CVE-2019-8324: debian debian_linux Improper Control of Generation of Code

Modified

AliasesALPINE-CVE-2019-8324RHSA-2019:1151RHSA-2019:1972+3 more

Published 17-06-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-8324 is a high (CVSS 8.8) Improper Control of Generation of Code vulnerability in debian debian_linux. EPSS estimates a 3.22% chance of exploitation in the next 30 days, higher than 88.2% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 8.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

8.8/10

010

High · v3.1 (NVD)

EPSS score

3.22%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15 · Related 4

DLA-1735-1 DLA-1796-1 DLA-2330-1 DSA-4433-1 MGASA-2020-0243 MGASA-2020-0440+9 more

Timeline

17-06-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.

CVSS metrics

7 scores · 6 sources · 3 versions

v3.18.8v3.07.2v2.06.8

EPSS trend

Probability

3.22%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

No change 0.00 pp

From 3.22% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat67 products

enterprise_linux8.0
rh-ruby23-ruby< 0:2.3.8-70.el6 | < 0:2.3.8-70.el7
rh-ruby23-ruby-debuginfo< 0:2.3.8-70.el6 | < 0:2.3.8-70.el7
rh-ruby23-ruby-devel< 0:2.3.8-70.el6 | < 0:2.3.8-70.el7
rh-ruby23-ruby-doc< 0:2.3.8-70.el6 | < 0:2.3.8-70.el7

rh-ruby23-ruby-irb< 0:2.3.8-70.el6 | < 0:2.3.8-70.el7
rh-ruby23-ruby-libs< 0:2.3.8-70.el6 | < 0:2.3.8-70.el7
rh-ruby23-ruby-tcltk< 0:2.3.8-70.el6 | < 0:2.3.8-70.el7
rh-ruby23-rubygem-bigdecimal< 0:1.2.8-70.el6 | < 0:1.2.8-70.el7
rh-ruby23-rubygem-did_you_mean< 0:1.0.0-70.el6 | < 0:1.0.0-70.el7
rh-ruby23-rubygem-io-console< 0:0.4.5-70.el6 | < 0:0.4.5-70.el7
rh-ruby23-rubygem-json< 0:1.8.3.1-70.el6 | < 0:1.8.3.1-70.el7
rh-ruby23-rubygem-minitest< 0:5.8.5-70.el6 | < 0:5.8.5-70.el7
rh-ruby23-rubygem-net-telnet< 0:0.1.1-70.el6 | < 0:0.1.1-70.el7
rh-ruby23-rubygem-power_assert< 0:0.2.6-70.el6 | < 0:0.2.6-70.el7
rh-ruby23-rubygem-psych< 0:2.1.0.1-70.el6 | < 0:2.1.0.1-70.el7
rh-ruby23-rubygem-rake< 0:10.4.2-70.el6 | < 0:10.4.2-70.el7
rh-ruby23-rubygem-rdoc< 0:4.2.1-70.el6 | < 0:4.2.1-70.el7
rh-ruby23-rubygem-test-unit< 0:3.1.5-70.el6 | < 0:3.1.5-70.el7
rh-ruby23-rubygems< 0:2.5.2.3-70.el6 | < 0:2.5.2.3-70.el7
rh-ruby23-rubygems-devel< 0:2.5.2.3-70.el6 | < 0:2.5.2.3-70.el7
ruby< 0:2.5.3-104.module+el8.0.0+3250+4b7d6d43
ruby-debuginfo< 0:2.5.3-104.module+el8.0.0+3250+4b7d6d43
ruby-debugsource< 0:2.5.3-104.module+el8.0.0+3250+4b7d6d43
ruby-devel< 0:2.5.3-104.module+el8.0.0+3250+4b7d6d43
ruby-doc< 0:2.5.3-104.module+el8.0.0+3250+4b7d6d43
ruby-irb< 0:2.5.3-104.module+el8.0.0+3250+4b7d6d43
ruby-libs< 0:2.5.3-104.module+el8.0.0+3250+4b7d6d43
ruby-libs-debuginfo< 0:2.5.3-104.module+el8.0.0+3250+4b7d6d43
rubygem-abrt< 0:0.3.0-4.module+el8.0.0+3250+4b7d6d43
rubygem-abrt-doc< 0:0.3.0-4.module+el8.0.0+3250+4b7d6d43
rubygem-bigdecimal< 0:1.3.4-104.module+el8.0.0+3250+4b7d6d43
rubygem-bigdecimal-debuginfo< 0:1.3.4-104.module+el8.0.0+3250+4b7d6d43
rubygem-bson< 0:4.3.0-2.module+el8.0.0+3250+4b7d6d43
rubygem-bson-debuginfo< 0:4.3.0-2.module+el8.0.0+3250+4b7d6d43
rubygem-bson-debugsource< 0:4.3.0-2.module+el8.0.0+3250+4b7d6d43
rubygem-bson-doc< 0:4.3.0-2.module+el8.0.0+3250+4b7d6d43
rubygem-bundler< 0:1.16.1-3.module+el8.0.0+3250+4b7d6d43
rubygem-bundler-doc< 0:1.16.1-3.module+el8.0.0+3250+4b7d6d43
rubygem-did_you_mean< 0:1.2.0-104.module+el8.0.0+3250+4b7d6d43
rubygem-io-console< 0:0.4.6-104.module+el8.0.0+3250+4b7d6d43
rubygem-io-console-debuginfo< 0:0.4.6-104.module+el8.0.0+3250+4b7d6d43
rubygem-json< 0:2.1.0-104.module+el8.0.0+3250+4b7d6d43
rubygem-json-debuginfo< 0:2.1.0-104.module+el8.0.0+3250+4b7d6d43
rubygem-minitest< 0:5.10.3-104.module+el8.0.0+3250+4b7d6d43
rubygem-mongo< 0:2.5.1-2.module+el8.0.0+3250+4b7d6d43
rubygem-mongo-doc< 0:2.5.1-2.module+el8.0.0+3250+4b7d6d43
rubygem-mysql2< 0:0.4.10-4.module+el8.0.0+3250+4b7d6d43
rubygem-mysql2-debuginfo< 0:0.4.10-4.module+el8.0.0+3250+4b7d6d43
rubygem-mysql2-debugsource< 0:0.4.10-4.module+el8.0.0+3250+4b7d6d43
rubygem-mysql2-doc< 0:0.4.10-4.module+el8.0.0+3250+4b7d6d43
rubygem-net-telnet< 0:0.1.1-104.module+el8.0.0+3250+4b7d6d43
rubygem-openssl< 0:2.1.2-104.module+el8.0.0+3250+4b7d6d43
rubygem-openssl-debuginfo< 0:2.1.2-104.module+el8.0.0+3250+4b7d6d43
rubygem-pg< 0:1.0.0-2.module+el8.0.0+3250+4b7d6d43
rubygem-pg-debuginfo< 0:1.0.0-2.module+el8.0.0+3250+4b7d6d43
rubygem-pg-debugsource< 0:1.0.0-2.module+el8.0.0+3250+4b7d6d43
rubygem-pg-doc< 0:1.0.0-2.module+el8.0.0+3250+4b7d6d43
rubygem-power_assert< 0:1.1.1-104.module+el8.0.0+3250+4b7d6d43
rubygem-psych< 0:3.0.2-104.module+el8.0.0+3250+4b7d6d43
rubygem-psych-debuginfo< 0:3.0.2-104.module+el8.0.0+3250+4b7d6d43
rubygem-rake< 0:12.3.0-104.module+el8.0.0+3250+4b7d6d43
rubygem-rdoc< 0:6.0.1-104.module+el8.0.0+3250+4b7d6d43
rubygem-test-unit< 0:3.2.7-104.module+el8.0.0+3250+4b7d6d43
rubygem-xmlrpc< 0:0.3.0-104.module+el8.0.0+3250+4b7d6d43
rubygems< 0:2.7.6-104.module+el8.0.0+3250+4b7d6d43
rubygems-devel< 0:2.7.6-104.module+el8.0.0+3250+4b7d6d43

Show all 67

Ubuntu5 products

jruby< 1.5.6-9+deb8u2build0.14.04.1~esm2 | All versions (No fix recorded)
ruby1.9.1< 1.9.3.484-2ubuntu1.14
ruby2.0< 2.0.0.484-1ubuntu2.13
ruby2.3< 2.3.1-2~16.04.12
ruby2.5< 2.5.1-1ubuntu1.2

Debian3 products

jruby< 9.1.17.0-3
rubygems< 3.2.0~rc.1-1
debian_linuxEOL9.0

RubyGems2 products

rubygems-update≥ 2.6.0, < 2.7.9 | ≥ 3.0.0, < 3.0.2
rubygems≥ 2.6.0, ≤ 3.0.2

Alpine1 product

ruby< 2.4.6-r0 | < 2.5.5-r0

Opensuse1 product

leapEOL15.0 | 15.1

6 vendors · 79 products

References

21 links

hackerone.com/reports/328571X Refsource MISCPermissions RequiredThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
access.redhat.com/errata/RHSA-2019:1972Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
lists.debian.org/debian-lts-announce/2020/08/msg00027.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
security.alpinelinux.org/vuln/CVE-2019-8324Advisory
access.redhat.com/errata/RHSA-2019:1151Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1692520REPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1151.jsonAdvisory
access.redhat.com/security/cve/CVE-2019-8324REPORT

Show all 21 references

www.cve.org/CVERecord?id=CVE-2019-8324AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2019-8324Advisory
blog.rubygems.org/2019/03/05/security-advisories-2019-03.htmlARTICLEREPORTWEB
www.ruby-lang.org/en/news/2019/03/05/multiple-vulnerabilities-in-rubygems/ARTICLEREPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1972.jsonAdvisory
ubuntu.com/security/CVE-2019-8324REPORT
bugs.ruby-lang.org/attachments/7669REPORT
bugs.ruby-lang.org/attachments/7670REPORT
ubuntu.com/security/notices/USN-3945-1Advisory
security-tracker.debian.org/tracker/CVE-2019-8324Advisory
github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2019-8324.ymlWEB