Skip to content
OpenAdvisories
High · 7.8 CVE-2014-4999 EUVD-2022-2415GHSA-4ph7-5c44-pppv

kajam allows local users to obtain sensitive information by listing the process

Published Jan 10, 2018 · Updated Aug 6, 2024 · Assigned by mitre

Description

vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump command line in the capture function and (2) mysql command line in the restore function, which allows local users to obtain sensitive information by listing the process.

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems kajam <= 1.0.3.rc2 — GHSA-4ph7-5c44-pppv

References