RubyGems Escape sequence injection vulnerability in api response handling
High severity
GitHub Reviewed
Published
Jun 20, 2019
to the GitHub Advisory Database
•
Updated Aug 28, 2023
Package
Affected versions
>= 2.6.0, < 2.7.9
>= 3.0.0, < 3.0.2
Patched versions
2.7.9
3.0.2
Description
Reviewed
Jun 20, 2019
Published to the GitHub Advisory Database
Jun 20, 2019
Last updated
Aug 28, 2023
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.
References