RubySec

Providing security resources for the Ruby community

CVE-2014-5000 (lawn-login): lawn-login Gem for Ruby /lib/lawn.rb Process Table Local Plaintext Password Disclosure

ADVISORIES

GEM

lawn-login

PATCHED VERSIONS

None.

DESCRIPTION

lawn-login Gem for Ruby contains a flaw in /lib/lawn.rb that is due to the application exposing password information in plaintext in the process table. This may allow a local attacker to gain access to password information.