CVE-2019-16892

Published: Sep 25, 2019Modified: Nov 21, 2024

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

Affected (6)

Products: Rubyzip Project: Rubyzip · Fedoraproject: Fedora · Redhat: Cloudforms

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Rubyzip Project Rubyzip	Before 1.3.0

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 29
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Cloudforms	Version 4.7
Redhat Cloudforms	Version 5.11

References (14)

https://access.redhat.com/errata/RHBA-2019:4047

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:4201

Source: cve@mitre.org

Third Party Advisory

https://github.com/rubyzip/rubyzip/commit/d65fe7bd283ec94f9d6dc7605f61a6b0dd00f55e

Source: cve@mitre.org

Patch

https://github.com/rubyzip/rubyzip/pull/403

Source: cve@mitre.org

ExploitIssue TrackingPatchThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO6/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWWPORMSBHZTMP4PGF4DQD22TTKBQMMC/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X255K6ZBAQC462PQN2ND5HOTTQEJ2G2X/

Source: cve@mitre.org

Mailing List

https://access.redhat.com/errata/RHBA-2019:4047