PT-2019-4652 · Ruby+8 · Ruby+8
Bengt Jonsson
+4
·
Published
2019-07-27
·
Updated
2023-05-01
·
CVE-2019-16255
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Ruby versions 2.4.7 and earlier, 2.5.x through 2.5.6, and 2.6.x through 2.6.4
Description
The issue allows code injection if the first argument to
Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method. This is due to incorrect neutralization of special elements in output used by an incoming component.Recommendations
For Ruby versions 2.4.7 and earlier, update to version 2.4.8.
For Ruby versions 2.5.x through 2.5.6, update to version 2.5.7.
For Ruby versions 2.6.x through 2.6.4, update to version 2.6.5.
As a temporary workaround, consider validating and sanitizing the first argument to
Shell#[] and Shell#test to prevent code injection.Exploit
Fix
Code Injection
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Red Hat
Rocky Linux
Ruby
Suse
Ubuntu