CVE-2019-8325

Published: 27 March 2019

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)

From the Ubuntu security team

It was discovered that Gem::CommandMangert#run failed to escape certain characters. An attacker could use this vulnerability inject escape sequences into a victim's terminal.

Priority

Medium

CVSS 3 base score: 7.5

Status

Notes

ruby{1.9.1,2.0,2.3} and jruby ship an embedded rubygems.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8325
• https://bugs.ruby-lang.org/attachments/7669 (for 2.4.5)
• https://bugs.ruby-lang.org/attachments/7670 (for 2.5.3)
• https://www.ruby-lang.org/en/news/2019/03/05/multiple-vulnerabilities-in-rubygems/
• https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
• https://ubuntu.com/security/notices/USN-3945-1
• NVD
• Launchpad
• Debian

Bugs