CVE-2019-16255
ruby: Code injection via command argument of Shell#test / Shell#[]
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
Ruby versiones hasta 2.4.7, versiones 2.5.x hasta 2.5.6 y versiones 2.6.x hasta 2.6.4, permite una inyección de código si el primer argumento (también conocido como el argumento "command") para Shell#[] o Shell#test en la biblioteca lib/shell.rb es un dato no seguro. Un atacante puede explotar esto para llamar a un método de Ruby arbitrario.
It was discovered that Ruby incorrectly handled certain files. An attacker could possibly use this issue to pass path matching what can lead to an unauthorized access. It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could use this issue to cause a denial of service. It was discovered that Ruby incorrectly handled certain HTTP headers. An attacker could possibly use this issue to execute arbitrary code. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-09-11 CVE Reserved
- 2019-11-26 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (17)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html | Mailing List |
|
| https://seclists.org/bugtraq/2019/Dec/31 | Broken Link |
|
| https://seclists.org/bugtraq/2019/Dec/32 | Broken Link |
|
| https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released | Release Notes | |
| https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released | Release Notes | |
| https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released | Release Notes |
| URL | Date | SRC |
|---|---|---|
| https://hackerone.com/reports/327512 | 2024-08-05 |
| URL | Date | SRC |
|---|---|---|
| https://www.oracle.com/security-alerts/cpujan2020.html | 2023-04-30 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | >= 2.4.0 <= 2.4.7 Search vendor "Ruby-lang" for product "Ruby" and version " >= 2.4.0 <= 2.4.7" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | >= 2.5.0 <= 2.5.6 Search vendor "Ruby-lang" for product "Ruby" and version " >= 2.5.0 <= 2.5.6" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | >= 2.6.0 <= 2.6.4 Search vendor "Ruby-lang" for product "Ruby" and version " >= 2.6.0 <= 2.6.4" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 15.1 Search vendor "Opensuse" for product "Leap" and version "15.1" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Graalvm Search vendor "Oracle" for product "Graalvm" | 19.3.0.2 Search vendor "Oracle" for product "Graalvm" and version "19.3.0.2" | enterprise |
Affected
| ||||||