CVE-2019-8323

HIGH7.5EPSS 0.33%

RubyGems Escape sequence injection vulnerability in api response handling

Published: 6/20/2019Modified: 11/19/2025

Also known as:GHSA-3h4r-pjv6-cph9ALPINE-CVE-2019-8323DEBIAN-CVE-2019-8323

Description

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.

Affected packages (4)

Alpine/rubyfrom 0, < 2.4.6-r0
Debian/jrubyfrom 0, < 9.1.17.0-3
Debian/rubygemsfrom 0, < 3.2.0~rc.1-1
RubyGems/rubygems-update>= 2.6.0, < 2.7.9

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References (8)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-8323
ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2019-8323
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2019-8323
WEBhttp://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
WEBhttps://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
WEBhttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2019-8323.yml
WEBhttps://hackerone.com/reports/315081
WEBhttps://lists.debian.org/debian-lts-announce/2020/08/msg00027.html