Denial of Service Vulnerability in Rubyzip Product by Ruby

CVE-2019-16892

What is CVE-2019-16892?

In Rubyzip versions before 1.3.0, a crafted ZIP file can exploit application weaknesses by manipulating the uncompressed size attribute, leading to potential denial of service through excessive disk consumption. Attackers can create malicious ZIP entries that bypass size checks, filling up disk space and possibly resulting in application crashes or degraded performance.

References