CVE-2019-8322

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.htmlMailing List, Third Party Advisory
https://hackerone.com/reports/315087Permissions Required, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00027.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.htmlMailing List, Third Party Advisory
https://hackerone.com/reports/315087Permissions Required, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00027.htmlMailing List, Third Party Advisory

Timeline

Published: Jun 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-83237.5An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout CVE-2019-83248.8An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, a CVE-2019-83257.5An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape se CVE-2019-83316.1In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.CVE-2019-83346.1An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&viewid=[XSS].CVE-2019-83356.1An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&id=[XSS].CVE-2019-83368.1HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges CVE-2019-83375.3In msmtp 1.8.2 and mpop 1.4.3, when tls_trust_file has its default configuration, certificate-verification results are not properly checked.CVE-2019-83385.9The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier, does not verify the status of the signature CVE-2019-83395.5An issue was discovered in Falco through 0.14.0. A missing indicator for insufficient resources allows local users to bypass the detection e CVE-2019-83419.8An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "sourc CVE-2019-83427.8A Local Privilege Escalation in libqcocoa.dylib in Foxit Reader 3.1.0.0111 on macOS has been discovered due to an incorrect permission set.