GitHub Advisoryadvisory · RubyGems
GHSA-mh37-8c3g-3fgc RubyGems Escape sequence injection vulnerability in gem owner
HIGH
Official page ↗
- Aliases
- CVE-2019-8322
- Ecosystem
- RubyGems
- Packages
- rubygems-update
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-74
- Reviewed
- 2019-06-20
Affected packages
• RubyGems rubygems-update: >= 2.6.0, < 2.7.9 → fixed in 2.7.9
• RubyGems rubygems-update: >= 3.0.0, < 3.0.2 → fixed in 3.0.2
Description
An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
Related
Alias · CVE (1)
- CVE-2019-8322 An issue was discovered in RubyGems 2.6 and later through 3.0.2. vulnerability
Weakness · CWE (1)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-8322 advisory
- https://hackerone.com/reports/315087 web
- https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2019-8322.yml web
- https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html web
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html web