High · 7.8 CVE-2014-5002 EUVD-2018-0157GHSA-94cq-7ccq-cmcm

lynx doesn't properly sanitize user input and exposes database password to unauthorized users

Published Jan 10, 2018 · Updated Aug 6, 2024 · Assigned by mitre

Description

The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
RubyGems	lynx	< 1.0.0	1.0.0	GHSA-94cq-7ccq-cmcm

References

[oss-security] 20140707 Vulnerability Report for Ruby Gem lynx-0.2.0 mailing-list
[oss-security] 20140717 Re: Vulnerability Report for Ruby Gem codders-dataset-1.3.2.1 (etc.) mailing-list
https://github.com/panthomakos/lynx/issues/3
http://www.vapid.dhs.org/advisories/lynx-0.2.0.html