Code Injection Vulnerability in Ruby Shell Library
CVE-2019-16255

8.1HIGH

Key Information:

Vendor

Ruby-lang

Status
Ruby
Vendor
CVE Published:
26 November 2019

What is CVE-2019-16255?

A vulnerability exists in the Ruby programming language that allows untrusted data to be injected into Shell#[] or Shell#test methods in lib/shell.rb. This can lead to arbitrary Ruby method calls, posing significant risks if exploited. It is critical for users of affected Ruby versions to upgrade to the latest releases to mitigate potential security issues.

References

https://hackerone.com/reports/327512
https://lists.debian.org/debian-lts-announce/2019/11/msg0...
https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-r...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.