CVE-2019-13589

Опубликовано: 14 июл. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.

Ссылки

http://www.securityfocus.com/bid/109281
Third Party Advisory
VDB Entry
https://github.com/rubygems/rubygems.org/issues/2051
Exploit
Issue Tracking
Third Party Advisory
https://rubygems.org/gems/paranoid2/versions
Vendor Advisory
https://snyk.io/vuln/SNYK-RUBY-PARANOID2-451600
Third Party Advisory
http://www.securityfocus.com/bid/109281
Third Party Advisory
VDB Entry
https://github.com/rubygems/rubygems.org/issues/2051
Exploit
Issue Tracking
Third Party Advisory
https://rubygems.org/gems/paranoid2/versions
Vendor Advisory
https://snyk.io/vuln/SNYK-RUBY-PARANOID2-451600
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:anjlab:paranoid2:1.1.6:*:*:*:*:ruby:*:*

EPSS

Процентиль: 91%

0.06233

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-829

Связанные уязвимости

GHSA-4g4c-8gqh-m4vm