Описание
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| ruby2.5 | fixed | 2.5.5-1 | package | |
| ruby2.3 | removed | package | ||
| ruby2.1 | removed | package | ||
| ruby2.1 | not-affected | jessie | package | |
| rubygems | fixed | 3.2.0~rc.1-1 | package | |
| jruby | fixed | 9.1.17.0-3 | package |
Примечания
https://www.ruby-lang.org/en/news/2019/03/05/multiple-vulnerabilities-in-rubygems/
https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
https://github.com/rubygems/rubygems/commit/56c0bbb69e4506bda7ef7f447dfec5db820df20b
Связанные уязвимости
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
RubyGems Escape sequence injection vulnerability in verbose
Уязвимость модуля Gem::UserInteraction системы управления пакетами RubyGems, позволяющая нарушителю нарушить целостность данных