PT-2019-4652 · Ruby+8 · Ruby+8
Bengt Jonsson
+4
·
Publicado
2019-07-27
·
Atualizado
2023-05-01
·
CVE-2019-16255
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Ruby versions 2.4.7 and earlier, 2.5.x through 2.5.6, and 2.6.x through 2.6.4
Description
The issue allows code injection if the first argument to
Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method. This is due to incorrect neutralization of special elements in output used by an incoming component.Recommendations
For Ruby versions 2.4.7 and earlier, update to version 2.4.8.
For Ruby versions 2.5.x through 2.5.6, update to version 2.5.7.
For Ruby versions 2.6.x through 2.6.4, update to version 2.6.5.
As a temporary workaround, consider validating and sanitizing the first argument to
Shell#[] and Shell#test to prevent code injection.Exploit
Correção
Code Injection
Special Elements Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Centos
Red Hat
Rocky Linux
Ruby
Suse
Ubuntu