CVE-2014-5002: Infoleak
First published: Wed Jan 10 2018(Updated: )
The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lynx Project Lynx | <1.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2014-5002
- https://github.com/panthomakos/lynx/issues/3
- http://www.openwall.com/lists/oss-security/2014/07/07/23
- http://www.openwall.com/lists/oss-security/2014/07/17/5
- http://www.vapid.dhs.org/advisories/lynx-0.2.0.html
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lynx/CVE-2014-5002.yml
- https://github.com/advisories/GHSA-94cq-7ccq-cmcm (Advisory)
Frequently Asked Questions
What is CVE-2014-5002?
CVE-2014-5002 is a vulnerability in the lynx gem prior to version 1.0.0 for Ruby that exposes configured passwords on command lines, allowing local users to obtain sensitive information by listing processes.
What is the severity of CVE-2014-5002?
CVE-2014-5002 has a severity value of 7.8 (High).
How does CVE-2014-5002 affect lynx gem?
CVE-2014-5002 affects the lynx gem versions up to and including 0.4.0 for Ruby.
How can the CVE-2014-5002 vulnerability be fixed?
To fix the CVE-2014-5002 vulnerability, it is recommended to upgrade to version 1.0.0 or higher of the lynx gem for Ruby.
What are the references for CVE-2014-5002?
The references for CVE-2014-5002 are: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-5002), [GitHub Issue](https://github.com/panthomakos/lynx/issues/3), [Openwall Mailing List](http://www.openwall.com/lists/oss-security/2014/07/07/23).
- collector/github-advisory-latest
- alias/GHSA-94cq-7ccq-cmcm
- alias/CVE-2014-5002
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/event
- agent/author
- agent/type
- agent/description
- agent/first-publish-date
- agent/tags
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- package-manager/rubygems
- vendor/lynx project
- canonical/lynx project lynx