diff --git a/ruby-advisory-db b/ruby-advisory-db index f5322e45..ddc713a1 160000 --- a/ruby-advisory-db +++ b/ruby-advisory-db @@ -1 +1 @@ -Subproject commit f5322e451d085f3e9f28b441fe6af09e25b8f860 +Subproject commit ddc713a13139eec4a881e3d246678f234c23324d diff --git a/source/_posts/2012-01-01-CVE-2012-6134.markdown b/source/_posts/2012-09-08-CVE-2012-6134.markdown similarity index 81% rename from source/_posts/2012-01-01-CVE-2012-6134.markdown rename to source/_posts/2012-09-08-CVE-2012-6134.markdown index 3972be97..ef46eb4e 100644 --- a/source/_posts/2012-01-01-CVE-2012-6134.markdown +++ b/source/_posts/2012-09-08-CVE-2012-6134.markdown @@ -1,14 +1,14 @@ --- layout: post title: "CVE-2012-6134: Ruby on Rails omniauth-oauth2 Gem CSRF vulnerability" -date: 2012-01-01 +date: 2012-09-08 comments: false categories: [omniauth-oauth2] --- ### CVE ID -* [CVE-2012-6134](https://github.com/intridea/omniauth-oauth2/pull/25) +* [CVE-2012-6134](http://www.osvdb.org/show/osvdb/90264) ### GEM NAME diff --git a/source/_posts/2013-01-01-CVE-2013-0284.markdown b/source/_posts/2012-12-06-CVE-2013-0284.markdown similarity index 82% rename from source/_posts/2013-01-01-CVE-2013-0284.markdown rename to source/_posts/2012-12-06-CVE-2013-0284.markdown index b0c76852..0607e672 100644 --- a/source/_posts/2013-01-01-CVE-2013-0284.markdown +++ b/source/_posts/2012-12-06-CVE-2013-0284.markdown @@ -1,14 +1,14 @@ --- layout: post title: "CVE-2013-0284: Ruby on Rails newrelic_rpm Gem Discloses Sensitive Information" -date: 2013-01-01 +date: 2012-12-06 comments: false categories: [newrelic_rpm] --- ### CVE ID -* [CVE-2013-0284](https://newrelic.com/docs/ruby/ruby-agent-security-notification) +* [CVE-2013-0284](http://osvdb.org/show/osvdb/90189) ### GEM NAME diff --git a/source/_posts/2013-01-01-CVE-2013-0285.markdown b/source/_posts/2013-01-10-CVE-2013-0285.markdown similarity index 79% rename from source/_posts/2013-01-01-CVE-2013-0285.markdown rename to source/_posts/2013-01-10-CVE-2013-0285.markdown index f7af483e..2c76976e 100644 --- a/source/_posts/2013-01-01-CVE-2013-0285.markdown +++ b/source/_posts/2013-01-10-CVE-2013-0285.markdown @@ -1,14 +1,14 @@ --- layout: post title: "CVE-2013-0285: Ruby Gem nori Parameter Parsing Remote Code Execution" -date: 2013-01-01 +date: 2013-01-10 comments: false categories: [nori] --- ### CVE ID -* [CVE-2013-0285](https://github.com/savonrb/nori/commit/818f5263b1d597b603d46cbe1702cd2717259e32) +* [CVE-2013-0285](http://osvdb.org/show/osvdb/90196) ### GEM NAME diff --git a/source/_posts/2013-01-01-CVE-2013-1756.markdown b/source/_posts/2013-02-19-CVE-2013-1756.markdown similarity index 95% rename from source/_posts/2013-01-01-CVE-2013-1756.markdown rename to source/_posts/2013-02-19-CVE-2013-1756.markdown index 8990de18..083a52fc 100644 --- a/source/_posts/2013-01-01-CVE-2013-1756.markdown +++ b/source/_posts/2013-02-19-CVE-2013-1756.markdown @@ -1,7 +1,7 @@ --- layout: post title: "CVE-2013-1756: Dragonfly Gem Remote Code Execution" -date: 2013-01-01 +date: 2013-02-19 comments: false categories: [dragonfly] --- diff --git a/source/_posts/2013-03-19-CVE-2013-1854.markdown b/source/_posts/2013-03-19-CVE-2013-1854.markdown index dc6ab3e5..ca5d6c9a 100644 --- a/source/_posts/2013-03-19-CVE-2013-1854.markdown +++ b/source/_posts/2013-03-19-CVE-2013-1854.markdown @@ -8,7 +8,7 @@ categories: [activerecord,rails] ### CVE ID -* [CVE-2013-1854](https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/jgJ4cjjS8FE) +* [CVE-2013-1854](http://osvdb.org/show/osvdb/91453) ### GEM NAME diff --git a/source/_posts/2013-03-19-CVE-2013-1855.markdown b/source/_posts/2013-03-19-CVE-2013-1855.markdown index 539bf7b3..a331b537 100644 --- a/source/_posts/2013-03-19-CVE-2013-1855.markdown +++ b/source/_posts/2013-03-19-CVE-2013-1855.markdown @@ -8,7 +8,7 @@ categories: [actionpack,rails] ### CVE ID -* [CVE-2013-1855](https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_QHo4BqnN8) +* [CVE-2013-1855](http://www.osvdb.org/show/osvdb/91452) ### GEM NAME diff --git a/source/_posts/2013-03-19-CVE-2013-1856.markdown b/source/_posts/2013-03-19-CVE-2013-1856.markdown index c0596889..ddce7da1 100644 --- a/source/_posts/2013-03-19-CVE-2013-1856.markdown +++ b/source/_posts/2013-03-19-CVE-2013-1856.markdown @@ -8,7 +8,7 @@ categories: [activesupport,rails] ### CVE ID -* [CVE-2013-1856](https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/KZwsQbYsOiI) +* [CVE-2013-1856](http://www.osvdb.org/show/osvdb/91451) ### GEM NAME diff --git a/source/_posts/2013-03-19-CVE-2013-1857.markdown b/source/_posts/2013-03-19-CVE-2013-1857.markdown index 0d4f3422..2e3ca9eb 100644 --- a/source/_posts/2013-03-19-CVE-2013-1857.markdown +++ b/source/_posts/2013-03-19-CVE-2013-1857.markdown @@ -8,7 +8,7 @@ categories: [actionpack,rails] ### CVE ID -* [CVE-2013-1857](https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/zAAU7vGTPvI) +* [CVE-2013-1857](http://osvdb.org/show/osvdb/91454) ### GEM NAME diff --git a/tasks/sync_advisories.rake b/tasks/sync_advisories.rake index bebae091..3da41c72 100644 --- a/tasks/sync_advisories.rake +++ b/tasks/sync_advisories.rake @@ -10,29 +10,19 @@ task :sync_advisories do Rake::FileList["ruby-advisory-db/gems/**/*.yml"].each do |advisory| yaml = YAML.load_file(advisory) + unless yaml['cve'] + STDERR.puts "*** WARNING: couldn't sync '#{yaml['title']}: no CVE metadata" + next + end cve = "CVE-" + yaml['cve'] title = yaml['title'].gsub(/\s+/m, ' ') title = "#{cve}: #{title}" slug = cve + date = yaml['date'] - puts "Processing: #{title}" - - if yaml['url']['osvdb.org'] - osvdb_entry = Net::HTTP.get URI(yaml['url']) - date = osvdb_entry[/(\d{4}-\d{2}-\d{2})\<\/td/, 1] - else - nvd_entry = Net::HTTP.get URI("http://web.nvd.nist.gov/view/vuln/detail?vulnId=#{cve}") - matches = nvd_entry.match(/(\d{2})\/(\d{2})\/(\d{4})\<\/div/) - - if matches - date = sprintf("%04d-%02d-%02d", Integer(matches[3]), Integer(matches[1]), Integer(matches[2])) - else - puts "Can't determine date for: #{title}" - date = "#{yaml['cve'][/\d{4}/]}-01-01" - end - end + STDERR.puts "Processing: #{title}" filename = "#{date}-#{slug}.markdown" template = ERB.new <<-MARKDOWN @@ -67,4 +57,4 @@ MARKDOWN File.open("source/_posts/#{filename}", "w") { |file| file << template.result(binding) } end -end \ No newline at end of file +end