Privilege Escalation

2019-05-1603:22:57

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.014 Low

EPSS

Percentile

86.6%

JSON

Ruby is vulnerable to privilege escalation attacks. A remote user could supply a specially crafted Array#pack and String#unpack array to cause the target system to fail to properly check security controls. The B, b, H, and h directives are not properly propagated.

CPENameOperatorVersion
rh-ruby23-rubyeq2.3.8__69.sc1.el7
rh-ruby23-rubyeq2.3.6__67.el7
rh-ruby23-rubyeq2.3.6__67.el6
rh-ruby23-rubyeq2.3.1__64.el6
rh-ruby23-rubyeq2.3.1__64.el7
rh-ruby24-rubyeq2.4.3__90.el6
rh-ruby24-rubyeq2.4.0__75.el7
rh-ruby24-rubyeq2.4.2__86.el6
rh-ruby24-rubyeq2.4.3__90.el7
rh-ruby24-rubyeq2.4.5__91.sc1.el7

Name	Operator	Version
rh-ruby23-ruby	eq	2.3.8__69.sc1.el7
rh-ruby23-ruby	eq	2.3.6__67.el7
rh-ruby23-ruby	eq	2.3.6__67.el6
rh-ruby23-ruby	eq	2.3.1__64.el6
rh-ruby23-ruby	eq	2.3.1__64.el7
rh-ruby24-ruby	eq	2.4.3__90.el6
rh-ruby24-ruby	eq	2.4.0__75.el7
rh-ruby24-ruby	eq	2.4.2__86.el6
rh-ruby24-ruby	eq	2.4.3__90.el7
rh-ruby24-ruby	eq	2.4.5__91.sc1.el7