PT-2020-9132 · Unknown · Bibtex-Ruby

Published 2020-01-22 · Updated 2020-02-14 · CVE-2019-10780

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BibTeX-ruby versions prior to 5.1.0

Description The issue arises from unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open, allowing shell command injection.

Recommendations For versions prior to 5.1.0, update to version 5.1.0 or later to resolve the issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-10780

GHSA-C5R5-7PFH-6QG6

SNYK-RUBY-BIBTEXRUBY-542602

Affected Products

Bibtex-Ruby

References · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bibtex-ruby/CVE-2019-10780.yml · Exploit
• 🔥 https://snyk.io/vuln/SNYK-RUBY-BIBTEXRUBY-542602 · Exploit
• https://osv.dev/vulnerability/CVE-2019-10780 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c5r5-7pfh-6qg6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10780 · Security Note
• https://github.com/inukshuk/bibtex-ruby · Note
• https://github.com/inukshuk/bibtex-ruby/commit/14406f4460f4e1ecabd25ca94f809b3ea7c5fb11 · Note
• https://github.com/advisories/GHSA-c5r5-7pfh-6qg6 · Note