Security restrictions bypass in Ruby - CVE-2018-16396

Vulnerability identifier: #VU15725

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2018-16396

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Ruby

Affected software:
Ruby

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to the tainted flags are not propagated with the B, b, H, and h directives. A remote attacker can supply inputs by Array#pack and/or String#unpack with these directives and checks the reliability with tainted flags and cause the check to be wrong to bypass security restrictions and conduct further attacks.

The vulnerability has been fixed in the versions 2.3.8, 2.4.5, 2.5.2.

• https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/