Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

Privacy Policy
Terms of Service
Contact

CVE-2019-16255 — HIGH severity vulnerability | Release Alert

CVE-2019-16255

8.1

HIGHCVSS v3

Published

November 26, 2019

CVSS v2

6.8 MEDIUM

Affected

6 projects

Assigned by

MITRE

Severity scale

010

Description

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.

Ruby

ChocolateyRuby is a dynamic, open source programming language focusing on simplicity and productivity. It has an elegant syntax that is natural to read and easy to write. This package provides a self-contained [Windows-based installer](https://rubyinstaller.org) that includes the Ruby language, an execution environment, important documentation, and more. ## Package Parameters - `/InstallDir` - Ruby installation directory, by default `c:\tools\RubyXY` where XY are major and minor version parts. - `/NoPath` - Do not add ruby bin folder to machine PATH. Example: `choco install ruby --package-parameters="'/NoPath ""/InstallDir:C:\your\install\path""'"` ## Notes - To install ruby development kit ruby installer provides `ridk` command. It provides an easy way to install msys2 via `ridk install 1`, however, the installation is interactive. To accomplish unattended install, use [msys2](https://chocolatey.org/packages/msys2) package.

>= 2.6.0, <= 2.6.4, >= 2.5.0, <= 2.5.6, >= 2.4.0, <= 2.4.7NVD