Privilege Escalation

2019-05-1602:16:34

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.02 Low

EPSS

Percentile

89.0%

JSON

RubyGems is vulnerable to privilege escalation attacks. A remote, unauthenticated attacker could elevate their privileges by interacting with the terminal via the use of escape sequences with a specifically crafted gem. Improper sanitization of gems’ specification text enables the attacker to exploit this vulnerability.

CPENameOperatorVersion
rh-ruby24-rubyeq2.4.0__75.el7
rh-ruby24-rubyeq2.4.0__75.el6
rh-ruby22-rubyeq2.2.2__11.el6
rh-ruby22-rubyeq2.2.2__15.el6
rh-ruby22-rubyeq2.2.2__16.el6
rh-ruby22-rubyeq2.2.2__16.el7
rh-ruby22-rubyeq2.2.2__12.el6
rh-ruby23-rubyeq2.3.1__64.el7
rh-ruby23-rubyeq2.3.1__64.el6
ruby:3.3eq2.2.4-r0

Name	Operator	Version
rh-ruby24-ruby	eq	2.4.0__75.el7
rh-ruby24-ruby	eq	2.4.0__75.el6
rh-ruby22-ruby	eq	2.2.2__11.el6
rh-ruby22-ruby	eq	2.2.2__15.el6
rh-ruby22-ruby	eq	2.2.2__16.el6
rh-ruby22-ruby	eq	2.2.2__16.el7
rh-ruby22-ruby	eq	2.2.2__12.el6
rh-ruby23-ruby	eq	2.3.1__64.el7
rh-ruby23-ruby	eq	2.3.1__64.el6
ruby:3.3	eq	2.2.4-r0