PT-2019-4617 · Ruby+6 · Rubygems+6
Publicado
2019-03-27
·
Atualizado
2020-11-27
·
CVE-2019-8324
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
RubyGems versions 2.6 through 3.0.2
Description
An issue in RubyGems allows an attacker to inject arbitrary code into the stub line of gemspec, which is eval-ed by code in
ensure loadable spec during the preinstall check. This is due to incorrect handling of crafted gems with multi-line names. The vulnerability can be exploited by a remote attacker using a specially crafted string in the gemspec, potentially allowing the execution of arbitrary code.Recommendations
For RubyGems versions 2.6 through 3.0.2, consider disabling the
ensure loadable spec function until a patch is available to prevent exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Code Injection
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Almalinux
Centos
Red Hat
Rocky Linux
Rubygems
Suse
Ubuntu