Missing Advisory: omniauth CVE-2015-9284

[DarthHater]

I'm unsure if this is truly missing, or the version range is wrong. Starting with missing since I don't have insight to see if it's the version range.

Advisory details

  URL: https://nvd.nist.gov/vuln/detail/CVE-2015-9284
  format: rubygem
  namespace: 
  name: omniauth
  versions: This affects up to the newest version, so `1.9.1` in this case, no  fix has been released

From bundle-audit:

Name: omniauth
Version: 1.9.0
Advisory: CVE-2015-9284
Criticality: High
URL: https://github.com/omniauth/omniauth/pull/809
Title: CSRF vulnerability in OmniAuth's request phase
Solution: remove or disable this gem until a patch is available!

Vulnerabilities found!

More information
Basically, the fix for this has not been merged, more info can be seen here:

omniauth/omniauth#809

We found this issue while testing chelsea against the results from bundle-audit on a project.

[ken-duck]

This has been added and should show up tomorrow, all going well.

[ken-duck]

Visual confirmation indicates this has been added.