CVE-2019-16892

Опубликовано: 25 сент. 2019

Источник: nvd

CVSS3: 5.5

CVSS2: 7.1

EPSS Низкий

Описание

In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

Ссылки

https://access.redhat.com/errata/RHBA-2019:4047
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4201
Third Party Advisory
https://github.com/rubyzip/rubyzip/commit/d65fe7bd283ec94f9d6dc7605f61a6b0dd00f55e
Patch
https://github.com/rubyzip/rubyzip/pull/403
Exploit
Issue Tracking
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO6/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWWPORMSBHZTMP4PGF4DQD22TTKBQMMC/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X255K6ZBAQC462PQN2ND5HOTTQEJ2G2X/
Mailing List
https://access.redhat.com/errata/RHBA-2019:4047
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4201
Third Party Advisory
https://github.com/rubyzip/rubyzip/commit/d65fe7bd283ec94f9d6dc7605f61a6b0dd00f55e
Patch
https://github.com/rubyzip/rubyzip/pull/403
Exploit
Issue Tracking
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO6/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWWPORMSBHZTMP4PGF4DQD22TTKBQMMC/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X255K6ZBAQC462PQN2ND5HOTTQEJ2G2X/
Mailing List

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:rubyzip_project:rubyzip:*:*:*:*:*:*:*:*

Версия до 1.3.0 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:*

cpe:2.3:a:redhat:cloudforms:5.11:*:*:*:*:*:*:*

EPSS

Процентиль: 40%

0.0018

Низкий

5.5 Medium

CVSS3

7.1 High

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2019-16892

CVSS3: 5.5

ubuntu

больше 6 лет назад

CVE-2019-16892

CVSS3: 5.5

redhat

больше 6 лет назад

CVE-2019-16892

CVSS3: 5.5

debian

больше 6 лет назад

In Rubyzip before 1.3.0, a crafted ZIP file can bypass application che ...

GHSA-5m2v-hc64-56h6

CVSS3: 5.5

github

больше 6 лет назад

Rubyzip denial of service

EPSS

Процентиль: 40%

0.0018

Низкий

5.5 Medium

CVSS3

7.1 High

CVSS2

Дефекты

NVD-CWE-noinfo