CVEvulnerability
CVE-2019-8322
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-06-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-74
Description
An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
Affected configurations
• rubygems rubygems (>= 2.6.0 <= 3.0.2)
• debian debian linux 9.0
• opensuse leap 15.0
• opensuse leap 15.1
Related
Weakness · CWE (1)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html Mailing List, Third Party Advisory
- https://hackerone.com/reports/315087 Permissions Required, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html Mailing List, Third Party Advisory
- https://hackerone.com/reports/315087 Permissions Required, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html Mailing List, Third Party Advisory