{"id":"GHSA-5h5r-ffc4-c455","summary":"strong_password Ruby gem malicious version causing Remote Code Execution vulnerability","details":"The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Version 0.0.8 does not contain the backdoor.","aliases":["CVE-2019-13354"],"modified":"2023-11-08T04:01:08.215454Z","published":"2019-07-08T20:32:35Z","database_specific":{"github_reviewed_at":"2019-07-08T20:32:08Z","nvd_published_at":"2019-07-08T14:15:10Z","cwe_ids":["CWE-94"],"severity":"CRITICAL","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13354"},{"type":"WEB","url":"https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-strong_password-0-0-7"},{"type":"PACKAGE","url":"https://github.com/bdmac/strong_password"},{"type":"WEB","url":"https://github.com/bdmac/strong_password/releases"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/strong_password/CVE-2019-13354.yml"},{"type":"WEB","url":"https://rubygems.org/gems/strong_password/versions"},{"type":"WEB","url":"https://withatwist.dev/strong-password-rubygem-hijacked.html"}],"affected":[{"package":{"name":"strong_password","ecosystem":"RubyGems","purl":"pkg:gem/strong_password"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.7"},{"fixed":"0.0.8"}]}],"versions":["0.0.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/07/GHSA-5h5r-ffc4-c455/GHSA-5h5r-ffc4-c455.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}