ASA-2019-00358 – RubyGems: Escape sequence injection vulnerability in verbose

Posted on by Allele Security Intelligence in Alerts

Allele Security Alert

ASA-2019-00358

Identifier(s)

ASA-2019-00358, CVE-2019-8321

Title

Escape sequence injection vulnerability in verbose

Vendor(s)

RubyGems.org

Product(s)

RubyGems

Affected version(s)

RubyGems 2.6 and later through 3.0.2

Fixed version(s)

RubyGems 3.0.3
RubyGems 2.7.8

Proof of concept

Unknown

Description

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.

Technical details

Unknown

Credits

ooooooo_q

Reference(s)

March 2019 Security Advisories
https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html

Clean ascii escape sequence polluted messages processed by Gem::UserInteraction#verbose
https://github.com/rubygems/rubygems/commit/181e5d7e8d98cac268ec6f42644ff81fb4783cb2

Fix missing closing parenthesis in Gem::UserInteraction#verbose
https://github.com/rubygems/rubygems/commit/cb264ff64330f9ee069d88fe5c6e8a302d9e54d8

ruby-2.4.5-rubygems-v2.patch
https://bugs.ruby-lang.org/attachments/7669

CVE-2019-8321
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8321

CVE-2019-8321
https://nvd.nist.gov/vuln/detail/CVE-2019-8321

If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: June 19, 2019

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.