Malicious Package Affecting strong_password package, versions =0.0.7
Exploit Maturity
Mature
Attack Complexity
Low
Confidentiality
High
Integrity
High
Availability
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-RUBY-STRONGPASSWORD-451547
-
published
6 Jul 2019
-
disclosed
3 Jul 2019
-
credit
WithaTwist
Introduced: 3 Jul 2019
Malicious CVE-2019-13354 Open this link in a new tabHow to fix?
Avoid using strong_password v0.0.7 altogether. Downgrading to v0.0.6 will ensure no malicious code execution is possible.
Overview
strong_password is a is an entropy-based password strength checking for Ruby and ActiveModel
This gem was hijacked by a malicious actor, who has published v0.0.7 containing malicious code that enables them to execute remote code in production.