p PatchFirst

CVE-2019-8322

CVE-2019-8322

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.

CVSS 7.5 · High · EPSS 3.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • jruby Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.1.17.0-3

    Update to 9.1.17.0-3

  • jruby Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.1.17.0-3

    Update to 9.1.17.0-3

  • jruby Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.1.17.0-3

    Update to 9.1.17.0-3

  • rubygems Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.2.0~rc.1-1

    Update to 3.2.0~rc.1-1

  • rubygems Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.2.0~rc.1-1

    Update to 3.2.0~rc.1-1

  • rubygems Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.2.0~rc.1-1

    Update to 3.2.0~rc.1-1

  • ruby1.9.1 Ubuntu:14.04:LTS

    Versions
    • 1.9.3.194-8.1ubuntu2
    • 1.9.3.448-1ubuntu1
    • 1.9.3.448-1ubuntu2
    • 1.9.3.484-1ubuntu1
    • 1.9.3.484-1ubuntu2
    • 1.9.3.484-2ubuntu1
    • 1.9.3.484-2ubuntu1.1
    • 1.9.3.484-2ubuntu1.2
    • 1.9.3.484-2ubuntu1.3
    • 1.9.3.484-2ubuntu1.5
    • 1.9.3.484-2ubuntu1.6
    • 1.9.3.484-2ubuntu1.7
    • 1.9.3.484-2ubuntu1.8
    • 1.9.3.484-2ubuntu1.10
    • 1.9.3.484-2ubuntu1.11
    • 1.9.3.484-2ubuntu1.12
    • 1.9.3.484-2ubuntu1.13
    Affected ranges
    • ECOSYSTEM: < 1.9.3.484-2ubuntu1.14

    Update to 1.9.3.484-2ubuntu1.14

  • ruby2.0 Ubuntu:14.04:LTS

    Versions
    • 2.0.0.299-2
    • 2.0.0.343-1
    • 2.0.0.343-1ubuntu1
    • 2.0.0.353-1
    • 2.0.0.353-1ubuntu1
    • 2.0.0.484-1ubuntu1
    • 2.0.0.484-1ubuntu2
    • 2.0.0.484-1ubuntu2.1
    • 2.0.0.484-1ubuntu2.2
    • 2.0.0.484-1ubuntu2.4
    • 2.0.0.484-1ubuntu2.5
    • 2.0.0.484-1ubuntu2.6
    • 2.0.0.484-1ubuntu2.8
    • 2.0.0.484-1ubuntu2.9
    • 2.0.0.484-1ubuntu2.10
    • 2.0.0.484-1ubuntu2.11
    Affected ranges
    • ECOSYSTEM: < 2.0.0.484-1ubuntu2.13

    Update to 2.0.0.484-1ubuntu2.13

  • jruby Ubuntu:Pro:14.04:LTS

    Versions
    • 1.5.6-5ubuntu1
    • 1.5.6-6
    • 1.5.6-7
    Affected ranges
    • ECOSYSTEM: < 1.5.6-9+deb8u2build0.14.04.1~esm2

    Update to 1.5.6-9+deb8u2build0.14.04.1~esm2

  • ruby2.3 Ubuntu:16.04:LTS

    Versions
    • 2.3.0-1
    • 2.3.0-2
    • 2.3.0-4ubuntu2
    • 2.3.0-4ubuntu3
    • 2.3.0-5ubuntu1
    • 2.3.1-2~16.04
    • 2.3.1-2~16.04.2
    • 2.3.1-2~16.04.4
    • 2.3.1-2~16.04.5
    • 2.3.1-2~16.04.6
    • 2.3.1-2~16.04.7
    • 2.3.1-2~16.04.9
    • 2.3.1-2~16.04.10
    • 2.3.1-2~16.04.11
    Affected ranges
    • ECOSYSTEM: < 2.3.1-2~16.04.12

    Update to 2.3.1-2~16.04.12

  • ruby2.5 Ubuntu:18.04:LTS

    Versions
    • 2.5.0~preview1-1ubuntu2
    • 2.5.0-4ubuntu1
    • 2.5.0-4ubuntu4
    • 2.5.0-5ubuntu1
    • 2.5.0-6ubuntu1
    • 2.5.1-1ubuntu1
    • 2.5.1-1ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 2.5.1-1ubuntu1.2

    Update to 2.5.1-1ubuntu1.2

  • jruby Ubuntu:18.04:LTS

    Versions
    • 9.1.13.0-1
    • 9.1.17.0-1~18.04
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →