GHSA-vr22-43gj-rx3f

Suggest an improvement
Source
https://github.com/advisories/GHSA-vr22-43gj-rx3f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vr22-43gj-rx3f/GHSA-vr22-43gj-rx3f.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vr22-43gj-rx3f
Aliases
  • CVE-2019-17268
Published
2022-05-24T17:08:14Z
Modified
2023-11-08T04:01:23.253873Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third party
Details

The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected.

References

Affected packages

RubyGems / omniauth-weibo-oauth2

Package

Name
omniauth-weibo-oauth2
Purl
pkg:gem/omniauth-weibo-oauth2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.4.6
Fixed
0.5.1