GHSA-6fcq-3cm2-j3j5

Kcapifony gem for Ruby places database user passwords on the command line

Source: GitHub Advisory Database (reviewed) High CVE-2014-5001

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	kcapifony	<= 2.1.6	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

`lib/ksymfony1.rb` in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) `mysqldump`, (2) `pg_dump`, (3) `mysql`, and (4) `psql` command lines, which allows local users to obtain sensitive information by listing the processes.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2014-5001 advisory
https://github.com/Kunstmaan/kCapifony package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/kcapifony/CVE-2014-5001.yml web
http://www.openwall.com/lists/oss-security/2014/07/07/21 web
http://www.openwall.com/lists/oss-security/2014/07/17/5 web
http://www.vapid.dhs.org/advisories/kcapifony-2.1.6.html web