CVE-2019-8323
Published: 27 March 2019
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.
From the Ubuntu Security Team
It was discovered that Gem::GemcutterUtilities#with_response failed to escape certain characters. An attacker could use this vulnerability inject escape sequences into a victim's terminal.
Notes
| Author | Note |
|---|---|
| tyhicks | ruby{1.9.1,2.0,2.3} and jruby ship an embedded rubygems. |
Priority
Medium
CVSS 3 base score: 7.5
Status
| Package | Release | Status |
|---|---|---|
|
jruby Launchpad, Ubuntu, Debian |
bionic |
Needed
|
| cosmic |
Ignored
(reached end-of-life)
|
|
| disco |
Ignored
(reached end-of-life)
|
|
| eoan |
Not vulnerable
(9.1.17.0-3)
|
|
| focal |
Not vulnerable
(9.1.17.0-3)
|
|
| groovy |
Not vulnerable
(9.1.17.0-3)
|
|
| hirsute |
Not vulnerable
(9.1.17.0-3)
|
|
| impish |
Not vulnerable
(9.1.17.0-3)
|
|
| precise |
Does not exist
|
|
| trusty |
Needed
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code not present)
|
|
|
ruby1.9.1 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
(trusty was released [1.9.3.484-2ubuntu1.14])
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
ruby2.0 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
(trusty was released [2.0.0.484-1ubuntu2.13])
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
ruby2.1 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
ruby2.3 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(2.3.1-2~16.04.12)
|
|
|
ruby2.5 Launchpad, Ubuntu, Debian |
bionic |
Released
(2.5.1-1ubuntu1.2)
|
| cosmic |
Released
(2.5.1-5ubuntu4.3)
|
|
| disco |
Released
(2.5.5-1)
|
|
| eoan |
Released
(2.5.5-1)
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8323
- https://bugs.ruby-lang.org/attachments/7669 (for 2.4.5)
- https://bugs.ruby-lang.org/attachments/7670 (for 2.5.3)
- https://www.ruby-lang.org/en/news/2019/03/05/multiple-vulnerabilities-in-rubygems/
- https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
- https://ubuntu.com/security/notices/USN-3945-1
- NVD
- Launchpad
- Debian