Allele Security Alert
ASA-2019-00362
Identifier(s)
ASA-2019-00362, CVE-2019-8325
Title
Escape sequence injection vulnerability in errors
Vendor(s)
RubyGems.org
Product(s)
RubyGems
Affected version(s)
RubyGems 2.6 and later through 3.0.2
Fixed version(s)
RubyGems 3.0.3
RubyGems 2.7.8
Proof of concept
Unknown
Description
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)
Technical details
Unknown
Credits
ooooooo_q
Reference(s)
March 2019 Security Advisories
https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
Clean ascii escape sequence polluted exceptions processed by Gem::CommandManager#run
https://github.com/rubygems/rubygems/commit/e434c3e34367f8a2ea83ca16ed805cf219117e18
ruby-2.4.5-rubygems-v2.patch
https://bugs.ruby-lang.org/attachments/7669
CVE-2019-8325
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8325
CVE-2019-8325
https://nvd.nist.gov/vuln/detail/CVE-2019-8325
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: June 20, 2019