PT-2019-14498 · Airbrake · Airbrake Ruby Notifier

Nbdavies · Publicado 2019-09-06 · Atualizado 2020-08-24 · CVE-2019-16060

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Airbrake Ruby notifier version 4.2.3

Description The Airbrake Ruby notifier mishandles the blacklist keys configuration option, which may lead to the disclosure of passwords to unauthorized actors.

Recommendations For Airbrake Ruby notifier version 4.2.3, update to version 4.2.4 to resolve the issue.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2019-16060

GHSA-2P82-V77V-MPPR

Produtos afetados

Airbrake Ruby Notifier

Referências · 6

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/airbrake-ruby/CVE-2019-16060.yml · Exploit
• https://github.com/airbrake/airbrake-ruby/issues/468 · Correção
• https://github.com/airbrake/airbrake-ruby/pull/469/commits/d29925e7838031bf7dea7016b22de52532503796 · Nota
• https://osv.dev/vulnerability/CVE-2019-16060 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-16060 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-2p82-v77v-mppr · Aviso do Fabricante