CVE-2019-16892: Medium severity Rubyzip Project Rubyzip vulnerability

Q: What is the vulnerability ID of this issue?

The vulnerability ID of this issue is CVE-2019-16892.

Q: What is the severity of CVE-2019-16892?

The severity of CVE-2019-16892 is high.

Q: How does CVE-2019-16892 affect Rubyzip?

CVE-2019-16892 affects Rubyzip versions before 1.3.0.

Q: What is the impact of CVE-2019-16892?

The impact of CVE-2019-16892 is a denial of service (disk consumption).

Q: How can I fix CVE-2019-16892?

To fix CVE-2019-16892, update Rubyzip to version 1.3.0 or later.

Published Sep 25, 2019

Updated

A vulnerability was found in Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

Reference: https://github.com/rubyzip/rubyzip/pull/403

Affected Software

8 affected componentsFixes available

rubygems/rubyzip<1.3.0

1.3.0

redhat/Rubyzip<1.3.0

1.3.0

Rubyzip Project Rubyzip<1.3.0

Fedoraproject Fedora=29

Fedoraproject Fedora=30

Fedoraproject Fedora=31

redhat Cloudforms=4.7

redhat Cloudforms=5.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rubygems/rubyzip to a version that resolves this vulnerability.
Fixed in 1.3.0
Upgrade
Upgrade redhat/Rubyzip to a version that resolves this vulnerability.
Fixed in 1.3.0
Upgrade
Upgrade Rubyzip to a version that resolves this vulnerability.
Fixed in 1.3.0

Event History

Sep 25, 2019

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Sep 30, 2019

Advisory Published

04:05 PM

Nov 12, 2019

Data Sourced

via Red Hat·06:52 AM

DescriptionSeverityAffected Software

Feb 6, 58434

Event

02:33 PM

Frequently Asked Questions

What is the vulnerability ID of this issue?

The vulnerability ID of this issue is CVE-2019-16892.

What is the severity of CVE-2019-16892?