RubyGems/railties CVE-2019-5420: critical 9.8, EPSS 89.33%
Use of Insufficiently Random Values in Railties Allows Remote Code Execution
Action: Upgrade railties to 5.2.2.1 or later.
bundle update railtiesAffected
| introduced | fixed | last affected |
|---|---|---|
| 5.2.0 | 5.2.2.1 | - |
Fixed versions
| 5.2.2.1 |
Sources
- osv: GHSA-m42h-mh85-4qgc
- https://nvd.nist.gov/vuln/detail/CVE-2019-5420
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/railties/CVE-2019-5420.yml
- https://groups.google.com/forum/#!topic/rubyonrails-security/IsQKvDqZdKw
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA
- https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released
- https://www.exploit-db.com/exploits/46785
- http://packetstormsecurity.com/files/152704/Ruby-On-Rails-DoubleTap-Development-Mode-secret_key_base-Remote-Code-Execution.html
CVE-2019-5420 · published · modified · JSON