CVE-2019-8323

HIGH

RubyGems Escape sequence injection vulnerability in api response handling

Published June 20, 2019Updated February 16, 2024Source: osv

Summary

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.

Remediation

Upgrade to the fixed version using your package manager.

Bundler

Update rubygems-update to 2.7.9 or later

gem install rubygems-update -v 2.7.9

Bundler

Update rubygems-update to 3.0.2 or later

gem install rubygems-update -v 3.0.2

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Package	Ecosystem	Affected	Fixed In
rubygems-update	rubygems	2.6.0, 2.6.1, 2.6.10, 2.6.11 (+21 more)	2.7.9
rubygems-update	rubygems	3.0.0, 3.0.1	3.0.2

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-74
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Frequently Asked Questions

What is CVE-2019-8323?: RubyGems Escape sequence injection vulnerability in api response handling This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2019-8323?: CVE-2019-8323 affects rubygems-update. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2019-8323 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-3h4r-pjv6-cph9

Related CVEs

CVE-2018-1000076
CRITICAL
RubyGems Improper Verification of Cryptographic Signature vulnerability
CVE-2017-0903
CRITICAL
RubyGems vulnerable to Deserialization of Untrusted Data
CVE-2019-8325
HIGH
RubyGems Escape sequence injection in errors
CVE-2019-8320
HIGH
RubyGems Delete directory using symlink when decompressing tar
CVE-2017-0902
HIGH
RubyGems has Origin Validation Error vulnerability
CVE-2019-8321
HIGH
RubyGems Escape sequence injection vulnerability in verbose
CVE-2019-8322
HIGH
RubyGems Escape sequence injection vulnerability in gem owner
CVE-2018-1000078
MEDIUM
RubyGems Cross-site Scripting vulnerability

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies