CVE-2019-16892
Fixed in a distro release EPSS 2%
In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).
Products: rubyzip_project rubyzip, fedoraproject fedora, redhat cloudforms
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | rubyzip | 1.3.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ruby-zip | 2.0.0-1 |
| Debian 13 | ruby-zip | 2.0.0-1 |
| Debian 14 | ruby-zip | 2.0.0-1 |
| Red Hat cloudforms managementengine 5.10 | cfme | 0:5.10.13.1-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | cfme-amazon-smartstate | 0:5.10.13.1-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | cfme-appliance | 0:5.10.13.1-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | cfme-appliance-common | 0:5.10.13.1-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | cfme-appliance-debuginfo | 0:5.10.13.1-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | cfme-appliance-tools | 0:5.10.13.1-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | cfme-debuginfo | 0:5.10.13.1-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | cfme-gemset | 0:5.10.13.1-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | cfme-gemset-debuginfo | 0:5.10.13.1-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | ruby | 0:2.4.9-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | ruby-debuginfo | 0:2.4.9-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | ruby-devel | 0:2.4.9-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | ruby-doc | 0:2.4.9-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | ruby-irb | 0:2.4.9-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | ruby-libs | 0:2.4.9-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | rubygem-bigdecimal | 0:1.3.2-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | rubygem-did_you_mean | 0:1.1.0-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | rubygem-io-console | 0:0.4.6-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | rubygem-minitest | 0:5.10.1-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | rubygem-net-telnet | 0:0.1.1-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | rubygem-openssl | 0:2.0.9-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | rubygem-power_assert | 0:0.4.1-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | rubygem-psych | 0:2.2.2-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | rubygem-rake | 0:12.0.0-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | rubygem-rdoc | 0:5.0.1-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | rubygem-test-unit | 0:3.2.3-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | rubygem-xmlrpc | 0:0.2.1-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | rubygems | 0:2.6.14.4-93.el7cf |
| Red Hat cloudforms managementengine 5.10 | rubygems-devel | 0:2.6.14.4-93.el7cf |
| Red Hat cloudforms managementengine 5.11 | cfme | 0:5.11.1.2-1.el8cf |
| Red Hat cloudforms managementengine 5.11 | cfme-amazon-smartstate | 0:5.11.1.2-1.el8cf |
| Red Hat cloudforms managementengine 5.11 | cfme-appliance | 0:5.11.1.2-1.el8cf |
| Red Hat cloudforms managementengine 5.11 | cfme-appliance-common | 0:5.11.1.2-1.el8cf |
| Red Hat cloudforms managementengine 5.11 | cfme-appliance-tools | 0:5.11.1.2-1.el8cf |
| Red Hat cloudforms managementengine 5.11 | cfme-gemset | 0:5.11.1.2-1.el8cf |
| Red Hat cloudforms managementengine 5.11 | ovirt-ansible-hosted-engine-setup | 0:1.0.28-1.el8ev |
| Red Hat cloudforms managementengine 5.11 | v2v-conversion-host | 0:1.15.0-1.el8ev |
| Red Hat cloudforms managementengine 5.11 | v2v-conversion-host-ansible | 0:1.15.0-1.el8ev |
| Ubuntu 16.04 LTS | ruby-zip | no fix |
| Ubuntu 18.04 LTS | ruby-zip | no fix |
| openSUSE Tumbleweed | vagrant | 2.2.18-1.3 |