{"action":"Upgrade strong_password to 0.0.8 or later.","affected":[{"fixed":"0.0.8","introduced":"0.0.7"}],"component":"strong_password","cve_ids":["CVE-2019-13354"],"ecosystem":"RubyGems","epss":0.03329,"exploited":false,"fixed_versions":["0.0.8"],"ghsa_id":"GHSA-5h5r-ffc4-c455","id":"tcs_01M5KEH107DEXSY4B96E1VVMWE","modified_at":"2023-11-08T04:01:08.215454Z","published_at":"2019-07-08T20:32:35Z","references":["https://osv.dev/vulnerability/GHSA-5h5r-ffc4-c455","https://nvd.nist.gov/vuln/detail/CVE-2019-13354","https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-strong_password-0-0-7","https://github.com/bdmac/strong_password","https://github.com/bdmac/strong_password/releases","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/strong_password/CVE-2019-13354.yml","https://rubygems.org/gems/strong_password/versions","https://withatwist.dev/strong-password-rubygem-hijacked.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-5h5r-ffc4-c455","url":"https://osv.dev/vulnerability/GHSA-5h5r-ffc4-c455"}],"summary":"strong_password Ruby gem malicious version causing Remote Code Execution vulnerability"}