RubyGems Escape sequence injection in errors

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-8325 · ADVISORY
• blog.rubygems.org/2019/03/05/security-advisories-2019-03.html · WEB
• rubysec/ruby-advisory-db · WEB
• lists.debian.org/debian-lts-announce/2020/08/msg00027.html · WEB
• lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html · WEB
• hackerone.com/reports/317353 · Permissions Required

rubygems-update のその他の脆弱性

• CVE-2019-8323高 7.5An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout…
• CVE-2019-8322高 7.5An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to …
• CVE-2019-8321高 7.5An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape seque…
• CVE-2019-8324高 8.8An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, a…
• CVE-2019-8320高 7.4A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which…