CVE-2019-8324: Code Injection
A flaw was found in RubyGems. A crafted gem with a multi-line name is not handled correctly allowing an attacker to inject arbitrary code to the stub line of gemspec. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensureloadablespec during the preinstall check.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-8324?
CVE-2019-8324 is a vulnerability in RubyGems that allows an attacker to inject arbitrary code.
How does CVE-2019-8324 impact RubyGems?
CVE-2019-8324 impacts RubyGems by allowing an attacker to inject arbitrary code into a gem with a multi-line name.
What is the severity of CVE-2019-8324?
CVE-2019-8324 has a severity rating of 8.8, which is considered high.
Which versions of RubyGems are affected by CVE-2019-8324?
RubyGems versions 2.6 and later through 3.0.2 are affected by CVE-2019-8324.
Where can I find more information about CVE-2019-8324?
You can find more information about CVE-2019-8324 at the following references: [link1] [link2] [link3].