rubysec / ruby-advisory-db

# Ruby Advisory Database
The Ruby Advisory Database is a community effort to compile all security
advisories that are relevant to Ruby libraries.
We expect others to create the data, such as getting CVE's, GHSA's,
OSVDB's, cvss', or original vulnerability information.
More details at HERE.
You can check your own Gemfile.locks against this database by using
[bundler-audit].
## Support Ruby Security!
Do you know about a vulnerability that isn't listed in this database? Open an
issue or submit a PR.
## Directory Structure
The database is a list of directories that match the names of Ruby libraries on
[rubygems.org]. Within each directory are one or more advisory files
for the Ruby library. These advisory files are named using
the advisories' [CVE] or [GHSA] or [OSVDB] (legacy) identifier number.
 [code] 
### `gems/`
The `gems/` directory contains sub-directories that match the names of the Ruby
libraries on [rubygems.org]. Within each directory are one or more advisory
files for the Ruby library. These advisory files are named using the
advisories' [CVE] or [GHSA] ID.
### `rubies/`
The `rubies/` directory contains sub-directories for each Ruby implementation.
Within each directory are one or more advisory files for the Ruby
implementation. These advisory files are named using the advisories' [CVE]
or [GHSA] ID.
## Examples
Each advisory file contains the advisory information in [YAML] format.
Here are some example advisories:
### `gems/actionpack/CVE-2023-22795.yml`
 [code] 
### `rubies/ruby/CVE-2022-28739.yml`
 [code] 
## YAML Schema
### `gems`
* `gem` \[String\] (required): Name of the affected gem.
* `library` \[String\] (optional): Name of the ruby library which the
 affected gem belongs to.
* `framework` \[String\] (optional): Name of the framework which the
 affected gem belongs to. (e.g. rails)
* `platform` \[String\] (optional): If this vulnerability is platform-specific,
 name of platform this vulnerability affects (e.g. jruby)
* `cve` \[String\] (optional): Common Vulnerabilities and Exposures (CVE) ID.
* `osvdb` \[Integer\] (optional): Open Sourced Vulnerability Database (OSVDB) ID.
* `ghsa` \[String\] (optional): GitHub Security Advisory (GHSA) ID.
* `url` \[String\] (required): The URL to the full advisory.
* `title` \[String\] (required): The title of the advisory or individual
 vulnerability. It must be a single line sentence.
 * Line wrap `title:` field at 80.
* `date` \[Date\] (required): The public disclosure date of the advisory.
* `description` \[String\] (required): One or more paragraphs describing the
 vulnerability. It may contain multiple paragraphs.
 * Used `description: |` if it is more than one sentence/line.
 * Line wrap `descriptions:` field at 80.
 * Do not include "POC", "PoC", or "Proof of Concept" heading sections
 (any casing) in the `description:` field.
 * Not use "\n" or "%" in `description:` field.
* `cvss_v2` \[Float\] (optional): The [CVSSv2] score for the vulnerability.
* `cvss_v3` \[Float\] (optional): The