VYPR
← All advisories
High severityNVD Advisory· Published Jun 17, 2019· Updated Aug 4, 2024

CVE-2019-8324

CVE-2019-8324

Description

An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

RubyGems fails to properly handle crafted gem names with newlines, allowing arbitrary code injection during preinstall checks.

Vulnerability

Overview

CVE-2019-8324 is a code injection vulnerability in RubyGems versions 2.6 through 3.0.2. The issue lies in how the ensure_loadable_spec method processes a gem's gemspec stub line. When a crafted gem has a multi-line name, the stub line is not correctly sanitized, leading to arbitrary code being injected into that stub line [2]. This stub line is subsequently evaluated by ensure_loadable_spec during the preinstall check, executing the attacker's code [1].

Exploitation

Vector

Exploitation requires an attacker to supply a maliciously crafted gem to a user or system that attempts to install it using a vulnerable RubyGems version. The attack does not require authentication beyond the ability to provide a gem file (e.g., via a public gem server, a dependency, or social engineering) [3]. The preinstall check runs automatically when gem install or similar commands are invoked, providing a direct trigger for the injected code.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the user running the gem installation command. Since gem installations are often performed with elevated privileges (e.g., via sudo), this could lead to full system compromise, data exfiltration, or installation of persistent backdoors [1].

Mitigation

The RubyGems project released patched versions 2.7.8 and 3.0.3 to fix this vulnerability [3]. Users should upgrade to the latest stable version of RubyGems (3.0.3 or later) or apply the provided patch for versions 2.6.x. Red Hat also released updated packages for RHEL 8 (ruby-2.5.3-104.module+el8.0.0+3250+4b7d6d43) as part of RHSA-2019:1972 [1].

References
  1. https://access.redhat.com/errata/RHSA-2019:1972
  2. NVD - CVE-2019-8324
  3. March 2019 Security Advisories

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rubygems-updateRubyGems
>= 2.6.0, < 2.7.92.7.9
rubygems-updateRubyGems
>= 3.0.0, < 3.0.23.0.2

Affected products

39

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.