PT-2019-13440 · Ruby · Paranoid2

Publicado 2019-07-14 · Atualizado 2020-08-24 · CVE-2019-13589

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions paranoid2 gem version 1.1.6

Description The issue concerns a code-execution backdoor inserted by a third party into the paranoid2 gem for Ruby. This backdoor was present in the version distributed on RubyGems.org.

Recommendations For version 1.1.6, downgrade to version 1.1.5 to remove the backdoor.

Exploit

Correção

Enumeração de Fraquezas

CWE-829

Identificadores relacionados

CVE-2019-13589

GHSA-4G4C-8GQH-M4VM

SNYK-RUBY-PARANOID2-451600

Produtos afetados

Paranoid2

Referências · 9

• 🔥 https://github.com/rubygems/rubygems.org/issues/2051 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/paranoid2/CVE-2019-13589.yml · Exploit
• https://github.com/anjlab/paranoid2 · Nota
• https://osv.dev/vulnerability/GHSA-4g4c-8gqh-m4vm · Aviso do Fabricante
• http://securityfocus.com/bid/109281 · Nota
• https://osv.dev/vulnerability/CVE-2019-13589 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13589 · Nota de Segurança
• https://rubygems.org/gems/paranoid2/versions · Aviso do Fabricante
• https://snyk.io/vuln/SNYK-RUBY-PARANOID2-451600 · Nota