CVE-2019-8322
An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
02 / AFFECTED SOFTWARE
Affected packages
55 explicit affected versions
27 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
05 / REFERENCES
Further evidence
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
- https://hackerone.com/reports/315087
- https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
- https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2019-8322.yml
- https://nvd.nist.gov/vuln/detail/CVE-2019-8322