PT-2019-4617 · Ruby+6 · Rubygems+6

Published 2019-03-27 · Updated 2020-11-27 · CVE-2019-8324

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RubyGems versions 2.6 through 3.0.2

Description An issue in RubyGems allows an attacker to inject arbitrary code into the stub line of gemspec, which is eval-ed by code in ensure loadable spec during the preinstall check. This is due to incorrect handling of crafted gems with multi-line names. The vulnerability can be exploited by a remote attacker using a specially crafted string in the gemspec, potentially allowing the execution of arbitrary code.

Recommendations For RubyGems versions 2.6 through 3.0.2, consider disabling the ensure loadable spec function until a patch is available to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

RCE

Weakness Enumeration

CWE-94

CWE-20

Related Identifiers

ALSA-2019:1972

BDU:2020-00760

CESA-2019_1235

CESA-2019_1972

CVE-2019-8324

DLA-1735-1

DLA-1796-1

DLA-2330-1

DSA-4433-1

GHSA-76WM-422Q-92MQ

MGASA-2020-0243

MGASA-2020-0440

OPENSUSE-SU-2019:1771-1

OPENSUSE-SU-2019_1771-1

RHSA-2019:1148

RHSA-2019:1150

RHSA-2019:1151

RHSA-2019:1235

RHSA-2019:1429

RHSA-2019:1972

RHSA-2019_1235

RHSA-2019_1972

RHSA-2020:2769

RLSA-2019:1972

SUSE-SU-2019:1804-1

SUSE-SU-2020:1570-1

SUSE-SU-2020_1570-1

USN-3945-1

Affected Products

Almalinux

Centos

Red Hat

Rocky Linux

Rubygems

Suse

Ubuntu

References · 142

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2019-8324.yml · Exploit
• 🔥 https://github.com/rails-lts/json_cve_2020_10663 · Exploit
• https://ubuntu.com/security/CVE-2019-8321 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:1804-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-8324 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:1972 · Vendor Advisory
• https://debian.org/lts/security/2020/dla-2330 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2330-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0440 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2019-1235.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2019:1972 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0440.html · Security Note
• https://osv.dev/vulnerability/DLA-1735-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-3945-1 · Vendor Advisory