CVE-2019-17268 omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third party
A backdoor in the omniauth-weibo-oauth2 gem allows attackers to execute arbitrary code via malicious package distribution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-17268?
CVE-2019-17268 is a critical code injection vulnerability in n/a, published on 7 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected.
Weakness: CWE-94
Which versions are affected by CVE-2019-17268?
2 open source packages ship an affected version, including omniauth-weibo-oauth2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
omniauth-weibo-oauth2 RubyGems | From 0.4.6 | 0.5.1 |
omniauth-weibo-oauth2 RubyGems | From 0.4.6 | 0.5.1 |
Products include Omniauth-Weibo-Oauth2 Project Omniauth-Weibo-Oauth2.
How do I fix CVE-2019-17268?
Upgrade omniauth-weibo-oauth2 to 0.5.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-17268 being exploited?
There is no known exploitation of CVE-2019-17268 in the wild and no public exploit code.
Sources
Also known as GHSA-vr22-43gj-rx3f.