Skip to content
OpenAdvisories
High · 7.5 CVE-2019-8323 EUVD-2019-0493GHSA-3h4r-pjv6-cph9

RubyGems Escape sequence injection vulnerability in api response handling

Published Jun 17, 2019 · Updated Aug 4, 2024 · Assigned by mitre

Description

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 jruby 9.1.17.0-3 —
Debian 14 rubygems 3.2.0~rc.1-1 —
Debian 13 jruby 9.1.17.0-3 —
Debian 13 rubygems 3.2.0~rc.1-1 —
Debian 12 jruby 9.1.17.0-3 —
Debian 12 rubygems 3.2.0~rc.1-1 —
Debian 9 jruby 1.7.26-1+deb9u2 DLA-2330-1
Debian 9 ruby2.3 2.3.3-1+deb9u6 DSA-4433-1
Debian 8 jruby 1.5.6-9+deb8u1 DLA-1796-1
Debian 8 ruby2.1 2.1.5-2+deb8u7 DLA-1735-1
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS jruby No fix yet —
Ubuntu 18.04 LTS ruby2.5 2.5.1-1ubuntu1.2 USN-3945-1
Ubuntu 16.04 LTS ruby2.3 2.3.1-2~16.04.12 USN-3945-1
Ubuntu 14.04 LTS ruby1.9.1 1.9.3.484-2ubuntu1.14 USN-3945-1
Ubuntu 14.04 LTS ruby2.0 2.0.0.484-1ubuntu2.13 USN-3945-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 14.04 LTS jruby 1.5.6-9+deb8u2build0.14.04.1~esm2 —
ReleasePackageFixed inAdvisory
RHEL 8 ruby +4 2.5.5-105.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-abrt +1 0.3.0-4.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-bigdecimal 1.3.4-105.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-bson +1 4.3.0-2.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-bundler +1 1.16.1-3.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-did_you_mean 1.2.0-105.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-io-console 0.4.6-105.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-json 2.1.0-105.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-minitest 5.10.3-105.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-mongo +1 2.5.1-2.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-mysql2 +1 0.4.10-4.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-net-telnet 0.1.1-105.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-openssl 2.1.2-105.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-pg +1 1.0.0-2.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-power_assert 1.1.1-105.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-psych 3.0.2-105.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-rake 12.3.0-105.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-rdoc 6.0.1-105.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-test-unit 3.2.7-105.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygem-xmlrpc 0.3.0-105.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 8 rubygems +1 2.7.6.2-105.module+el8.1.0+3656+f80bfa1d RHBA-2019:3384
RHEL 7 ruby +5 2.0.0.648-35.el7_6 RHSA-2019:1235
RHEL 7 rubygem-bigdecimal 1.2.0-35.el7_6 RHSA-2019:1235
RHEL 7 rubygem-io-console 0.4.2-35.el7_6 RHSA-2019:1235
RHEL 7 rubygem-json 1.7.7-35.el7_6 RHSA-2019:1235
RHEL 7 rubygem-minitest 4.3.2-35.el7_6 RHSA-2019:1235
RHEL 7 rubygem-psych 2.0.0-35.el7_6 RHSA-2019:1235
RHEL 7 rubygem-rake 0.9.6-35.el7_6 RHSA-2019:1235
RHEL 7 rubygem-rdoc 4.0.0-35.el7_6 RHSA-2019:1235
RHEL 7 rubygems +1 2.0.14.1-35.el7_6 RHSA-2019:1235
RHEL 3 rh-ruby24-ruby +4 2.4.6-92.el6 RHSA-2019:1150
RHEL 3 rh-ruby24-rubygem-bigdecimal 1.3.2-92.el6 RHSA-2019:1150
RHEL 3 rh-ruby24-rubygem-did_you_mean 1.1.0-92.el6 RHSA-2019:1150
RHEL 3 rh-ruby24-rubygem-io-console 0.4.6-92.el6 RHSA-2019:1150
RHEL 3 rh-ruby24-rubygem-json 2.0.4-92.el6 RHSA-2019:1150
RHEL 3 rh-ruby24-rubygem-minitest 5.10.1-92.el6 RHSA-2019:1150
RHEL 3 rh-ruby24-rubygem-net-telnet 0.1.1-92.el6 RHSA-2019:1150
RHEL 3 rh-ruby24-rubygem-openssl 2.0.9-92.el6 RHSA-2019:1150
RHEL 3 rh-ruby24-rubygem-power_assert 0.4.1-92.el6 RHSA-2019:1150
RHEL 3 rh-ruby24-rubygem-psych 2.2.2-92.el6 RHSA-2019:1150
RHEL 3 rh-ruby24-rubygem-rake 12.0.0-92.el6 RHSA-2019:1150
RHEL 3 rh-ruby24-rubygem-rdoc 5.0.0-92.el6 RHSA-2019:1150
RHEL 3 rh-ruby24-rubygem-test-unit 3.2.3-92.el6 RHSA-2019:1150
RHEL 3 rh-ruby24-rubygem-xmlrpc 0.2.1-92.el6 RHSA-2019:1150
RHEL 3 rh-ruby24-rubygems +1 2.6.14.4-92.el6 RHSA-2019:1150
RHEL 3 rh-ruby25-ruby +4 2.5.5-7.el7 RHSA-2019:1148
RHEL 3 rh-ruby25-rubygem-bigdecimal 1.3.4-7.el7 RHSA-2019:1148
RHEL 3 rh-ruby25-rubygem-did_you_mean 1.2.0-7.el7 RHSA-2019:1148
RHEL 3 rh-ruby25-rubygem-io-console 0.4.6-7.el7 RHSA-2019:1148
RHEL 3 rh-ruby25-rubygem-json 2.1.0-7.el7 RHSA-2019:1148
RHEL 3 rh-ruby25-rubygem-minitest 5.10.3-7.el7 RHSA-2019:1148
RHEL 3 rh-ruby25-rubygem-net-telnet 0.1.1-7.el7 RHSA-2019:1148
RHEL 3 rh-ruby25-rubygem-openssl 2.1.2-7.el7 RHSA-2019:1148
RHEL 3 rh-ruby25-rubygem-power_assert 1.1.1-7.el7 RHSA-2019:1148
RHEL 3 rh-ruby25-rubygem-psych 3.0.2-7.el7 RHSA-2019:1148
RHEL 3 rh-ruby25-rubygem-rake 12.3.0-7.el7 RHSA-2019:1148
RHEL 3 rh-ruby25-rubygem-rdoc 6.0.1-7.el7 RHSA-2019:1148
RHEL 3 rh-ruby25-rubygem-test-unit 3.2.7-7.el7 RHSA-2019:1148
RHEL 3 rh-ruby25-rubygem-xmlrpc 0.3.0-7.el7 RHSA-2019:1148
RHEL 3 rh-ruby25-rubygems +1 2.7.6.2-7.el7 RHSA-2019:1148
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 7.4 TUS ruby +5 2.0.0.648-37.el7_4 RHSA-2020:2769
RHEL 7.4 TUS rubygem-bigdecimal 1.2.0-37.el7_4 RHSA-2020:2769
RHEL 7.4 TUS rubygem-io-console 0.4.2-37.el7_4 RHSA-2020:2769
RHEL 7.4 TUS rubygem-json 1.7.7-37.el7_4 RHSA-2020:2769
RHEL 7.4 TUS rubygem-minitest 4.3.2-37.el7_4 RHSA-2020:2769
RHEL 7.4 TUS rubygem-psych 2.0.0-37.el7_4 RHSA-2020:2769
RHEL 7.4 TUS rubygem-rake 0.9.6-37.el7_4 RHSA-2020:2769
RHEL 7.4 TUS rubygem-rdoc 4.0.0-37.el7_4 RHSA-2020:2769
RHEL 7.4 TUS rubygems +1 2.0.14.1-37.el7_4 RHSA-2020:2769
RHEL 7.4 E4S ruby +5 2.0.0.648-37.el7_4 RHSA-2020:2769
RHEL 7.4 E4S rubygem-bigdecimal 1.2.0-37.el7_4 RHSA-2020:2769
RHEL 7.4 E4S rubygem-io-console 0.4.2-37.el7_4 RHSA-2020:2769
RHEL 7.4 E4S rubygem-json 1.7.7-37.el7_4 RHSA-2020:2769
RHEL 7.4 E4S rubygem-minitest 4.3.2-37.el7_4 RHSA-2020:2769
RHEL 7.4 E4S rubygem-psych 2.0.0-37.el7_4 RHSA-2020:2769
RHEL 7.4 E4S rubygem-rake 0.9.6-37.el7_4 RHSA-2020:2769
RHEL 7.4 E4S rubygem-rdoc 4.0.0-37.el7_4 RHSA-2020:2769
RHEL 7.4 E4S rubygems +1 2.0.14.1-37.el7_4 RHSA-2020:2769
RHEL 7.4 AUS ruby +5 2.0.0.648-37.el7_4 RHSA-2020:2769
RHEL 7.4 AUS rubygem-bigdecimal 1.2.0-37.el7_4 RHSA-2020:2769
RHEL 7.4 AUS rubygem-io-console 0.4.2-37.el7_4 RHSA-2020:2769
RHEL 7.4 AUS rubygem-json 1.7.7-37.el7_4 RHSA-2020:2769
RHEL 7.4 AUS rubygem-minitest 4.3.2-37.el7_4 RHSA-2020:2769
RHEL 7.4 AUS rubygem-psych 2.0.0-37.el7_4 RHSA-2020:2769
RHEL 7.4 AUS rubygem-rake 0.9.6-37.el7_4 RHSA-2020:2769
RHEL 7.4 AUS rubygem-rdoc 4.0.0-37.el7_4 RHSA-2020:2769
RHEL 7.4 AUS rubygems +1 2.0.14.1-37.el7_4 RHSA-2020:2769
Red Hat CloudForms 5 cfme +5 5.10.5.1-1.el7cf RHSA-2019:1429
Red Hat CloudForms 5 ruby +4 2.4.6-91.el7cf RHSA-2019:1429
Red Hat CloudForms 5 rubygem-bigdecimal 1.3.2-91.el7cf RHSA-2019:1429
Red Hat CloudForms 5 rubygem-did_you_mean 1.1.0-91.el7cf RHSA-2019:1429
Red Hat CloudForms 5 rubygem-io-console 0.4.6-91.el7cf RHSA-2019:1429
Red Hat CloudForms 5 rubygem-minitest 5.10.1-91.el7cf RHSA-2019:1429
Red Hat CloudForms 5 rubygem-net-telnet 0.1.1-91.el7cf RHSA-2019:1429
Red Hat CloudForms 5 rubygem-openssl 2.0.9-91.el7cf RHSA-2019:1429
Red Hat CloudForms 5 rubygem-power_assert 0.4.1-91.el7cf RHSA-2019:1429
Red Hat CloudForms 5 rubygem-psych 2.2.2-91.el7cf RHSA-2019:1429
Red Hat CloudForms 5 rubygem-rake 12.0.0-91.el7cf RHSA-2019:1429
Red Hat CloudForms 5 rubygem-rdoc 5.0.0-91.el7cf RHSA-2019:1429
Red Hat CloudForms 5 rubygem-test-unit 3.2.3-91.el7cf RHSA-2019:1429
Red Hat CloudForms 5 rubygem-xmlrpc 0.2.1-91.el7cf RHSA-2019:1429
Red Hat CloudForms 5 rubygems +1 2.6.14.4-91.el7cf RHSA-2019:1429

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 rubygem-abrt +1 0.3.0-4.module_el8.5.0+259+8cec6917 ALBA-2019:3384
AlmaLinux 8 rubygem-bson +1 4.3.0-2.module_el8.5.0+259+8cec6917 ALBA-2019:3384
AlmaLinux 8 rubygem-mongo +1 2.5.1-2.module_el8.5.0+259+8cec6917 ALBA-2019:3384
AlmaLinux 8 rubygem-mysql2 +1 0.4.10-4.module_el8.5.0+259+8cec6917 ALBA-2019:3384
AlmaLinux 8 rubygem-pg +1 1.0.0-2.module_el8.5.0+259+8cec6917 ALBA-2019:3384
ReleasePackageFixed inAdvisory
SLES 15 SP1 ruby2.5 2.5.5-4.3.1 SUSE-SU-2019:1804-1
SLES 15 ruby2.5 2.5.5-4.3.1 SUSE-SU-2019:1804-1
SLES 12 SP5 ruby2.1 2.1.9-19.3.2 SUSE-SU-2020:1570-1
SLES 12 SP4 ruby2.1 2.1.9-19.3.2 SUSE-SU-2020:1570-1
SLES 12 SP3 ruby2.1 2.1.9-19.3.2 SUSE-SU-2020:1570-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP2 ruby2.1 2.1.9-19.3.2 SUSE-SU-2020:1570-1
SLES 12 SP2 yast2-ruby-bindings 3.1.53-9.8.1 SUSE-SU-2020:1570-1
SLES for SAP 12 SP5 ruby2.1 2.1.9-19.3.2 SUSE-SU-2020:1570-1
SLES for SAP 12 SP4 ruby2.1 2.1.9-19.3.2 SUSE-SU-2020:1570-1
SLES for SAP 12 SP3 ruby2.1 2.1.9-19.3.2 SUSE-SU-2020:1570-1
SLES for SAP 12 SP2 ruby2.1 2.1.9-19.3.2 SUSE-SU-2020:1570-1
SLES for SAP 12 SP2 yast2-ruby-bindings 3.1.53-9.8.1 SUSE-SU-2020:1570-1
SUSE OpenStack Cloud Crowbar 8 ruby2.1 2.1.9-19.3.2 SUSE-SU-2020:1570-1
SUSE OpenStack Cloud 8 ruby2.1 2.1.9-19.3.2 SUSE-SU-2020:1570-1
SUSE OpenStack Cloud 7 ruby2.1 2.1.9-19.3.2 SUSE-SU-2020:1570-1
SUSE OpenStack Cloud 7 yast2-ruby-bindings 3.1.53-9.8.1 SUSE-SU-2020:1570-1
SUSE HPE Helion OpenStack 8 ruby2.1 2.1.9-19.3.2 SUSE-SU-2020:1570-1
SUSE Enterprise Storage 5 ruby2.1 2.1.9-19.3.2 SUSE-SU-2020:1570-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.1 ruby-bundled-gems-rpmhelper 0.0.2-lp151.2.1 openSUSE-SU-2019:1771-1
openSUSE Leap 15.1 ruby2.5 2.5.5-lp151.4.3.1 openSUSE-SU-2019:1771-1
openSUSE Leap 15.0 ruby-bundled-gems-rpmhelper 0.0.2-lp151.2.1 openSUSE-SU-2019:1771-1
openSUSE Leap 15.0 ruby2.5 2.5.5-lp151.4.3.1 openSUSE-SU-2019:1771-1
ReleasePackageFixed inAdvisory
Alpine v3.9 ruby 2.5.5-r0 —
Alpine v3.8 ruby 2.5.5-r0 —
Alpine v3.7 ruby 2.4.6-r0 —
Alpine v3.6 ruby 2.4.6-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 ruby +5 2.0.0.648-35.amzn2.0.1 ALAS2-2019-1249
Amazon Linux 2 rubygem-bigdecimal 1.2.0-35.amzn2.0.1 ALAS2-2019-1249
Amazon Linux 2 rubygem-io-console 0.4.2-35.amzn2.0.1 ALAS2-2019-1249
Amazon Linux 2 rubygem-json 1.7.7-35.amzn2.0.1 ALAS2-2019-1249
Amazon Linux 2 rubygem-minitest 4.3.2-35.amzn2.0.1 ALAS2-2019-1249
Amazon Linux 2 rubygem-psych 2.0.0-35.amzn2.0.1 ALAS2-2019-1249
Amazon Linux 2 rubygem-rake 0.9.6-35.amzn2.0.1 ALAS2-2019-1249
Amazon Linux 2 rubygem-rdoc 4.0.0-35.amzn2.0.1 ALAS2-2019-1249
Amazon Linux 2 rubygems +1 2.0.14.1-35.amzn2.0.1 ALAS2-2019-1249

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 ruby +5 2.0.0.648-35.el7_6 ELSA-2019-1235
Oracle Linux 7 rubygem-bigdecimal 1.2.0-35.el7_6 ELSA-2019-1235
Oracle Linux 7 rubygem-io-console 0.4.2-35.el7_6 ELSA-2019-1235
Oracle Linux 7 rubygem-json 1.7.7-35.el7_6 ELSA-2019-1235
Oracle Linux 7 rubygem-minitest 4.3.2-35.el7_6 ELSA-2019-1235
Oracle Linux 7 rubygem-psych 2.0.0-35.el7_6 ELSA-2019-1235
Oracle Linux 7 rubygem-rake 0.9.6-35.el7_6 ELSA-2019-1235
Oracle Linux 7 rubygem-rdoc 4.0.0-35.el7_6 ELSA-2019-1235
Oracle Linux 7 rubygems +1 2.0.14.1-35.el7_6 ELSA-2019-1235

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems rubygems-update >= 2.6.0, < 2.7.9 2.7.9 GHSA-3h4r-pjv6-cph9
RubyGems rubygems-update >= 3.0.0, < 3.0.2 3.0.2 GHSA-3h4r-pjv6-cph9

Advisories 17

References