DeutschShown in its original language — a full translation is planned for a future version.
Ruby: Mehrere Schwachstellen
view advisory published 2019-10-01
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Ruby ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Daten zu manipulieren oder einen Denial of Servie zu verursachen.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-16255US | high8.1 | — | ||
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb… | ||||
| CVE-2019-16254US | medium5.3 | — | ||
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an att… | ||||
| CVE-2019-16201US | high7.5 | — | ||
WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim… | ||||
| CVE-2019-15845US | medium6.5 | — | ||
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions. | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2021-2588 vom 2021-07-08external
- SUSE Security Update SUSE-SU-2020:1570-1 vom 2020-06-09external
- Debian Security Advisory DSA-4587 vom 2019-12-17external
- Debian Security Advisory DSA-4586 vom 2019-12-17external
- Red Hat Security Advisory RHSA-2021:2104 vom 2021-05-25external
- Red Hat Security Advisory RHSA-2021:2230 vom 2021-06-03external
- Red Hat Security Advisory RHSA-2021:2587 vom 2021-06-29external
- Red Hat Security Advisory RHSA-2021:2588 vom 2021-06-29external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan