RubyGems Code Injection vulnerability
RubyGems prior to 2.6.13 is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-0899US | critical9.8 | — | ||
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute te… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://blog.rubygems.org/2017/08/27/2.6.13-released.htmlWEB
- https://access.redhat.com/errata/RHSA-2017:3485WEB
- https://access.redhat.com/errata/RHSA-2018:0378WEB
- https://access.redhat.com/errata/RHSA-2018:0583WEB
- https://access.redhat.com/errata/RHSA-2018:0585WEB
- https://github.com/rubygems/rubygemsPACKAGE
- https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1WEB
- https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan