Critical Code Injection Vulnerability in JRuby and Ruby Packages
Summary
UBUNTU-CVE-2019-16255: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. Affects jruby versions < 1.5.6-9+deb8u2build0.14.04.1~esm2. Fixed in 1.5.6-9+deb8u2build0.14.04.1~esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JRuby is an implementation of the Ruby programming language that runs on the Java Virtual Machine (JVM). It allows Ruby applications to leverage Java libraries and provides a bridge between Ruby and Java. The Ruby packages, including versions 2.3, 2.5, and 2.6, are widely used for web development and scripting. The vulnerability in question affects these packages, allowing untrusted data to be executed as code, which poses a significant security risk.
Vulnerability Detail
Ruby through versions 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 contains a critical vulnerability that allows code injection via the Shell#[] or Shell#test methods in lib/shell.rb. If the first argument to these methods is untrusted data, an attacker can exploit this to execute arbitrary Ruby methods, leading to potential system compromise. This vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
1.5.6-9+deb8u2build0.14.04.1~esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jrubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using untrusted data as arguments in Shell#[] or Shell#test methods. Implement input validation to sanitize any user inputs before passing them to these methods.
Conclusion
The vulnerability in JRuby and Ruby packages poses a significant risk due to its potential for code injection. It is crucial for users to update their packages to the latest patched versions and implement input validation as a temporary workaround. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for jruby →
FAQ
The vulnerability allows code injection through untrusted data passed to specific Ruby methods, potentially leading to arbitrary code execution.
Affected versions include Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Check your application at Vulert Scanner.
Implement input validation to sanitize user inputs and avoid using untrusted data in the affected methods as a temporary measure.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for jruby.
