Egor Homakov

Name of the Vulnerable Software and Affected Versions: mongodb/bson-ruby versions prior to 3.0.4 Description: The issue allows remote attackers to cause a denial of service, specifically worker resource consumption, via a crafted string. This is due to an incomplete fix. Recommendations: For versions prior to 3.0.4, update to version 3.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `Moped::BSON::ObjectId.legal?` method until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** omniauth-facebook (affected versions not specified) **Description** The RubyGem omniauth-facebook has an access token security issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** bson-ruby gem versions prior to 3.0.4 **Description** The issue allows remote attackers to cause a denial of service or inject arbitrary data via a crafted string, exploiting a BSON injection vulnerability in the `legal?` function. **Recommendations** For versions prior to 3.0.4, update to version 3.0.4 or later to resolve the issue. As a temporary workaround, consider restricting input to the `legal?` function to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: rubygem-moped versions prior to the version containing commit dd5a7c14b5d2e466f7875d079af71ad19774609b Description: The issue allows remote attackers to cause a denial of service or perform a cross-site scripting attack via a crafted string. This is due to the `Moped::BSON::ObjectId.legal?` method in rubygem-moped. The method can be exploited to consume worker resources or execute malicious scripts. Recommendations: For versions prior to the version containing commit dd5a7c14b5d2e466f7875d079af71ad19774609b, update to a version that includes the commit dd5a7c14b5d2e466f7875d079af71ad19774609b to resolve the issue. As a temporary workaround, consider restricting input to the `Moped::BSON::ObjectId.legal?` method to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** doorkeeper versions prior to 1.4.1 **Description** A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of victims for requests that read a user OAuth authorization code. **Recommendations** For versions prior to 1.4.1, update to version 1.4.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Ruby on Rails versions 3.0.0 through 3.0.13 Ruby on Rails versions 3.1.0 through 3.1.5 Ruby on Rails versions 3.2.0 through 3.2.5 **Description** The issue arises from improper consideration of differences in parameter handling between the Active Record component and the Rack interface in Ruby on Rails. This allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request. For example, certain values like `['xyz', nil]` can be used to demonstrate this issue. **Recommendations** For Ruby on Rails versions 3.0.0 through 3.0.13, update to version 3.0.14 or later. For Ruby on Rails versions 3.1.0 through 3.1.5, update to version 3.1.6 or later. For Ruby on Rails versions 3.2.0 through 3.2.5, update to version 3.2.6 or later.