logo

Database

Asymmetric denial of service In rubyzip

Description

Rubyzip denial of service In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2019-168922. NVD-2019-168923. OSV-DEBIAN-2019-168924. OSV-2019-168925. GCVE-2019-168926. SECURITY-TRACKER-CVE-2019-168927. access.redhat.com8. access.redhat.com

References

1. https://github.com/rubyzip/rubyzip/pull/4032. https://github.com/rubyzip/rubyzip/commit/d65fe7bd283ec94f9d6dc7605f61a6b0dd00f55e3. https://github.com/jdleesmiller/ruby-advisory-db/blob/master/gems/rubyzip/CVE-2019-16892.yml4. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubyzip/CVE-2019-16892.yml5. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO66. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWWPORMSBHZTMP4PGF4DQD22TTKBQMMC7. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X255K6ZBAQC462PQN2ND5HOTTQEJ2G2X8. https://lists.fedoraproject.org/archives/list/[email protected]/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO69. https://lists.fedoraproject.org/archives/list/[email protected]/message/MWWPORMSBHZTMP4PGF4DQD22TTKBQMMC10. https://lists.fedoraproject.org/archives/list/[email protected]/message/X255K6ZBAQC462PQN2ND5HOTTQEJ2G2X

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.