CVE-2019-8325 RubyGems Escape sequence injection in errors

High 7.5 Published 17 Jun 2019 Updated 4 Aug 2024

An attacker can inject escape sequences into RubyGems error messages, potentially manipulating terminal output or causing display issues.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-8325?

CVE-2019-8325 is a high-severity vulnerability in Debian Debian Linux, published on 17 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)

Weakness: CWE-74

Which versions are affected by CVE-2019-8325?

4 open source packages ship an affected version, including rubygems-update. It affects 3 products.

Package	Affected	Fixed in
`rubygems-update` RubyGems	From `2.6.0`	`2.7.9`
`rubygems-update` RubyGems	From `2.6.0`	`2.7.9`
`rubygems-update` RubyGems	From `3.0.0`	`3.0.2`
`rubygems-update` RubyGems	From `3.0.0`	`3.0.2`

Products include Debian Debian Linux, Opensuse Leap, Rubygems Rubygems.

How do I fix CVE-2019-8325?

Upgrade rubygems-update to a fixed version for your release line: 2.7.9 or 3.0.2.

Is CVE-2019-8325 being exploited?

There is no known exploitation of CVE-2019-8325 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2019-8325, DEBIAN-CVE-2019-8325, GHSA-4wm8-fjv7-j774, UBUNTU-CVE-2019-8325.