Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 679490 (CVE-2019-8320, CVE-2019-8321, CVE-2019-8322, CVE-2019-8323, CVE-2019-8324, CVE-2019-8325)

Summary: <dev-ruby/rubygems-2.7.9: multiple vulnerabilities (CVE-2019-8320, CVE-2019-8321, CVE-2019-8322, CVE-2019-8323, CVE-2019-8324, CVE-2019-8325)
Product: Gentoo Security Reporter: Hans de Graaff <graaff>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: ruby
Priority: Normal Flags: stable-bot: sanity-check+
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
Whiteboard: B3 [noglsa cve]
Package list:
dev-ruby/rubygems-2.7.9
Runtime testing required: ---

Description Hans de Graaff gentoo-dev 2019-03-05 05:05:41 UTC
Today we’re disclosing several vulnerablities to RubyGems. They have all been reported via hackerone.

We strongly recommend to upgrade the latest stable version of RubyGems 3.0.3 or 2.7.8. If you can’t upgrade RubyGems 2.7 or 3.0, please use this patch for RubyGems 2.6.

The following vulnerabilities have been reported.

    CVE-2019-8320: Delete directory using symlink when decompressing tar
    CVE-2019-8321: Escape sequence injection vulnerability in verbose
    CVE-2019-8322: Escape sequence injection vulnerability in gem owner
    CVE-2019-8323: Escape sequence injection vulnerability in API response handling
    CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution
    CVE-2019-8325: Escape sequence injection vulnerability in errors
Comment 1 Hans de Graaff gentoo-dev 2019-03-05 05:33:05 UTC
Fixed versions rubygems-2.7.9 and rubygems-3.0.3 have been added.
Comment 2 Agostino Sarubbo gentoo-dev 2019-03-06 18:35:00 UTC
amd64 stable
Comment 3 Rolf Eike Beer 2019-03-06 21:18:58 UTC
sparc stable
Comment 4 Thomas Deutschmann gentoo-dev Security 2019-03-07 21:51:25 UTC
x86 stable
Comment 5 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2019-03-10 14:28:34 UTC
arm stable
Comment 6 Sergei Trofimovich gentoo-dev 2019-03-14 19:38:32 UTC
ia64 stable
Comment 7 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2019-03-15 23:16:03 UTC
s390 stable
Comment 8 Sergei Trofimovich gentoo-dev 2019-03-17 09:50:07 UTC
ppc stable
Comment 9 Sergei Trofimovich gentoo-dev 2019-03-17 09:55:21 UTC
ppc64 stable
Comment 10 Rolf Eike Beer 2019-03-25 21:40:16 UTC
hppa stable
Comment 11 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2019-04-02 12:21:20 UTC
alpha stable
Comment 12 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2019-04-02 19:19:46 UTC
@maintainer, please drop vulnerable.
Comment 13 Hans de Graaff gentoo-dev 2019-04-21 07:27:16 UTC
cleanup done.