GitHub Advisoryadvisory · RubyGems

GHSA-5m2v-hc64-56h6 Rubyzip denial of service

MEDIUM Published 2019-09-30 Modified 2023-11-17 Official page ↗
Aliases
CVE-2019-16892
Ecosystem
RubyGems
Packages
rubyzip
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2019-09-30

Affected packages

• RubyGems rubyzip: < 1.3.0 → fixed in 1.3.0

Description

In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

Related

Alias · CVE (1)

  • CVE-2019-16892 In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References