CVE-2019-8324

An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2019-8324 jruby Corrigé dans: 9.1.17.0-3

Références

advisory lists.opensuse.org
advisory access.redhat.com
advisory lists.debian.org
report hackerone.com