Skip to content

Commit 78dba7b

Browse files
sudoremosudoremo
committed
GHSA SYNC: 10 brand new advisories
1 parent e7530e9 commit 78dba7b

File tree

10 files changed

+347
-0
lines changed

10 files changed

+347
-0
lines changed

‎gems/Autolab/CVE-2024-49376.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
gem: Autolab
3+
cve: 2024-49376
4+
ghsa: v46j-h43h-rwrm
5+
url: https://github.com/autolab/Autolab/security/advisories/GHSA-v46j-h43h-rwrm
6+
title: Autolab Misconfigured Reset Password Permissions
7+
date: 2024-10-25
8+
description: |
9+
### Impact
10+
For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords.
11+
12+
### Patches
13+
This is fixed in v3.0.1.
14+
15+
### Workarounds
16+
No workarounds.
17+
18+
### For more information
19+
If you have any questions or comments about this advisory:
20+
21+
Open an issue in https://github.com/autolab/Autolab/
22+
Email us at [autolab-dev@andrew.cmu.edu](mailto:autolab-dev@andrew.cmu.edu)
23+
cvss_v3: 8.8
24+
unaffected_versions:
25+
- "< 3.0.0"
26+
patched_versions:
27+
- ">= 3.0.1"
28+
related:
29+
url:
30+
- https://github.com/autolab/Autolab/security/advisories/GHSA-v46j-h43h-rwrm
31+
- https://nvd.nist.gov/vuln/detail/CVE-2024-49376
32+
- https://github.com/autolab/Autolab/commit/301689ab5c5e39d13bab47b71eaf8998d04bcc9b
33+
- https://github.com/advisories/GHSA-v46j-h43h-rwrm

‎gems/nokogiri/GHSA-fq42-c5rg-92c2.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
gem: nokogiri
3+
ghsa: fq42-c5rg-92c2
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2
5+
title: Vulnerable dependencies in Nokogiri
6+
date: 2022-02-25
7+
description: |
8+
### Summary
9+
10+
Nokogiri [v1.13.2](https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.2) upgrades two of its packaged dependencies:
11+
12+
- vendored libxml2 from v2.9.12 to [v2.9.13](https://download.gnome.org/sources/libxml2/2.9/libxml2-2.9.13.news)
13+
- vendored libxslt from v1.1.34 to [v1.1.35](https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.35.news)
14+
15+
Those library versions address the following upstream CVEs:
16+
17+
- libxslt: [CVE-2021-30560](https://nvd.nist.gov/vuln/detail/CVE-2021-30560) (CVSS 8.8, High severity)
18+
- libxml2: [CVE-2022-23308](https://nvd.nist.gov/vuln/detail/CVE-2022-23308) (Unspecified severity, see more information below)
19+
20+
Those library versions also address numerous other issues including performance improvements, regression fixes, and bug fixes, as well as memory leaks and other use-after-free issues that were not assigned CVEs.
21+
22+
Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.13.2`, and only if the _packaged_ libraries are being used. If you've overridden defaults at installation time to use _system_ libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` and `libxslt` release announcements.
23+
24+
25+
### Mitigation
26+
27+
Upgrade to Nokogiri `>= 1.13.2`.
28+
29+
Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link an older version Nokogiri against external libraries libxml2 `>= 2.9.13` and libxslt `>= 1.1.35`, which will also address these same CVEs.
30+
31+
32+
### Impact
33+
34+
#### libxslt [CVE-2021-30560](https://nvd.nist.gov/vuln/detail/CVE-2021-30560)
35+
36+
- CVSS3 score: 8.8 (High)
37+
- Fixed by https://gitlab.gnome.org/GNOME/libxslt/-/commit/50f9c9c
38+
39+
All versions of libxslt prior to v1.1.35 are affected.
40+
41+
Applications using **untrusted** XSL stylesheets to transform XML are vulnerable to a denial-of-service attack and should be upgraded immediately.
42+
43+
44+
#### libxml2 [CVE-2022-23308](https://nvd.nist.gov/vuln/detail/CVE-2022-23308)
45+
46+
- As of the time this security advisory was published, there is no officially published information available about this CVE's severity. The above NIST link does not yet have a published record, and the libxml2 maintainer has declined to provide a severity score.
47+
- Fixed by https://gitlab.gnome.org/GNOME/libxml2/-/commit/652dd12
48+
- Further explanation is at https://mail.gnome.org/archives/xml/2022-February/msg00015.html
49+
50+
The upstream commit and the explanation linked above indicate that an application may be vulnerable to a denial of service, memory disclosure, or code execution if it parses an **untrusted** document with parse options `DTDVALID` set to true, and `NOENT` set to false.
51+
52+
An analysis of these parse options:
53+
54+
- While `NOENT` is off by default for Document, DocumentFragment, Reader, and Schema parsing, it is on by default for XSLT (stylesheet) parsing in Nokogiri v1.12.0 and later.
55+
- `DTDVALID` is an option that Nokogiri does not set for any operations, and so this CVE applies only to applications setting this option explicitly.
56+
57+
It seems reasonable to assume that any application explicitly setting the parse option `DTDVALID` when parsing **untrusted** documents is vulnerable and should be upgraded immediately.
58+
patched_versions:
59+
- ">= 1.13.2"
60+
related:
61+
url:
62+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2
63+
- https://github.com/advisories/GHSA-fq42-c5rg-92c2

‎gems/nokogiri/GHSA-gx8x-g87m-h5q6.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
gem: nokogiri
3+
ghsa: gx8x-g87m-h5q6
4+
url: https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv
5+
title: Denial of Service (DoS) in Nokogiri on JRuby
6+
date: 2022-04-11
7+
description: |
8+
## Summary
9+
10+
Nokogiri `v1.13.4` updates the vendored `org.cyberneko.html` library to `1.9.22.noko2` which addresses [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv). That CVE is rated 7.5 (High Severity).
11+
12+
See [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) for more information.
13+
14+
Please note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.
15+
16+
17+
## Mitigation
18+
19+
Upgrade to Nokogiri `>= 1.13.4`.
20+
21+
22+
## Impact
23+
24+
### [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) in nekohtml
25+
26+
- **Severity**: High 7.5
27+
- **Type**: [CWE-400](https://cwe.mitre.org/data/definitions/400.html) Uncontrolled Resource Consumption
28+
- **Description**: The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup.
29+
- **See also**: [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv)
30+
cvss_v3: 7.5
31+
patched_versions:
32+
- ">= 1.13.4"
33+
related:
34+
url:
35+
- https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv
36+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-gx8x-g87m-h5q6
37+
- https://nvd.nist.gov/vuln/detail/CVE-2022-24839
38+
- https://github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773d
39+
- https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
40+
- https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer
41+
- https://github.com/advisories/GHSA-gx8x-g87m-h5q6

‎gems/nokogiri/GHSA-v6gp-9mmm-c6p5.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
gem: nokogiri
3+
ghsa: v6gp-9mmm-c6p5
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5
5+
title: Out-of-bounds Write in zlib affects Nokogiri
6+
date: 2022-04-11
7+
description: "## Summary\n\nNokogiri v1.13.4 updates the vendored zlib from 1.2.11
8+
to 1.2.12, which addresses [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032).
9+
That CVE is scored as CVSS 7.4 \"High\" on the NVD record as of 2022-04-05.\n\nPlease
10+
note that this advisory only applies to the CRuby implementation of Nokogiri `<
11+
1.13.4`, and only if the packaged version of `zlib` is being used. Please see [this
12+
document](https://nokogiri.org/LICENSE-DEPENDENCIES.html#default-platform-release-ruby)
13+
for a complete description of which platform gems vendor `zlib`. If you've overridden
14+
defaults at installation time to use system libraries instead of packaged libraries,
15+
you should instead pay attention to your distro's `zlib` release announcements.
16+
\n\n## Mitigation\n\nUpgrade to Nokogiri `>= v1.13.4`.\n\n## Impact\n\n### [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032)
17+
in zlib\n\n- **Severity**: High\n- **Type**: [CWE-787](https://cwe.mitre.org/data/definitions/787.html)
18+
Out of bounds write\n- **Description**: zlib before 1.2.12 allows memory corruption
19+
when deflating (i.e., when compressing) if the input has many distant matches.\n\n"
20+
cvss_v3: 7.5
21+
patched_versions:
22+
- ">= 1.13.4"
23+
related:
24+
url:
25+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5
26+
- https://nvd.nist.gov/vuln/detail/CVE-2018-25032
27+
- https://github.com/advisories/GHSA-jc36-42cf-vqwj
28+
- https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
29+
- https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer
30+
- https://github.com/advisories/GHSA-v6gp-9mmm-c6p5

‎gems/nokogiri/GHSA-xxx9-3xcr-gjj3.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
gem: nokogiri
3+
ghsa: xxx9-3xcr-gjj3
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xxx9-3xcr-gjj3
5+
title: XML Injection in Xerces Java affects Nokogiri
6+
date: 2022-04-11
7+
description: |+
8+
## Summary
9+
10+
Nokogiri v1.13.4 updates the vendored `xerces:xercesImpl` from 2.12.0 to 2.12.2, which addresses [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437). That CVE is scored as CVSS 6.5 "Medium" on the NVD record.
11+
12+
Please note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.
13+
14+
## Mitigation
15+
16+
Upgrade to Nokogiri `>= v1.13.4`.
17+
18+
## Impact
19+
20+
### [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437) in xerces-J
21+
22+
- **Severity**: Medium
23+
- **Type**: [CWE-91](https://cwe.mitre.org/data/definitions/91.html) XML Injection (aka Blind XPath Injection)
24+
- **Description**: There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
25+
- **See also**: https://github.com/advisories/GHSA-h65f-jvqw-m9fj
26+
27+
cvss_v3: 6.5
28+
patched_versions:
29+
- ">= 1.13.4"
30+
related:
31+
url:
32+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xxx9-3xcr-gjj3
33+
- https://nvd.nist.gov/vuln/detail/CVE-2022-23437
34+
- https://github.com/advisories/GHSA-h65f-jvqw-m9fj
35+
- https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
36+
- https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer
37+
- https://github.com/advisories/GHSA-xxx9-3xcr-gjj3

‎gems/omniauth-saml/GHSA-cvp8-5r8g-fhvq.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
gem: omniauth-saml
3+
ghsa: cvp8-5r8g-fhvq
4+
url: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
5+
title: omniauth-saml vulnerable to Improper Verification of Cryptographic Signature
6+
date: 2024-09-11
7+
description: "ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping
8+
vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
9+
\nAs a result, omniauth-saml created a [new release](https://github.com/omniauth/omniauth-saml/releases)
10+
by upgrading ruby-saml to the patched versions v1.17. \n"
11+
cvss_v3: 10.0
12+
patched_versions:
13+
- "~> 1.10.5"
14+
- "~> 2.1.2"
15+
- ">= 2.2.1"
16+
related:
17+
url:
18+
- https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
19+
- https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq
20+
- https://github.com/omniauth/omniauth-saml/commit/4274e9d57e65f2dcaae4aa3b2accf831494f2ddd
21+
- https://github.com/omniauth/omniauth-saml/commit/6c681fd082ab3daf271821897a40ab3417382e29
22+
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/GHSA-cvp8-5r8g-fhvq.yml
23+
- https://github.com/advisories/GHSA-cvp8-5r8g-fhvq

‎gems/rails/CVE-2024-26143.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
---
2+
gem: rails
3+
cve: 2024-26143
4+
ghsa: 9822-6m93-xqf4
5+
url: https://github.com/rails/rails/security/advisories/GHSA-9822-6m93-xqf4
6+
title: Rails has possible XSS Vulnerability in Action Controller
7+
date: 2024-02-27
8+
description: "# Possible XSS Vulnerability in Action Controller\n\nThere is a possible
9+
XSS vulnerability when using the translation helpers\n(`translate`, `t`, etc) in
10+
Action Controller. This vulnerability has been\nassigned the CVE identifier CVE-2024-26143.\n\nVersions
11+
Affected: >= 7.0.0.\nNot affected: < 7.0.0\nFixed Versions: 7.1.3.1,
12+
7.0.8.1\n\nImpact\n------\nApplications using translation methods like `translate`,
13+
or `t` on a\ncontroller, with a key ending in \"_html\", a `:default` key which
14+
contains\nuntrusted user input, and the resulting string is used in a view, may
15+
be\nsusceptible to an XSS vulnerability.\n\nFor example, impacted code will look
16+
something like this:\n\n```ruby\nclass ArticlesController < ApplicationController\n
17+
\ def show \n @message = t(\"message_html\", default: untrusted_input)\n #
18+
The `show` template displays the contents of `@message`\n end\nend\n```\n\nTo reiterate
19+
the pre-conditions, applications must:\n\n* Use a translation function from a controller
20+
(i.e. _not_ I18n.t, or `t` from\n a view)\n* Use a key that ends in `_html`\n*
21+
Use a default value where the default value is untrusted and unescaped input\n*
22+
Send the text to the victim (whether that's part of a template, or a\n `render`
23+
call)\n\nAll users running an affected release should either upgrade or use one
24+
of the\nworkarounds immediately.\n\nReleases\n--------\nThe fixed releases are available
25+
at the normal locations.\n\nWorkarounds\n-----------\nThere are no feasible workarounds
26+
for this issue.\n\nPatches\n-------\nTo aid users who aren't able to upgrade immediately
27+
we have provided patches for\nthe two supported release series. They are in git-am
28+
format and consist of a\nsingle changeset.\n\n* 7-0-translate-xss.patch - Patch
29+
for 7.0 series\n* 7-1-translate-xss.patch - Patch for 7.1 series\n\nCredits\n-------\n\nThanks
30+
to [ooooooo_q](https://hackerone.com/ooooooo_q) for the patch and fix!"
31+
cvss_v3: 6.1
32+
unaffected_versions:
33+
- "< 7.0.0"
34+
patched_versions:
35+
- "~> 7.0.8.1"
36+
- ">= 7.1.3.1"
37+
related:
38+
url:
39+
- https://github.com/rails/rails/security/advisories/GHSA-9822-6m93-xqf4
40+
- https://nvd.nist.gov/vuln/detail/CVE-2024-26143
41+
- https://github.com/rails/rails/commit/4c83b331092a79d58e4adffe4be5f250fa5782cc
42+
- https://github.com/rails/rails/commit/5187a9ef51980ad1b8e81945ebe0462d28f84f9e
43+
- https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947
44+
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26143.yml
45+
- https://security.netapp.com/advisory/ntap-20240510-0004
46+
- https://github.com/advisories/GHSA-9822-6m93-xqf4

‎gems/ruby-saml/CVE-2025-66567.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
gem: ruby-saml
3+
cve: 2025-66567
4+
ghsa: 9v8j-x534-2fx3
5+
url: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-9v8j-x534-2fx3
6+
title: Ruby-saml has a SAML authentication bypass due to namespace handling (parser
7+
differential)
8+
date: 2025-12-08
9+
description: |-
10+
### Summary
11+
12+
Ruby-saml up to and including 1.12.4, there is an authentication bypass vulnerability because of an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. The vulnerability does not affect the version 1.18.0.
13+
14+
### Impact
15+
That allows an attacker to be able to execute a Signature Wrapping attack and bypass the authentication
16+
patched_versions:
17+
- ">= 1.18.0"
18+
related:
19+
url:
20+
- https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-9v8j-x534-2fx3
21+
- https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97
22+
- https://github.com/advisories/GHSA-754f-8gm6-c4r2
23+
- https://github.com/advisories/GHSA-9v8j-x534-2fx3

‎gems/ruby-saml/CVE-2025-66568.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
gem: ruby-saml
3+
cve: 2025-66568
4+
ghsa: x4h9-gwv3-r4m4
5+
url: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-x4h9-gwv3-r4m4
6+
title: Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature
7+
validation
8+
date: 2025-12-08
9+
description: |-
10+
### Summary
11+
Ruby-saml up to and including 1.12.4, there is an authentication bypass vulnerability because of an issue at libxml2 canonicalization process used by Nokogiri for document transformation. That allows an attacker to be able to execute a Signature Wrapping attack. The vulnerability does not affect the version 1.18.0.
12+
13+
### Details
14+
When libxml2’s canonicalization is invoked on an invalid XML input, it may return an empty string rather than a canonicalized node. ruby-saml then proceeds to compute the DigestValue over this empty string, treating it as if canonicalization succeeded.
15+
16+
### Impact
17+
1. Digest bypass: By crafting input that causes canonicalization to yield an empty string, the attacker can manipulate validation to pass incorrectly.
18+
19+
2. Signature replay on empty canonical form: If an empty string has been signed once (e.g., in a prior interaction or via a misconfigured flow), that signature can potentially be replayed to bypass authentication.
20+
patched_versions:
21+
- ">= 1.18.0"
22+
related:
23+
url:
24+
- https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-x4h9-gwv3-r4m4
25+
- https://github.com/SAML-Toolkits/ruby-saml/commit/acac9e9cc0b9a507882c614f25d41f8b47be349a
26+
- https://github.com/advisories/GHSA-x4h9-gwv3-r4m4

‎gems/user_agent_parser/GHSA-pcqq-5962-hvcw.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
gem: user_agent_parser
3+
ghsa: pcqq-5962-hvcw
4+
url: https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw
5+
title: Denial of Service in uap-core when processing crafted User-Agent strings
6+
date: 2020-03-10
7+
description: |-
8+
### Impact
9+
Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.
10+
11+
### Patches
12+
Please update `uap-ruby` to &gt;= v2.6.0
13+
14+
### For more information
15+
https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p
16+
17+
Reported in `uap-core` by Ben Caller @bcaller
18+
patched_versions:
19+
- ">= 2.6.0"
20+
related:
21+
url:
22+
- https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw
23+
- https://github.com/ua-parser/uap-ruby/commit/2bb18268f4c5ba7d4ba0e21c296bf6437063da3a
24+
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/user_agent_parser/GHSA-pcqq-5962-hvcw.yml
25+
- https://github.com/advisories/GHSA-pcqq-5962-hvcw

0 commit comments

Comments
 (0)