Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 6 |
CVE-ID | CVE-2019-8324 CVE-2019-8325 CVE-2019-8322 CVE-2019-8323 CVE-2019-8320 CVE-2019-8321 |
CWE-ID | CWE-94 CWE-79 CWE-22 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Amazon Linux AMI Operating systems & Components / Operating system |
Vendor | Amazon Web Services |
Security Bulletin
This security bulletin contains information about 6 vulnerabilities.
EUVDB-ID: #VU20189
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-8324
CWE-ID:
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation when processing multiple line entries within gems in ensure_loadable_spec(). A remote attacker can send a specially crafted gem, inject malicious code into stub line of gemspec and execute it code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected packages:
i686:Vulnerable software versions
ruby20-libs-2.0.0.648-1.32.amzn1.i686
ruby20-debuginfo-2.0.0.648-1.32.amzn1.i686
rubygem20-bigdecimal-1.2.0-1.32.amzn1.i686
ruby20-devel-2.0.0.648-1.32.amzn1.i686
rubygem20-psych-2.0.0-1.32.amzn1.i686
rubygem20-io-console-0.4.2-1.32.amzn1.i686
ruby20-2.0.0.648-1.32.amzn1.i686
ruby21-2.1.9-1.22.amzn1.i686
rubygem21-bigdecimal-1.2.4-1.22.amzn1.i686
ruby21-debuginfo-2.1.9-1.22.amzn1.i686
rubygem21-io-console-0.4.3-1.22.amzn1.i686
ruby21-devel-2.1.9-1.22.amzn1.i686
rubygem21-psych-2.0.5-1.22.amzn1.i686
ruby21-libs-2.1.9-1.22.amzn1.i686
ruby24-2.4.5-1.30.11.amzn1.i686
rubygem24-json-2.0.4-1.30.11.amzn1.i686
rubygem24-bigdecimal-1.3.2-1.30.11.amzn1.i686
ruby24-debuginfo-2.4.5-1.30.11.amzn1.i686
rubygem24-io-console-0.4.6-1.30.11.amzn1.i686
rubygem24-psych-2.2.2-1.30.11.amzn1.i686
ruby24-libs-2.4.5-1.30.11.amzn1.i686
rubygem24-xmlrpc-0.2.1-1.30.11.amzn1.i686
ruby24-devel-2.4.5-1.30.11.amzn1.i686
noarch:
ruby20-irb-2.0.0.648-1.32.amzn1.noarch
ruby20-doc-2.0.0.648-1.32.amzn1.noarch
rubygems20-devel-2.0.14.1-1.32.amzn1.noarch
rubygems20-2.0.14.1-1.32.amzn1.noarch
ruby21-irb-2.1.9-1.22.amzn1.noarch
rubygems21-devel-2.2.5-1.22.amzn1.noarch
ruby21-doc-2.1.9-1.22.amzn1.noarch
rubygems21-2.2.5-1.22.amzn1.noarch
rubygems24-2.6.14.3-1.30.11.amzn1.noarch
rubygem24-did_you_mean-1.1.0-1.30.11.amzn1.noarch
rubygems24-devel-2.6.14.3-1.30.11.amzn1.noarch
ruby24-doc-2.4.5-1.30.11.amzn1.noarch
ruby24-irb-2.4.5-1.30.11.amzn1.noarch
src:
ruby20-2.0.0.648-1.32.amzn1.src
ruby21-2.1.9-1.22.amzn1.src
ruby24-2.4.5-1.30.11.amzn1.src
x86_64:
ruby20-devel-2.0.0.648-1.32.amzn1.x86_64
rubygem20-bigdecimal-1.2.0-1.32.amzn1.x86_64
ruby20-debuginfo-2.0.0.648-1.32.amzn1.x86_64
rubygem20-io-console-0.4.2-1.32.amzn1.x86_64
ruby20-2.0.0.648-1.32.amzn1.x86_64
rubygem20-psych-2.0.0-1.32.amzn1.x86_64
ruby20-libs-2.0.0.648-1.32.amzn1.x86_64
rubygem21-psych-2.0.5-1.22.amzn1.x86_64
ruby21-devel-2.1.9-1.22.amzn1.x86_64
ruby21-libs-2.1.9-1.22.amzn1.x86_64
ruby21-debuginfo-2.1.9-1.22.amzn1.x86_64
rubygem21-bigdecimal-1.2.4-1.22.amzn1.x86_64
ruby21-2.1.9-1.22.amzn1.x86_64
rubygem21-io-console-0.4.3-1.22.amzn1.x86_64
rubygem24-json-2.0.4-1.30.11.amzn1.x86_64
ruby24-devel-2.4.5-1.30.11.amzn1.x86_64
ruby24-debuginfo-2.4.5-1.30.11.amzn1.x86_64
rubygem24-bigdecimal-1.3.2-1.30.11.amzn1.x86_64
rubygem24-io-console-0.4.6-1.30.11.amzn1.x86_64
ruby24-2.4.5-1.30.11.amzn1.x86_64
ruby24-libs-2.4.5-1.30.11.amzn1.x86_64
rubygem24-xmlrpc-0.2.1-1.30.11.amzn1.x86_64
rubygem24-psych-2.2.2-1.30.11.amzn1.x86_64
Amazon Linux AMI: All versions
External linkshttp://alas.aws.amazon.com/ALAS-2019-1255.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU20190
Risk: Low
CVSSv3.1: 3.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-8325
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability exists due to improper input validation when processing alerts in the Gem::CommandManager#run. A remote attacker can inject and execute arbitrary HTML or JavaScript code.
MitigationUpdate the affected packages:
i686:Vulnerable software versions
ruby20-libs-2.0.0.648-1.32.amzn1.i686
ruby20-debuginfo-2.0.0.648-1.32.amzn1.i686
rubygem20-bigdecimal-1.2.0-1.32.amzn1.i686
ruby20-devel-2.0.0.648-1.32.amzn1.i686
rubygem20-psych-2.0.0-1.32.amzn1.i686
rubygem20-io-console-0.4.2-1.32.amzn1.i686
ruby20-2.0.0.648-1.32.amzn1.i686
ruby21-2.1.9-1.22.amzn1.i686
rubygem21-bigdecimal-1.2.4-1.22.amzn1.i686
ruby21-debuginfo-2.1.9-1.22.amzn1.i686
rubygem21-io-console-0.4.3-1.22.amzn1.i686
ruby21-devel-2.1.9-1.22.amzn1.i686
rubygem21-psych-2.0.5-1.22.amzn1.i686
ruby21-libs-2.1.9-1.22.amzn1.i686
ruby24-2.4.5-1.30.11.amzn1.i686
rubygem24-json-2.0.4-1.30.11.amzn1.i686
rubygem24-bigdecimal-1.3.2-1.30.11.amzn1.i686
ruby24-debuginfo-2.4.5-1.30.11.amzn1.i686
rubygem24-io-console-0.4.6-1.30.11.amzn1.i686
rubygem24-psych-2.2.2-1.30.11.amzn1.i686
ruby24-libs-2.4.5-1.30.11.amzn1.i686
rubygem24-xmlrpc-0.2.1-1.30.11.amzn1.i686
ruby24-devel-2.4.5-1.30.11.amzn1.i686
noarch:
ruby20-irb-2.0.0.648-1.32.amzn1.noarch
ruby20-doc-2.0.0.648-1.32.amzn1.noarch
rubygems20-devel-2.0.14.1-1.32.amzn1.noarch
rubygems20-2.0.14.1-1.32.amzn1.noarch
ruby21-irb-2.1.9-1.22.amzn1.noarch
rubygems21-devel-2.2.5-1.22.amzn1.noarch
ruby21-doc-2.1.9-1.22.amzn1.noarch
rubygems21-2.2.5-1.22.amzn1.noarch
rubygems24-2.6.14.3-1.30.11.amzn1.noarch
rubygem24-did_you_mean-1.1.0-1.30.11.amzn1.noarch
rubygems24-devel-2.6.14.3-1.30.11.amzn1.noarch
ruby24-doc-2.4.5-1.30.11.amzn1.noarch
ruby24-irb-2.4.5-1.30.11.amzn1.noarch
src:
ruby20-2.0.0.648-1.32.amzn1.src
ruby21-2.1.9-1.22.amzn1.src
ruby24-2.4.5-1.30.11.amzn1.src
x86_64:
ruby20-devel-2.0.0.648-1.32.amzn1.x86_64
rubygem20-bigdecimal-1.2.0-1.32.amzn1.x86_64
ruby20-debuginfo-2.0.0.648-1.32.amzn1.x86_64
rubygem20-io-console-0.4.2-1.32.amzn1.x86_64
ruby20-2.0.0.648-1.32.amzn1.x86_64
rubygem20-psych-2.0.0-1.32.amzn1.x86_64
ruby20-libs-2.0.0.648-1.32.amzn1.x86_64
rubygem21-psych-2.0.5-1.22.amzn1.x86_64
ruby21-devel-2.1.9-1.22.amzn1.x86_64
ruby21-libs-2.1.9-1.22.amzn1.x86_64
ruby21-debuginfo-2.1.9-1.22.amzn1.x86_64
rubygem21-bigdecimal-1.2.4-1.22.amzn1.x86_64
ruby21-2.1.9-1.22.amzn1.x86_64
rubygem21-io-console-0.4.3-1.22.amzn1.x86_64
rubygem24-json-2.0.4-1.30.11.amzn1.x86_64
ruby24-devel-2.4.5-1.30.11.amzn1.x86_64
ruby24-debuginfo-2.4.5-1.30.11.amzn1.x86_64
rubygem24-bigdecimal-1.3.2-1.30.11.amzn1.x86_64
rubygem24-io-console-0.4.6-1.30.11.amzn1.x86_64
ruby24-2.4.5-1.30.11.amzn1.x86_64
ruby24-libs-2.4.5-1.30.11.amzn1.x86_64
rubygem24-xmlrpc-0.2.1-1.30.11.amzn1.x86_64
rubygem24-psych-2.2.2-1.30.11.amzn1.x86_64
Amazon Linux AMI: All versions
External linkshttp://alas.aws.amazon.com/ALAS-2019-1255.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU20191
Risk: Low
CVSSv3.1: 3.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-8322
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when displaying contents of the API response directly to stdout. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationUpdate the affected packages:
i686:Vulnerable software versions
ruby20-libs-2.0.0.648-1.32.amzn1.i686
ruby20-debuginfo-2.0.0.648-1.32.amzn1.i686
rubygem20-bigdecimal-1.2.0-1.32.amzn1.i686
ruby20-devel-2.0.0.648-1.32.amzn1.i686
rubygem20-psych-2.0.0-1.32.amzn1.i686
rubygem20-io-console-0.4.2-1.32.amzn1.i686
ruby20-2.0.0.648-1.32.amzn1.i686
ruby21-2.1.9-1.22.amzn1.i686
rubygem21-bigdecimal-1.2.4-1.22.amzn1.i686
ruby21-debuginfo-2.1.9-1.22.amzn1.i686
rubygem21-io-console-0.4.3-1.22.amzn1.i686
ruby21-devel-2.1.9-1.22.amzn1.i686
rubygem21-psych-2.0.5-1.22.amzn1.i686
ruby21-libs-2.1.9-1.22.amzn1.i686
ruby24-2.4.5-1.30.11.amzn1.i686
rubygem24-json-2.0.4-1.30.11.amzn1.i686
rubygem24-bigdecimal-1.3.2-1.30.11.amzn1.i686
ruby24-debuginfo-2.4.5-1.30.11.amzn1.i686
rubygem24-io-console-0.4.6-1.30.11.amzn1.i686
rubygem24-psych-2.2.2-1.30.11.amzn1.i686
ruby24-libs-2.4.5-1.30.11.amzn1.i686
rubygem24-xmlrpc-0.2.1-1.30.11.amzn1.i686
ruby24-devel-2.4.5-1.30.11.amzn1.i686
noarch:
ruby20-irb-2.0.0.648-1.32.amzn1.noarch
ruby20-doc-2.0.0.648-1.32.amzn1.noarch
rubygems20-devel-2.0.14.1-1.32.amzn1.noarch
rubygems20-2.0.14.1-1.32.amzn1.noarch
ruby21-irb-2.1.9-1.22.amzn1.noarch
rubygems21-devel-2.2.5-1.22.amzn1.noarch
ruby21-doc-2.1.9-1.22.amzn1.noarch
rubygems21-2.2.5-1.22.amzn1.noarch
rubygems24-2.6.14.3-1.30.11.amzn1.noarch
rubygem24-did_you_mean-1.1.0-1.30.11.amzn1.noarch
rubygems24-devel-2.6.14.3-1.30.11.amzn1.noarch
ruby24-doc-2.4.5-1.30.11.amzn1.noarch
ruby24-irb-2.4.5-1.30.11.amzn1.noarch
src:
ruby20-2.0.0.648-1.32.amzn1.src
ruby21-2.1.9-1.22.amzn1.src
ruby24-2.4.5-1.30.11.amzn1.src
x86_64:
ruby20-devel-2.0.0.648-1.32.amzn1.x86_64
rubygem20-bigdecimal-1.2.0-1.32.amzn1.x86_64
ruby20-debuginfo-2.0.0.648-1.32.amzn1.x86_64
rubygem20-io-console-0.4.2-1.32.amzn1.x86_64
ruby20-2.0.0.648-1.32.amzn1.x86_64
rubygem20-psych-2.0.0-1.32.amzn1.x86_64
ruby20-libs-2.0.0.648-1.32.amzn1.x86_64
rubygem21-psych-2.0.5-1.22.amzn1.x86_64
ruby21-devel-2.1.9-1.22.amzn1.x86_64
ruby21-libs-2.1.9-1.22.amzn1.x86_64
ruby21-debuginfo-2.1.9-1.22.amzn1.x86_64
rubygem21-bigdecimal-1.2.4-1.22.amzn1.x86_64
ruby21-2.1.9-1.22.amzn1.x86_64
rubygem21-io-console-0.4.3-1.22.amzn1.x86_64
rubygem24-json-2.0.4-1.30.11.amzn1.x86_64
ruby24-devel-2.4.5-1.30.11.amzn1.x86_64
ruby24-debuginfo-2.4.5-1.30.11.amzn1.x86_64
rubygem24-bigdecimal-1.3.2-1.30.11.amzn1.x86_64
rubygem24-io-console-0.4.6-1.30.11.amzn1.x86_64
ruby24-2.4.5-1.30.11.amzn1.x86_64
ruby24-libs-2.4.5-1.30.11.amzn1.x86_64
rubygem24-xmlrpc-0.2.1-1.30.11.amzn1.x86_64
rubygem24-psych-2.2.2-1.30.11.amzn1.x86_64
Amazon Linux AMI: All versions
External linkshttp://alas.aws.amazon.com/ALAS-2019-1255.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU20192
Risk: Low
CVSSv3.1: 3.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-8323
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in Gem::GemcutterUtilities#with_response when displaying data in the API. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationUpdate the affected packages:
i686:Vulnerable software versions
ruby20-libs-2.0.0.648-1.32.amzn1.i686
ruby20-debuginfo-2.0.0.648-1.32.amzn1.i686
rubygem20-bigdecimal-1.2.0-1.32.amzn1.i686
ruby20-devel-2.0.0.648-1.32.amzn1.i686
rubygem20-psych-2.0.0-1.32.amzn1.i686
rubygem20-io-console-0.4.2-1.32.amzn1.i686
ruby20-2.0.0.648-1.32.amzn1.i686
ruby21-2.1.9-1.22.amzn1.i686
rubygem21-bigdecimal-1.2.4-1.22.amzn1.i686
ruby21-debuginfo-2.1.9-1.22.amzn1.i686
rubygem21-io-console-0.4.3-1.22.amzn1.i686
ruby21-devel-2.1.9-1.22.amzn1.i686
rubygem21-psych-2.0.5-1.22.amzn1.i686
ruby21-libs-2.1.9-1.22.amzn1.i686
ruby24-2.4.5-1.30.11.amzn1.i686
rubygem24-json-2.0.4-1.30.11.amzn1.i686
rubygem24-bigdecimal-1.3.2-1.30.11.amzn1.i686
ruby24-debuginfo-2.4.5-1.30.11.amzn1.i686
rubygem24-io-console-0.4.6-1.30.11.amzn1.i686
rubygem24-psych-2.2.2-1.30.11.amzn1.i686
ruby24-libs-2.4.5-1.30.11.amzn1.i686
rubygem24-xmlrpc-0.2.1-1.30.11.amzn1.i686
ruby24-devel-2.4.5-1.30.11.amzn1.i686
noarch:
ruby20-irb-2.0.0.648-1.32.amzn1.noarch
ruby20-doc-2.0.0.648-1.32.amzn1.noarch
rubygems20-devel-2.0.14.1-1.32.amzn1.noarch
rubygems20-2.0.14.1-1.32.amzn1.noarch
ruby21-irb-2.1.9-1.22.amzn1.noarch
rubygems21-devel-2.2.5-1.22.amzn1.noarch
ruby21-doc-2.1.9-1.22.amzn1.noarch
rubygems21-2.2.5-1.22.amzn1.noarch
rubygems24-2.6.14.3-1.30.11.amzn1.noarch
rubygem24-did_you_mean-1.1.0-1.30.11.amzn1.noarch
rubygems24-devel-2.6.14.3-1.30.11.amzn1.noarch
ruby24-doc-2.4.5-1.30.11.amzn1.noarch
ruby24-irb-2.4.5-1.30.11.amzn1.noarch
src:
ruby20-2.0.0.648-1.32.amzn1.src
ruby21-2.1.9-1.22.amzn1.src
ruby24-2.4.5-1.30.11.amzn1.src
x86_64:
ruby20-devel-2.0.0.648-1.32.amzn1.x86_64
rubygem20-bigdecimal-1.2.0-1.32.amzn1.x86_64
ruby20-debuginfo-2.0.0.648-1.32.amzn1.x86_64
rubygem20-io-console-0.4.2-1.32.amzn1.x86_64
ruby20-2.0.0.648-1.32.amzn1.x86_64
rubygem20-psych-2.0.0-1.32.amzn1.x86_64
ruby20-libs-2.0.0.648-1.32.amzn1.x86_64
rubygem21-psych-2.0.5-1.22.amzn1.x86_64
ruby21-devel-2.1.9-1.22.amzn1.x86_64
ruby21-libs-2.1.9-1.22.amzn1.x86_64
ruby21-debuginfo-2.1.9-1.22.amzn1.x86_64
rubygem21-bigdecimal-1.2.4-1.22.amzn1.x86_64
ruby21-2.1.9-1.22.amzn1.x86_64
rubygem21-io-console-0.4.3-1.22.amzn1.x86_64
rubygem24-json-2.0.4-1.30.11.amzn1.x86_64
ruby24-devel-2.4.5-1.30.11.amzn1.x86_64
ruby24-debuginfo-2.4.5-1.30.11.amzn1.x86_64
rubygem24-bigdecimal-1.3.2-1.30.11.amzn1.x86_64
rubygem24-io-console-0.4.6-1.30.11.amzn1.x86_64
ruby24-2.4.5-1.30.11.amzn1.x86_64
ruby24-libs-2.4.5-1.30.11.amzn1.x86_64
rubygem24-xmlrpc-0.2.1-1.30.11.amzn1.x86_64
rubygem24-psych-2.2.2-1.30.11.amzn1.x86_64
Amazon Linux AMI: All versions
External linkshttp://alas.aws.amazon.com/ALAS-2019-1255.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU20193
Risk: Low
CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-8320
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in gems. A remote attacker can trick the victim to load a specially crafted gem and delete arbitrary files on the system.
Update the affected packages:
i686:Vulnerable software versions
ruby20-libs-2.0.0.648-1.32.amzn1.i686
ruby20-debuginfo-2.0.0.648-1.32.amzn1.i686
rubygem20-bigdecimal-1.2.0-1.32.amzn1.i686
ruby20-devel-2.0.0.648-1.32.amzn1.i686
rubygem20-psych-2.0.0-1.32.amzn1.i686
rubygem20-io-console-0.4.2-1.32.amzn1.i686
ruby20-2.0.0.648-1.32.amzn1.i686
ruby21-2.1.9-1.22.amzn1.i686
rubygem21-bigdecimal-1.2.4-1.22.amzn1.i686
ruby21-debuginfo-2.1.9-1.22.amzn1.i686
rubygem21-io-console-0.4.3-1.22.amzn1.i686
ruby21-devel-2.1.9-1.22.amzn1.i686
rubygem21-psych-2.0.5-1.22.amzn1.i686
ruby21-libs-2.1.9-1.22.amzn1.i686
ruby24-2.4.5-1.30.11.amzn1.i686
rubygem24-json-2.0.4-1.30.11.amzn1.i686
rubygem24-bigdecimal-1.3.2-1.30.11.amzn1.i686
ruby24-debuginfo-2.4.5-1.30.11.amzn1.i686
rubygem24-io-console-0.4.6-1.30.11.amzn1.i686
rubygem24-psych-2.2.2-1.30.11.amzn1.i686
ruby24-libs-2.4.5-1.30.11.amzn1.i686
rubygem24-xmlrpc-0.2.1-1.30.11.amzn1.i686
ruby24-devel-2.4.5-1.30.11.amzn1.i686
noarch:
ruby20-irb-2.0.0.648-1.32.amzn1.noarch
ruby20-doc-2.0.0.648-1.32.amzn1.noarch
rubygems20-devel-2.0.14.1-1.32.amzn1.noarch
rubygems20-2.0.14.1-1.32.amzn1.noarch
ruby21-irb-2.1.9-1.22.amzn1.noarch
rubygems21-devel-2.2.5-1.22.amzn1.noarch
ruby21-doc-2.1.9-1.22.amzn1.noarch
rubygems21-2.2.5-1.22.amzn1.noarch
rubygems24-2.6.14.3-1.30.11.amzn1.noarch
rubygem24-did_you_mean-1.1.0-1.30.11.amzn1.noarch
rubygems24-devel-2.6.14.3-1.30.11.amzn1.noarch
ruby24-doc-2.4.5-1.30.11.amzn1.noarch
ruby24-irb-2.4.5-1.30.11.amzn1.noarch
src:
ruby20-2.0.0.648-1.32.amzn1.src
ruby21-2.1.9-1.22.amzn1.src
ruby24-2.4.5-1.30.11.amzn1.src
x86_64:
ruby20-devel-2.0.0.648-1.32.amzn1.x86_64
rubygem20-bigdecimal-1.2.0-1.32.amzn1.x86_64
ruby20-debuginfo-2.0.0.648-1.32.amzn1.x86_64
rubygem20-io-console-0.4.2-1.32.amzn1.x86_64
ruby20-2.0.0.648-1.32.amzn1.x86_64
rubygem20-psych-2.0.0-1.32.amzn1.x86_64
ruby20-libs-2.0.0.648-1.32.amzn1.x86_64
rubygem21-psych-2.0.5-1.22.amzn1.x86_64
ruby21-devel-2.1.9-1.22.amzn1.x86_64
ruby21-libs-2.1.9-1.22.amzn1.x86_64
ruby21-debuginfo-2.1.9-1.22.amzn1.x86_64
rubygem21-bigdecimal-1.2.4-1.22.amzn1.x86_64
ruby21-2.1.9-1.22.amzn1.x86_64
rubygem21-io-console-0.4.3-1.22.amzn1.x86_64
rubygem24-json-2.0.4-1.30.11.amzn1.x86_64
ruby24-devel-2.4.5-1.30.11.amzn1.x86_64
ruby24-debuginfo-2.4.5-1.30.11.amzn1.x86_64
rubygem24-bigdecimal-1.3.2-1.30.11.amzn1.x86_64
rubygem24-io-console-0.4.6-1.30.11.amzn1.x86_64
ruby24-2.4.5-1.30.11.amzn1.x86_64
ruby24-libs-2.4.5-1.30.11.amzn1.x86_64
rubygem24-xmlrpc-0.2.1-1.30.11.amzn1.x86_64
rubygem24-psych-2.2.2-1.30.11.amzn1.x86_64
Amazon Linux AMI: All versions
External linkshttp://alas.aws.amazon.com/ALAS-2019-1255.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU20194
Risk: Low
CVSSv3.1: 3.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-8321
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in Gem::UserInteraction#verbose. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationUpdate the affected packages:
i686:Vulnerable software versions
ruby20-libs-2.0.0.648-1.32.amzn1.i686
ruby20-debuginfo-2.0.0.648-1.32.amzn1.i686
rubygem20-bigdecimal-1.2.0-1.32.amzn1.i686
ruby20-devel-2.0.0.648-1.32.amzn1.i686
rubygem20-psych-2.0.0-1.32.amzn1.i686
rubygem20-io-console-0.4.2-1.32.amzn1.i686
ruby20-2.0.0.648-1.32.amzn1.i686
ruby21-2.1.9-1.22.amzn1.i686
rubygem21-bigdecimal-1.2.4-1.22.amzn1.i686
ruby21-debuginfo-2.1.9-1.22.amzn1.i686
rubygem21-io-console-0.4.3-1.22.amzn1.i686
ruby21-devel-2.1.9-1.22.amzn1.i686
rubygem21-psych-2.0.5-1.22.amzn1.i686
ruby21-libs-2.1.9-1.22.amzn1.i686
ruby24-2.4.5-1.30.11.amzn1.i686
rubygem24-json-2.0.4-1.30.11.amzn1.i686
rubygem24-bigdecimal-1.3.2-1.30.11.amzn1.i686
ruby24-debuginfo-2.4.5-1.30.11.amzn1.i686
rubygem24-io-console-0.4.6-1.30.11.amzn1.i686
rubygem24-psych-2.2.2-1.30.11.amzn1.i686
ruby24-libs-2.4.5-1.30.11.amzn1.i686
rubygem24-xmlrpc-0.2.1-1.30.11.amzn1.i686
ruby24-devel-2.4.5-1.30.11.amzn1.i686
noarch:
ruby20-irb-2.0.0.648-1.32.amzn1.noarch
ruby20-doc-2.0.0.648-1.32.amzn1.noarch
rubygems20-devel-2.0.14.1-1.32.amzn1.noarch
rubygems20-2.0.14.1-1.32.amzn1.noarch
ruby21-irb-2.1.9-1.22.amzn1.noarch
rubygems21-devel-2.2.5-1.22.amzn1.noarch
ruby21-doc-2.1.9-1.22.amzn1.noarch
rubygems21-2.2.5-1.22.amzn1.noarch
rubygems24-2.6.14.3-1.30.11.amzn1.noarch
rubygem24-did_you_mean-1.1.0-1.30.11.amzn1.noarch
rubygems24-devel-2.6.14.3-1.30.11.amzn1.noarch
ruby24-doc-2.4.5-1.30.11.amzn1.noarch
ruby24-irb-2.4.5-1.30.11.amzn1.noarch
src:
ruby20-2.0.0.648-1.32.amzn1.src
ruby21-2.1.9-1.22.amzn1.src
ruby24-2.4.5-1.30.11.amzn1.src
x86_64:
ruby20-devel-2.0.0.648-1.32.amzn1.x86_64
rubygem20-bigdecimal-1.2.0-1.32.amzn1.x86_64
ruby20-debuginfo-2.0.0.648-1.32.amzn1.x86_64
rubygem20-io-console-0.4.2-1.32.amzn1.x86_64
ruby20-2.0.0.648-1.32.amzn1.x86_64
rubygem20-psych-2.0.0-1.32.amzn1.x86_64
ruby20-libs-2.0.0.648-1.32.amzn1.x86_64
rubygem21-psych-2.0.5-1.22.amzn1.x86_64
ruby21-devel-2.1.9-1.22.amzn1.x86_64
ruby21-libs-2.1.9-1.22.amzn1.x86_64
ruby21-debuginfo-2.1.9-1.22.amzn1.x86_64
rubygem21-bigdecimal-1.2.4-1.22.amzn1.x86_64
ruby21-2.1.9-1.22.amzn1.x86_64
rubygem21-io-console-0.4.3-1.22.amzn1.x86_64
rubygem24-json-2.0.4-1.30.11.amzn1.x86_64
ruby24-devel-2.4.5-1.30.11.amzn1.x86_64
ruby24-debuginfo-2.4.5-1.30.11.amzn1.x86_64
rubygem24-bigdecimal-1.3.2-1.30.11.amzn1.x86_64
rubygem24-io-console-0.4.6-1.30.11.amzn1.x86_64
ruby24-2.4.5-1.30.11.amzn1.x86_64
ruby24-libs-2.4.5-1.30.11.amzn1.x86_64
rubygem24-xmlrpc-0.2.1-1.30.11.amzn1.x86_64
rubygem24-psych-2.2.2-1.30.11.amzn1.x86_64
Amazon Linux AMI: All versions
External linkshttp://alas.aws.amazon.com/ALAS-2019-1255.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.