CVE-2019-15845: Medium severity ruby-lang Ruby vulnerability
A flaw was discovered in Ruby in the way certain functions handled strings containing NULL bytes. Specifically, the built-in methods File.fnmatch and its alias File.fnmatch? did not properly handle path patterns containing the NULL byte. A remote attacker could exploit this flaw to make a Ruby script access unexpected files and to bypass intended file system access restrictions.
Other sources
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2019-15845.
What is the severity level of CVE-2019-15845?
The severity level of CVE-2019-15845 is medium.
Which software versions are affected by this vulnerability?
The affected software versions are Ruby 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by making a Ruby script process a specially crafted path pattern containing a NULL byte.
Where can I find more information about CVE-2019-15845?
More information about CVE-2019-15845 can be found at the following references: [Link 1](https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/), [Link 2](https://hackerone.com/reports/449617), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1789408).