medium6.5
CVE-2019-15845
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
Impact
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ruby-Lang | Ruby | from 2.4.0 through 2.4.7 from 2.5.0 through 2.5.6 from 2.6.0 through 2.6.4 |
| Canonical | Ubuntu Linux | Versions 16.04, 18.04, 19.04, 19.10 |
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
- https://hackerone.com/reports/449617
- https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html
- https://seclists.org/bugtraq/2019/Dec/31
- https://seclists.org/bugtraq/2019/Dec/32
- https://security.gentoo.org/glsa/202003-06
- https://usn.ubuntu.com/4201-1/
- https://www.debian.org/security/2019/dsa-4587
- https://www.oracle.com/security-alerts/cpujan2020.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
- https://hackerone.com/reports/449617
- https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html
- https://seclists.org/bugtraq/2019/Dec/31
- https://seclists.org/bugtraq/2019/Dec/32
- https://security.gentoo.org/glsa/202003-06
- https://usn.ubuntu.com/4201-1/
- https://www.debian.org/security/2019/dsa-4587
- https://www.oracle.com/security-alerts/cpujan2020.html