From a2c15fefbc5c097b3ee59dd38ed3b5592b993042 Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Mon, 20 Jul 2026 20:04:03 -0400
Subject: [PATCH 1/2] 2 updated advisories; extend sync script to update
 patched_versions with new data

---
 gems/concurrent-ruby/CVE-2026-54905.yml |  8 ++++----
 gems/rest-client/CVE-2019-15224.yml     | 11 +++++++++--
 lib/github_advisory_sync.rb             |  5 +++++
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/gems/concurrent-ruby/CVE-2026-54905.yml b/gems/concurrent-ruby/CVE-2026-54905.yml
index 20be4a7b04..d802df00b4 100644
--- a/gems/concurrent-ruby/CVE-2026-54905.yml
+++ b/gems/concurrent-ruby/CVE-2026-54905.yml
@@ -2,7 +2,7 @@
 gem: concurrent-ruby
 cve: 2026-54905
 ghsa: wv3x-4vxv-whpp
-url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54905
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-54905
 title: Concurrent Ruby - `ReentrantReadWriteLock` read-count overflow
   grants a write lock without exclusivity
 date: 2026-06-19
@@ -33,12 +33,13 @@ description: |
   ### Credit
 
   Pranjali Thakur - depthfirst ([depthfirst.com](<http://depthfirst.com>))
+cvss_v3: 5.5
 cvss_v4: 2.0
 patched_versions:
   - ">= 1.3.7"
 related:
   url:
-    - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54905
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-54905
     - https://rubygems.org/gems/concurrent-ruby/versions/1.3.7
     - https://github.com/ruby-concurrency/concurrent-ruby/releases/tag/v1.3.7
     - https://advisories.gitlab.com/gem/concurrent-ruby/CVE-2026-54905
@@ -46,5 +47,4 @@ related:
     - https://github.com/advisories/GHSA-wv3x-4vxv-whpp
 notes: |
   - cvss_v4 from GHSA
-  - CVE is reserved, but not published.
-    - Not on nvd.nist.gov so no cvss_v2 or cvss_v3.
+  - cvss_v3 from nvd.nist.gov
diff --git a/gems/rest-client/CVE-2019-15224.yml b/gems/rest-client/CVE-2019-15224.yml
index 85619df709..785b9921b3 100644
--- a/gems/rest-client/CVE-2019-15224.yml
+++ b/gems/rest-client/CVE-2019-15224.yml
@@ -2,13 +2,20 @@
 gem: rest-client
 cve: 2019-15224
 ghsa: 333g-rpr4-7hxq
-url: https://github.com/rest-client/rest-client/issues/713
-title: Code execution backdoor in rest-client
+url: https://nvd.nist.gov/vuln/detail/CVE-2019-15224
+title: Code execution backdoor in rest-client (Contains Malicious Code)
 date: 2019-08-19
 description: |
   The rest-client gem 1.6.13 for Ruby, as distributed on RubyGems.org,
   included a code-execution backdoor inserted by a third party.
 cvss_v3: 9.8
+cvss_v4: 7.5
 unaffected_versions:
   - "<= 1.6.9"
   - ">= 1.6.14"
+patched_versions:
+  - ">= 1.7.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-15224
+    - https://github.com/advisories/GHSA-333g-rpr4-7hxq
diff --git a/lib/github_advisory_sync.rb b/lib/github_advisory_sync.rb
index b9e0d7892b..b00bc7d220 100644
--- a/lib/github_advisory_sync.rb
+++ b/lib/github_advisory_sync.rb
@@ -418,6 +418,11 @@ def update(package)
       saved_data = YAML.safe_load_file(package.filename, permitted_classes: [Date])
       new_data = package.merge_data(saved_data)
 
+      patched = patched_versions_for(package)
+      if patched.any? && (new_data["patched_versions"].nil? || new_data["patched_versions"].empty?)
+        new_data["patched_versions"] = patched
+      end
+
       return if saved_data == new_data
 
       File.open(package.filename, 'w') do |file|

From c62373d5d7aa15461235aa8947758033031dcc09 Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Tue, 21 Jul 2026 16:48:11 -0400
Subject: [PATCH 2/2] Modify CVSS v4 entry in CVE-2019-15224.yml

Update CVSS version for CVE-2019-15224 in rest-client.

cvss_v2 from nvd.nist.gov URL
---
 gems/rest-client/CVE-2019-15224.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gems/rest-client/CVE-2019-15224.yml b/gems/rest-client/CVE-2019-15224.yml
index 785b9921b3..0163998e70 100644
--- a/gems/rest-client/CVE-2019-15224.yml
+++ b/gems/rest-client/CVE-2019-15224.yml
@@ -8,8 +8,8 @@ date: 2019-08-19
 description: |
   The rest-client gem 1.6.13 for Ruby, as distributed on RubyGems.org,
   included a code-execution backdoor inserted by a third party.
+cvss_v2: 7.5
 cvss_v3: 9.8
-cvss_v4: 7.5
 unaffected_versions:
   - "<= 1.6.9"
   - ">= 1.6.14"