Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2019-8324 →
DEBIAN-CVE-2019-8324
An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
jruby
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.17.0-3"}]}]
Debian:13
jruby
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.17.0-3"}]}]
Debian:14
jruby
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.17.0-3"}]}]
Debian:12
rubygems
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0~rc.1-1"}]}]
Debian:13
rubygems
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0~rc.1-1"}]}]
Debian:14
rubygems
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0~rc.1-1"}]}]
Références
- advisory security-tracker.debian.org