7.1

CVE-2019-16892: fedoraproject fedora

CVSS: 7.1v2.0HighModified
AliasesRHBA-2019:4047RHSA-2019:4201UBUNTU-CVE-2019-16892
Published 25-09-2019Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2019-16892 is a high (CVSS 7.1) vulnerability in fedoraproject fedora. EPSS estimates a 1.58% chance of exploitation in the next 30 days, higher than 75.1% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
39/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.1/10
010
High · v2.0 (NVD)
EPSS score
1.58%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Timeline

  1. 25-09-2019
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

CVSS metrics

6 scores · 5 sources · 3 versions

EPSS trend

Probability

1.58%

Chance of exploitation in the next 30 days

Percentile

75%

Versus all other CVEs

30-day change

0.00 pp

From 1.58% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.58%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Rubyzip

    Maturity: poc

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Redhat33 products
  • cloudforms4.7 | 5.11
  • cfme< 0:5.10.13.1-1.el7cf | < 0:5.11.1.2-1.el8cf
  • cfme-amazon-smartstate< 0:5.10.13.1-1.el7cf | < 0:5.11.1.2-1.el8cf
  • cfme-appliance< 0:5.10.13.1-1.el7cf | < 0:5.11.1.2-1.el8cf
  • cfme-appliance-common< 0:5.10.13.1-1.el7cf | < 0:5.11.1.2-1.el8cf
Debian1 product
  • ruby-zip< 2.0.0-1
Fedoraproject1 product
Opensuse1 product
  • vagrant&distro=openSUSE Tumbleweed< 2.2.18-1.3
RubyGems1 product
  • rubyzip< 1.3.0
Rubyzip_project1 product
Ubuntu1 product
  • ruby-zipAll versions (No fix recorded)

7 vendors · 39 products

References

101 links
Show all 100 references

Showing 100 of 101. Use Open JSON for the complete list.