Risk | High |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2019-16255 |
CWE-ID | CWE-94 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
ruby (Alpine package) Operating systems & Components / Operating system package or component |
Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one high risk vulnerability.
EUVDB-ID: #VU23009
Risk: High
CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-16255
CWE-ID:
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in lib/shell.rb in Ruby when processing Shell#[] and its alias Shell#test. A remote attacker can send a specially crafted request and execute arbitrary Ruby code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall update from vendor's website.
Vulnerable software versionsruby (Alpine package): 1.8.7-r0 - 2.5.5-r0
ruby (Alpine package):
External linkshttp://git.alpinelinux.org/aports/commit/?id=9187c18b5ec330fb9b5af90d85672f02af3a15d5
http://git.alpinelinux.org/aports/commit/?id=2831552db46aa5611d731c169b45810977d7b96a
http://git.alpinelinux.org/aports/commit/?id=9d8c04b05e9bd2d754e1d7fafde8d286b14751d9
http://git.alpinelinux.org/aports/commit/?id=d64618fe60af05a9e866c32d4bff6db761f2ea2b
http://git.alpinelinux.org/aports/commit/?id=4badd65f51c8099060803ef81deb2857141a06cd
http://git.alpinelinux.org/aports/commit/?id=9f704bf9da4bdb94ea9e7bcee0259b0b5f8f937d
http://git.alpinelinux.org/aports/commit/?id=b8817649bf6c0bceb6e5ad1133c8436de4a889ab
http://git.alpinelinux.org/aports/commit/?id=fba16f258980f2a04d905339e7b167b481e8f5d6
http://git.alpinelinux.org/aports/commit/?id=b21ba46a1a4971aee0a5432e0f30b42ff7d8ccdf
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.