CVE-2019-16892: In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed

Medium severity · published Sep 25, 2019

CVE-2019-16892

In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed

5.5

CVSS

1.6%

EPSS

On KEV

Description

In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack vector

Local

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.6% · higher than 75% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Cloudforms · Redhat

4.7; 5.11 · source: NVD

Fedora · Fedoraproject

29; 30; 31 · source: NVD

Rubyzip · Rubyzip Project

before 1.3.0 · source: NVD

Affected product

Fedora

Fedoraproject

All Fedora CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-16892

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-16892

Third Party Advisory

https://access.redhat.com/errata/RHBA-2019:4047

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:4201

Patch

https://github.com/rubyzip/rubyzip/commit/d65fe7bd283ec94f9d6dc7605f61a6b0dd00f55e

Exploit

https://github.com/rubyzip/rubyzip/pull/403

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO6/

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWWPORMSBHZTMP4PGF4DQD22TTKBQMMC/