GitHub Advisoryadvisory · RubyGems
GHSA-q6cw-2553-7837 newrelic_rpm Gem Discloses Sensitive Information
MEDIUM
Official page ↗
- Aliases
- CVE-2013-0284
- Ecosystem
- RubyGems
- Packages
- newrelic_rpm
- Severity
- Moderate
- Weaknesses
- CWE-200
- Reviewed
- 2020-06-16
Affected packages
• RubyGems newrelic_rpm: >= 3.2.0, < 3.5.3.24 → fixed in 3.5.3.24
Description
Ruby agent 3.2.0 through 3.5.3.23 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data.
Related
Alias · CVE (1)
- CVE-2013-0284 Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote… vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-0284 advisory
- https://github.com/newrelic/newrelic-ruby-agent package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/newrelic_rpm/CVE-2013-0284.yml web
- https://newrelic.com/docs/ruby/ruby-agent-security-notification web
- https://web.archive.org/web/20130117025417/https://newrelic.com/docs/ruby/ruby-agent-security-notification web
- http://seclists.org/oss-sec/2013/q1/304 web