-qhqg-8hv5.yml @@ -0,0 +1,46 @@ +--- +gem: sanitize +ghsa: wgw9-qhqg-8hv5 +url: https://github.com/rgrove/sanitize/security/advisories/GHSA-wgw9-qhqg-8hv5 +title: CSS property and URL allowlists can be bypassed via + CSS nesting in stylesheets +date: 2026-10-21 +description: | + ## SUMMARY + + When Sanitize is configured to allow