RubyGems Escape sequence injection vulnerability in verbose
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-8321US | high7.5 | — | ||
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.htmlWEB
- https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.htmlWEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2019-8321.ymlWEB
- https://lists.debian.org/debian-lts-announce/2020/08/msg00027.htmlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2019-8321ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan