Critical Code Injection Vulnerability in Ruby Package
Summary
ALPINE-CVE-2019-16255: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. Affects ruby versions < 2.5.7-r0. Fixed in 2.5.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is a dynamic, open-source programming language with a focus on simplicity and productivity. It is widely used for web development, particularly with the Ruby on Rails framework. The Ruby package provides essential libraries and tools for developers. However, certain versions of Ruby are vulnerable to a code injection issue that can be exploited if untrusted data is passed to specific shell commands.
Vulnerability Detail
The vulnerability, identified as CVE-2019-16255, affects Ruby versions through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4. It allows for code injection when the first argument to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this vulnerability to execute arbitrary Ruby methods, potentially leading to unauthorized access or manipulation of the system.
How To Fix
Minimum fixed version
2.5.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing untrusted data to Shell#[] or Shell#test methods. Validate and sanitize any input before using it in these commands to mitigate the risk of code injection.
Conclusion
CVE-2019-16255 is a critical vulnerability in specific Ruby versions that can lead to code injection attacks. It is essential to update to the patched versions or implement workarounds to secure your applications. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for ruby →
FAQ
CVE-2019-16255 is a vulnerability in Ruby that allows code injection through untrusted data passed to shell commands.
Ruby versions through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without signup.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
If immediate updates are not possible, ensure to validate and sanitize any input before using it in shell commands to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
