backup_checksum Gem for Ruby /lib/backup/cli/utility.rb Process List Local Plaintext Password Disclosure
Published: June 30, 2014
SECURITY IDENTIFIERS
- CVE: CVE-2014-4993 (NVD)
- GHSA: GHSA-wr5j-q359-6vr2
- OSVDB: OSVDB-108569
GEM
SEVERITY
PATCHED VERSIONS
None available.
DESCRIPTION
backup_checksum Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb that is triggered as the program displays password information in plaintext in the process list. This may allow a local attacker to gain access to password information.
RELATED
- https://nvd.nist.gov/vuln/detail/CVE-2014-4993
- https://rubygems.org/gems/backup_checksum/versions/3.0.23
- https://my.diffend.io/gems/backup_checksum/3.0.23
- http://www.openwall.com/lists/oss-security/2014/07/17/5
- http://www.openwall.com/lists/oss-security/2014/07/07/12
- http://www.vapid.dhs.org/advisories/backup_checksum-3.0.23.html
- https://github.com/backup/backup
- http://rubygems.org/gems/backup
- https://backup.github.io/backup/v4/release-notes
- https://github.com/advisories/GHSA-wr5j-q359-6vr2