PT-2018-13545 · Ruby+5 · Ruby+5

Chris Seaton

·

Publicado

2018-10-26

·

Atualizado

2020-06-09

·

CVE-2018-16396

CVSS v3.1

8.1

Alta

VetorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ruby versions prior to 2.3.8 Ruby versions 2.4.x prior to 2.4.5 Ruby versions 2.5.x prior to 2.5.2 Ruby versions 2.6.x prior to 2.6.0-preview3
Description The issue concerns the handling of tainted strings in Ruby. Specifically, it does not taint strings that result from unpacking tainted strings with some formats.
Recommendations For Ruby versions prior to 2.3.8, update to version 2.3.8 or later. For Ruby versions 2.4.x prior to 2.4.5, update to version 2.4.5 or later. For Ruby versions 2.5.x prior to 2.5.2, update to version 2.5.2 or later. For Ruby versions 2.6.x prior to 2.6.0-preview3, update to version 2.6.0-preview3 or later.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

ALT-PU-2019-1050
CESA-2019_2028
CVE-2018-16396
DLA-1558-1
DSA-4332-1
MGASA-2018-0411
OPENSUSE-SU-2019:1771-1
OPENSUSE-SU-2019_1771-1
RHSA-2018:3729
RHSA-2018:3730
RHSA-2018:3731
RHSA-2019:2028
RHSA-2019_2028
RHSA-2020:2769
RHSA-2020:2839
SUSE-SU-2019:1804-1
SUSE-SU-2020:1570-1
SUSE-SU-2020_1570-1
USN-3808-1

Produtos afetados

Alt Linux
Centos
Red Hat
Ruby
Suse
Ubuntu