Two updated advisories; 1 added to rad-ignores.sh script; one gem added to Gemfile (rubysec#1239)

* One new and 2 updated advisories; 1 added to rad-ignores.sh script; one gem added to Gemfile

* Delete rubies/mruby/CVE-2022-4996.yml

Author: jasnow

Gemfile

@@ -5,6 +5,7 @@ gem 'faraday',      '~> 2.0'
 gem 'kwalify',      '~> 0.1'
 gem 'json_schemer', '~> 2.0'
 gem 'rspec',        '~> 3.0'
+gem 'base64'
 
 group :development do
   gem 'pry'

gems/resolv/CVE-2026-80212.yml

@@ -1,6 +1,7 @@
 ---
 gem: resolv
 cve: 2026-80212
+ghsa: x2vh-ff4w-v64c
 url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-80212
 title: CVE-2026-80212 - Memory exhaustion through malicious DNS responses
 date: 2026-08-27
@@ -15,21 +16,23 @@ description: |
   ## Credits
 
   Thanks to dalifit for discovering these issues.
+cvss_v3: 7.5
 patched_versions:
   - "~> 0.3.2"
   - ">= 0.7.2"
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/cve-2026-80212
     - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-80212
     - https://rubygems.org/gems/resolv/versions/0.7.2
     - https://github.com/ruby/resolv/releases/tag/v0.7.2
     - https://rubygems.org/gems/resolv/versions/0.3.2
     - https://github.com/ruby/resolv/releases/tag/v0.3.2
     - https://www.ruby-lang.org/en/security
     - https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv
+    - https://github.com/advisories/GHSA-x2vh-ff4w-v64c
 notes: |
-  - CVE is reserved, but not published.
-  - No GHSA values and no cvss values
+  - GHSA from nvd.nist.gov URL.
   - Text from "multiple-vulnerabilities-in-resolv" URL
     - "Affected versions
       - resolv gem 0.4.0 through 0.7.1

gems/resolv/CVE-2026-80213.yml

@@ -1,6 +1,7 @@
 ---
 gem: resolv
 cve: 2026-80213
+ghsa: jr95-x3fr-rcg4
 url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-80213
 title: CVE-2026-80213 - Hostname validation bypass
 date: 2026-08-27
@@ -17,21 +18,23 @@ description: |
   ## Credits
 
   Thanks to dalifit for discovering these issues.
+cvss_v3: 4.0
 patched_versions:
   - "~> 0.3.2"
   - ">= 0.7.2"
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/cve-2026-80213
     - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-80213
     - https://rubygems.org/gems/resolv/versions/0.7.2
     - https://github.com/ruby/resolv/releases/tag/v0.7.2
     - https://rubygems.org/gems/resolv/versions/0.3.2
     - https://github.com/ruby/resolv/releases/tag/v0.3.2
     - https://www.ruby-lang.org/en/security
     - https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv
+    - https://github.com/advisories/GHSA-jr95-x3fr-rcg4
 notes: |
-  - CVE is reserved, but not published.
-  - No GHSA values and no cvss values
+  - cvss_v3 from nvd.nist.gov URL.
   - Text from "multiple-vulnerabilities-in-resolv" URL
     - "Affected versions
       - resolv gem 0.4.0 through 0.7.1

lib/rad-ignores.sh

@@ -298,3 +298,6 @@ rm -f gems/nokogiri/CVE-2026-79772.yml
 # nokogiri  | https://github.com/advisories/GHSA-rh9x-7xjc-vwx2 (duplicate)
 # paperclip | https://github.com/advisories/GHSA-phmw-pv3f-vvx7 (withdrawn)
 # sprockets | https://github.com/advisories/GHSA-r4x3-g983-9g48 (withdrawn)
+
+# 9/9/2026: 
+# Rubygmems | https://github.com/advisories/GHSA-mq4m-44x6-6r2v (not a gem)