RubyGems Improper Input Validation vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2015-4020 · ADVISORY
• rubygems/rubygems commit 5c7bfb5 · WEB
• rubygems/rubygems · PACKAGE
• rubysec/ruby-advisory-db · WEB
• puppet.com/security/cve/CVE-2015-3900 · WEB
• web.archive.org/web/20200228084212/http://www.securityfocus.com/bid/75431 · WEB
• web.archive.org/web/20200228085830/https://puppet.com/security/cve/CVE-2015-3900 · WEB
• trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009 · WEB
• trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900 · WEB
• blog.rubygems.org/2015/06/08/2.2.5-released.html · WEB
• blog.rubygems.org/2015/06/08/2.4.8-released.html · WEB
• oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html · WEB
• securityfocus.com/bid/75431 · WEB
• trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900 · Third Party Advisory

rubygems-update のその他の脆弱性

• CVE-2019-8323高 7.5An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout…
• CVE-2019-8322高 7.5An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to …
• CVE-2019-8321高 7.5An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape seque…
• CVE-2019-8325高 7.5An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape se…
• CVE-2019-8324高 8.8An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, a…