CVE-2019-15224

EUVD-2019-0614
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 84%
Affected Products (NVD)
VendorProductVersion
rest-client_projectrest-client
1.6.10 ≤
𝑥
≤ 1.6.13
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ruby-rest-client
bookworm
2.1.0-3
fixed
bullseye
2.1.0-1
fixed
sid
2.1.0-3
fixed
trixie
2.1.0-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby-rest-client
bionic
not-affected
disco
not-affected
trusty
dne
xenial
not-affected