GHSA-4g4c-8gqh-m4vm

paranoid2 gem Code backdoor

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-13589

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	paranoid2	1.1.6	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-13589 advisory
https://github.com/rubygems/rubygems.org/issues/2051 web
https://github.com/anjlab/paranoid2 package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/paranoid2/CVE-2019-13589.yml web
https://rubygems.org/gems/paranoid2/versions web
https://snyk.io/vuln/SNYK-RUBY-PARANOID2-451600 web
http://www.securityfocus.com/bid/109281 web