CVE-2014-5002: Infoleak
The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.
Other sources
The lynx gem prior to 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.
As of version 1.0.0, lynx no longer supports a --password option. Passwords are only configured in a configuration file, so it's no longer possible to expose passwords on the command line.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2014-5002?
CVE-2014-5002 is a vulnerability in the lynx gem prior to version 1.0.0 for Ruby that exposes configured passwords on command lines, allowing local users to obtain sensitive information by listing processes.
What is the severity of CVE-2014-5002?
CVE-2014-5002 has a severity value of 7.8 (High).
How does CVE-2014-5002 affect lynx gem?
CVE-2014-5002 affects the lynx gem versions up to and including 0.4.0 for Ruby.
How can the CVE-2014-5002 vulnerability be fixed?
To fix the CVE-2014-5002 vulnerability, it is recommended to upgrade to version 1.0.0 or higher of the lynx gem for Ruby.
What are the references for CVE-2014-5002?
The references for CVE-2014-5002 are: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-5002), [GitHub Issue](https://github.com/panthomakos/lynx/issues/3), [Openwall Mailing List](http://www.openwall.com/lists/oss-security/2014/07/07/23).