GitHub Advisoryadvisory · RubyGems

GHSA-wr5j-q359-6vr2 backup-agoddard and backup_checksum have Information Exposure vulnerability

HIGH Published 2022-05-14 Modified 2023-01-23 Official page ↗
Aliases
CVE-2014-4993
Ecosystem
RubyGems
Packages
backup-agoddard, backup_checksum
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2023-01-23

Affected packages

• RubyGems backup-agoddard: <= 3.0.28 (no fix yet) • RubyGems backup_checksum: <= 3.0.23 (no fix yet)

Description

(1) `lib/backup/cli/utility.rb` in the `backup-agoddard` gem 3.0.28 and (2) `lib/backup/cli/utility.rb` in the `backup_checksum` gem 3.0.23 for Ruby place credentials on the openssl command line, which allows local users to obtain sensitive information by listing the process.

Related

Alias · CVE (1)

  • CVE-2014-4993 (1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References