Input validation error in Ruby - CVE-2019-15845

Vulnerability identifier: #VU23006

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-15845

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists in Ruby due to insufficient validation of user-supplied files within File.fnmatch and File.fnmatch? functions when processing NUL byte in the filename. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the system.

Ruby
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Opensuse
Red Hat Software Collections
ruby (Alpine package)
ruby2.3 (Debian package)
ruby2.5 (Debian package)
ruby2.5 (Ubuntu package)
rh-ruby25-ruby (Red Hat package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
rh-ruby26-ruby (Red Hat package)
EMC Integrated Data Protection Appliance
IBM Cloud Foundry Migration Runtime
Oracle GraalVM Enterprise Edition
Dell EMC Data Protection Search

Install updates from vendor's website.

Ruby - addressed in versions 2.4.8, 2.5.7, 2.6.5
ruby (Alpine package) - update to 2.5.7-r0
EMC Integrated Data Protection Appliance - update to 2.7.1
ruby2.3 (Debian package) - update to 2.3.3-1+deb9u7
ruby2.5 (Debian package) - update to 2.5.5-3+deb10u1
ruby2.5 (Ubuntu package) - addressed in versions 2.5.1-1ubuntu1.6, 2.5.5-1ubuntu1.1, 2.5.5-4ubuntu2.1
rh-ruby25-ruby (Red Hat package) - update to 2.5.9-9.el7
IBM Cloud Foundry Migration Runtime - update to 4.1.2
Dell EMC Data Protection Search - update to 19.6.0
rh-ruby26-ruby (Red Hat package) - update to 2.6.7-119.el7

• https://hackerone.com/reports/44961
• https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-4-8-released/
• https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-5-7-released/
• https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-6-5-released/
• https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/

• Multiple vulnerabilities in Ruby
• Ubuntu update for Ruby
• Debian update for ruby2.3
• Debian update for ruby2.5
• Multiple vulnerabilities in Oracle GraalVM Enterprise Edition
• Gentoo update for Ruby
• OpenSUSE update for ruby
• Input validation error in ruby (Alpine package)
• Amazon Linux AMI update for ruby24
• Red Hat Software Collections update for rh-ruby25-ruby
• Red Hat Software Collections update for rh-ruby26-ruby
• Red Hat Enterprise Linux 8 update for the ruby:2.5 module
• Red Hat Enterprise Linux 8 update for the ruby:2.6 module
• Red Hat Enterprise Linux 8.1 update for the ruby:2.6 module
• Red Hat Enterprise Linux 8.2 update for the ruby:2.6 module
• Multiple vulnerabilities in Dell EMC Integrated Data Protection Appliance
• Multiple vulnerabilities in Dell EMC Data Protection Search
• Multiple vulnerabilities in IBM Cloud Foundry Migration Runtime