Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2019-8323

20
FAUCET Score

CVE-2019-8323 is a high-severity vulnerability affecting RubyGems versions 2.6 through 3.0.2, as well as various Debian and openSUSE distributions. It allows for escape sequence injection due to Gem::GemcutterUtilities#with_response outputting API responses directly to stdout, enabling an attacker to manipulate the output if the API response is altered. The CVSSv3 score is 7.5 (High), indicating a network-exploitable vulnerability with low attack complexity and high impact on integrity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
>= 2.6.0, <= 3.0.2CPE matchmatch criteria
cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*
9.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
15.0CPE matchmatch criteria
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
15.1CPE matchmatch criteria
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
3.37%
Probability of exploitation in next 30 days
EPSS Percentile
87.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0337 is in the 78th percentile among its peer group of 51,553 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (23)

redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-ruby25-ruby-0:2.5.5-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-ruby24-ruby-0:2.4.6-92.el7
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.10Fixed in: cfme-0:5.10.5.1-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.10Fixed in: cfme-amazon-smartstate-0:5.10.5.1-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.10Fixed in: cfme-appliance-0:5.10.5.1-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.10Fixed in: cfme-gemset-0:5.10.5.1-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.10Fixed in: ruby-0:2.4.6-91.el7cf
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: ruby-0:2.0.0.648-35.el7_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.4 Advanced Update SupportFixed in: ruby-0:2.0.0.648-37.el7_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.4 Telco Extended Update SupportFixed in: ruby-0:2.0.0.648-37.el7_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.4 Update Services for SAP SolutionsFixed in: ruby-0:2.0.0.648-37.el7_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: ruby:2.5-8010020190711131821.cdc1202b
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-ruby24-ruby-0:2.4.6-92.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby25-ruby-0:2.5.5-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby24-ruby-0:2.4.6-92.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-ruby25-ruby-0:2.5.5-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-ruby24-ruby-0:2.4.6-92.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: rh-ruby25-ruby-0:2.5.5-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: rh-ruby24-ruby-0:2.4.6-92.el7
View patch
rubygemspatch availablevia ghsa
Product: rubygems-updateFixed in: 2.7.9
rubygemspatch availablevia ghsa
Product: rubygems-updateFixed in: 3.0.2
redhatvendor investigatingvia redhat_api
Product: Red Hat Software CollectionsFixed in: rh-ruby23-ruby
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: rubygems

Vendor Advisories (2)

rubygemsGHSA-3h4r-pjv6-cph9high

RubyGems Escape sequence injection vulnerability in api response handling

Jun 20, 2019
redhatCVE-2019-8323Low

rubygems: Escape sequence injection vulnerability in API response handling

Mar 5, 2019

References

lists.opensuse.org / opensuse-security-announce/2019-07/msg00036.html
Mailing ListThird Party Advisory
hackerone.com / reports/315081
Permissions RequiredThird Party Advisory
lists.debian.org / debian-lts-announce/2020/08/msg00027.html
Mailing ListThird Party Advisory