8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:N/I:C/A:C
0.005 Low
EPSS
Percentile
75.8%
Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.
Security Fix(es):
rubygems: Installing a malicious gem may lead to arbitrary code execution (CVE-2019-8324)
rubygems: Delete directory using symlink when decompressing tar (CVE-2019-8320)
rubygems: Escape sequence injection vulnerability in verbose (CVE-2019-8321)
rubygems: Escape sequence injection vulnerability in gem owner (CVE-2019-8322)
rubygems: Escape sequence injection vulnerability in API response handling (CVE-2019-8323)
rubygems: Escape sequence injection vulnerability in errors (CVE-2019-8325)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
This update fixes various bugs and adds enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
RedHat | 7 | x86_64 | ruby-libs | < 2.4.6-91.el7cf | ruby-libs-2.4.6-91.el7cf.x86_64.rpm |
RedHat | 7 | x86_64 | rubygem-did_you_mean | < 1.1.0-91.el7cf | rubygem-did_you_mean-1.1.0-91.el7cf.x86_64.rpm |
RedHat | 7 | noarch | ruby-doc | < 2.4.6-91.el7cf | ruby-doc-2.4.6-91.el7cf.noarch.rpm |
RedHat | 7 | noarch | rubygem-rake | < 12.0.0-91.el7cf | rubygem-rake-12.0.0-91.el7cf.noarch.rpm |
RedHat | 7 | noarch | rubygem-power_assert | < 0.4.1-91.el7cf | rubygem-power_assert-0.4.1-91.el7cf.noarch.rpm |
RedHat | 7 | x86_64 | rubygem-net-telnet | < 0.1.1-91.el7cf | rubygem-net-telnet-0.1.1-91.el7cf.x86_64.rpm |
RedHat | 7 | x86_64 | cfme | < 5.10.5.1-1.el7cf | cfme-5.10.5.1-1.el7cf.x86_64.rpm |
RedHat | 7 | x86_64 | cfme-appliance-common | < 5.10.5.1-1.el7cf | cfme-appliance-common-5.10.5.1-1.el7cf.x86_64.rpm |
RedHat | 7 | x86_64 | rubygem-bigdecimal | < 1.3.2-91.el7cf | rubygem-bigdecimal-1.3.2-91.el7cf.x86_64.rpm |
RedHat | 7 | x86_64 | rubygem-io-console | < 0.4.6-91.el7cf | rubygem-io-console-0.4.6-91.el7cf.x86_64.rpm |
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:N/I:C/A:C
0.005 Low
EPSS
Percentile
75.8%