CVE-2019-16255

Advisory lineage Upstream: 0 Downstream: 21
Modified
Published: 26 Nov 2019, 00:00
Last modified:05 Aug 2024, 01:10

Vulnerability Summary

Overall Risk (default)
medium
43/100
CVSS Score
8.1 HIGH
v3.1 (nvd)
EPSS Score
1.16% LOW
1% probability -0.11%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

26 Nov 2019, 00:00
Published
Vulnerability first disclosed
05 Aug 2024, 01:10
Last Modified
Vulnerability information updated

Description

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.

CVSS Metrics

  • v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 1.16%• Percentile: 79%

Techniques & Countermeasures

  • CWE-94•Improper Control of Generation of Code ('Code Injection')

    The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected Systems

  • debian•debian_linux

    8.0 | 9.0

  • opensuse•leap

    15.1

  • oracle•graalvm

    19.3.0.2

  • ruby-lang•ruby

    ≥ 2.4.0, ≤ 2.4.7 | ≥ 2.5.0, ≤ 2.5.6 | ≥ 2.6.0, ≤ 2.6.4

References (15)