CVE-2019-16060 Airbrake keys not being filtered
The Airbrake Ruby notifier may disclose passwords to unauthorized actors if the blacklist_keys configuration option is mishandled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-16060?
CVE-2019-16060 is a critical vulnerability in n/a, published on 6 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 (also, 4.2.2 and earlier are unaffected).
Which versions are affected by CVE-2019-16060?
2 open source packages ship an affected version, including airbrake-ruby. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
airbrake-ruby RubyGems | From 4.2.3 | 4.2.4 |
airbrake-ruby RubyGems | From 4.2.3 | 4.2.4 |
Products include Airbrake Airbrake Ruby.
How do I fix CVE-2019-16060?
Upgrade airbrake-ruby to 4.2.4 or later.
Is CVE-2019-16060 being exploited?
There is no known exploitation of CVE-2019-16060 in the wild and no public exploit code.
Sources
Also known as GHSA-2p82-v77v-mppr.