From 32a777b261da573fad720aea8c8542738e650734 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Thu, 29 Oct 2026 11:07:06 -0400 Subject: [PATCH 1/2] Two advisories (One new and one modified) --- gems/crass/GHSA-pq4g-8rxf-4g29.yml | 7 +++- gems/rubyntlm/GHSA-cx24-f932-rr55.yml | 47 +++++++++++++++++++++++++++ lib/rad-ignores.sh | 3 ++ 3 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 gems/rubyntlm/GHSA-cx24-f932-rr55.yml diff --git a/gems/crass/GHSA-pq4g-8rxf-4g29.yml b/gems/crass/GHSA-pq4g-8rxf-4g29.yml index a34e68f097..98b423b385 100644 --- a/gems/crass/GHSA-pq4g-8rxf-4g29.yml +++ b/gems/crass/GHSA-pq4g-8rxf-4g29.yml @@ -1,5 +1,6 @@ --- gem: crass +cve: 2026-116695 ghsa: pq4g-8rxf-4g29 url: https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29 title: Incorrect tokenization of bad URLs enables CSS sanitizer bypass @@ -32,11 +33,15 @@ patched_versions: - ">= 1.0.8" related: url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-116695 - https://rubygems.org/gems/crass/versions/1.0.8 - https://github.com/rgrove/crass/blob/v1.0.8/HISTORY.md#108-2026-10-21 - https://github.com/rgrove/crass/compare/v1.0.7...v1.0.8 + - https://github.com/rgrove/crass/commit/689fc45c632fdf3803b2f4e844ffc9cca3b08f34 - https://drafts.csswg.org/css-syntax-3/#consume-remnants-of-bad-url + - https://advisories.gitlab.com/gem/crass/CVE-2026-116695 + - https://osv.dev/vulnerability/GHSA-pq4g-8rxf-4g29 - https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29 + - https://github.com/advisories/GHSA-pq4g-8rxf-4g29 notes: | - - No CVE in GHSA URL. - cvss_v4 from GHSA URL. diff --git a/gems/rubyntlm/GHSA-cx24-f932-rr55.yml b/gems/rubyntlm/GHSA-cx24-f932-rr55.yml new file mode 100644 index 0000000000..fb4442583c --- /dev/null +++ b/gems/rubyntlm/GHSA-cx24-f932-rr55.yml @@ -0,0 +1,47 @@ +--- +gem: rubyntlm +ghsa: cx24-f932-rr55 +url: https://github.com/WinRb/rubyntlm/security/advisories/GHSA-cx24-f932-rr55 +title: NTLMv2 authentication bypass - Type3#password? ignores its + password argument and verifies every message against the + empty password +date: 2026-09-09 +description: | + Type3#password? ignores its password argument on the NTLMv2 path + and verifies the message against a blank password instead. + + An application using password? to check NTLMv2 credentials will + accept any client that sends an empty password for a username it + knows, and will reject that account's real password. Knowing a + valid username is enough to authenticate as that user. + + ## Impact + + Authentication bypass (CWE-303). An application verifying NTLMv2 + credentials with Type3#password? can be authenticated to by anyone + who knows a valid username. The application doesn't have to misuse + the API — password? is public, documented, and the only server-side + check the gem offers. + + I couldn't identify a caller in the ecosystem. rack-ntlm's README + says it only verifies that the user exists in AD and doesn't bind + as that user, and ruby_smb does its own comparison with + Net::NTLM.ntlm_hash. The only caller inside the gem is + blank_password?, which passes '' and is unaffected. + + Anyone who had adopted the API would likely have noticed early, since + real passwords are rejected as well as empty ones being accepted. +cvss_v4: 9.3 +unaffected_versions: + - "< 0.5.0" +patched_versions: + - ">= 0.6.6" +related: + url: + - https://rubygems.org/gems/rubyntlm/versions/0.6.6 + - https://github.com/WinRb/rubyntlm/releases/tag/v0.6.6 + - https://github.com/winrb/rubyntlm/blob/main/CHANGELOG.md#066-2026-09-09 + - https://github.com/WinRb/rubyntlm/security/advisories/GHSA-cx24-f932-rr55 +notes: | + - No CVE in GHSA URL. + - cvss_v4 from GHSA URL. diff --git a/lib/rad-ignores.sh b/lib/rad-ignores.sh index 0d5dd2806c..4fd10ec0bb 100755 --- a/lib/rad-ignores.sh +++ b/lib/rad-ignores.sh @@ -298,6 +298,9 @@ rm -f gems/crass/CVE-2026-61845.yml # 10/24/2026: "Disputed" @ https://nvd.nist.gov/vuln/detail/cve-2018-18260 rm -f gems/camaleon_cms/CVE-2018-18260.yml +# 10/29/2026: Use GHSA prefix over CVE. +rm -f gems/crass/CVE-2026-116695.yml + # 9/4/2026: More duplicates and withdrawns # nokogiri | https://github.com/advisories/GHSA-5jhf-fpp7-v2pv (duplicate) # nokogiri | https://github.com/advisories/GHSA-xqqh-3w52-q8p7 (duplicate) From 2a6d957949be0ad59f8246ad3b1f9180bd486881 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Sun, 1 Nov 2026 10:12:50 -0500 Subject: [PATCH 2/2] Removed texted in question Removed unnecessary details about API usage and caller identification. --- gems/rubyntlm/GHSA-cx24-f932-rr55.yml | 9 --------- 1 file changed, 9 deletions(-) diff --git a/gems/rubyntlm/GHSA-cx24-f932-rr55.yml b/gems/rubyntlm/GHSA-cx24-f932-rr55.yml index fb4442583c..e433f51b9a 100644 --- a/gems/rubyntlm/GHSA-cx24-f932-rr55.yml +++ b/gems/rubyntlm/GHSA-cx24-f932-rr55.yml @@ -22,15 +22,6 @@ description: | who knows a valid username. The application doesn't have to misuse the API — password? is public, documented, and the only server-side check the gem offers. - - I couldn't identify a caller in the ecosystem. rack-ntlm's README - says it only verifies that the user exists in AD and doesn't bind - as that user, and ruby_smb does its own comparison with - Net::NTLM.ntlm_hash. The only caller inside the gem is - blank_password?, which passes '' and is unaffected. - - Anyone who had adopted the API would likely have noticed early, since - real passwords are rejected as well as empty ones being accepted. cvss_v4: 9.3 unaffected_versions: - "< 0.5.0"