Echor Ruby Gem credentials can be stolen via process table monitoring

2022-05-1403:44:51

Google

osv.dev

0.0004 Low

EPSS

Percentile

5.1%

JSON

The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table.

CPENameOperatorVersion
echoreq0.1.4
echoreq0.1.6
echoreq0.1.5

Name	Operator	Version
echor	eq	0.1.4
echor	eq	0.1.6
echor	eq	0.1.5

References

www.openwall.com/lists/oss-security/2014/01/31/10

github.com/rubysec/ruby-advisory-db/blob/master/gems/echor/CVE-2014-1835.yml

nvd.nist.gov/vuln/detail/CVE-2014-1835

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for OSV:GHSA-J4GX-P3X5-M987