VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Sep 25, 2019· Updated Jun 17, 2026

CVE-2019-16892

CVE-2019-16892

Description

In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rubyzipRubyGems
< 1.3.01.3.0

Affected products

9
  • Red Hat/Cloudforms2 versions
    cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:cloudforms:5.11:*:*:*:*:*:*:*
  • Rubyzip Project/Rubyzip
    cpe:2.3:a:rubyzip_project:rubyzip:*:*:*:*:*:*:*:*
    Range: <1.3.0
  • Fedoraproject/Fedora3 versions
    cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
  • Rubyzip/Rubyzipdescription
  • ghsa-coords2 versions
    pkg:gem/rubyzippkg:rpm/opensuse/vagrant&distro=openSUSE%20Tumbleweed
    < 1.3.0+ 1 more
    • (no CPE)range: < 1.3.0
    • (no CPE)range: < 2.2.18-1.3

Patches

Vulnerability mechanics

References

17

News mentions

0

No linked articles in our index yet.