{"id":"CVE-2019-16892","aliases":["DEBIAN-CVE-2019-16892","EUVD-2019-0653","GHSA-5m2v-hc64-56h6","OESA-2022-1542","RHBA-2019:4047","RHSA-2019:4201","UBUNTU-CVE-2019-16892","openSUSE-SU-2024:11491-1"],"status":"published","title":"Rubyzip denial of service","description":"In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01581,"percentile":0.75696,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2019-09-25T00:00:00Z","modified":"2026-10-20T10:51:37Z","fixes":[{"ecosystem":"RubyGems","package":"rubyzip","fixed_in":["1.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-zip","fixed_in":["2.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-zip","fixed_in":["2.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-zip","fixed_in":["2.0.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-rubyzip","fixed_in":["2.0.0-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"rubygem-rubyzip","fixed_in":["2.0.0-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"rubygem-rubyzip","fixed_in":["2.0.0-1.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme","fixed_in":["0:5.10.13.1-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-amazon-smartstate","fixed_in":["0:5.10.13.1-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance","fixed_in":["0:5.10.13.1-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance-common","fixed_in":["0:5.10.13.1-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance-debuginfo","fixed_in":["0:5.10.13.1-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance-tools","fixed_in":["0:5.10.13.1-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-debuginfo","fixed_in":["0:5.10.13.1-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-gemset","fixed_in":["0:5.10.13.1-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-gemset-debuginfo","fixed_in":["0:5.10.13.1-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ruby","fixed_in":["0:2.4.9-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ruby-debuginfo","fixed_in":["0:2.4.9-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ruby-devel","fixed_in":["0:2.4.9-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ruby-doc","fixed_in":["0:2.4.9-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ruby-irb","fixed_in":["0:2.4.9-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ruby-libs","fixed_in":["0:2.4.9-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-bigdecimal","fixed_in":["0:1.3.2-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-did_you_mean","fixed_in":["0:1.1.0-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-io-console","fixed_in":["0:0.4.6-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-minitest","fixed_in":["0:5.10.1-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-net-telnet","fixed_in":["0:0.1.1-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-openssl","fixed_in":["0:2.0.9-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-power_assert","fixed_in":["0:0.4.1-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-psych","fixed_in":["0:2.2.2-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-rake","fixed_in":["0:12.0.0-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-rdoc","fixed_in":["0:5.0.1-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-test-unit","fixed_in":["0:3.2.3-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-xmlrpc","fixed_in":["0:0.2.1-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygems","fixed_in":["0:2.6.14.4-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygems-devel","fixed_in":["0:2.6.14.4-93.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme","fixed_in":["0:5.11.1.2-1.el8cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme-amazon-smartstate","fixed_in":["0:5.11.1.2-1.el8cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme-appliance","fixed_in":["0:5.11.1.2-1.el8cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme-appliance-common","fixed_in":["0:5.11.1.2-1.el8cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme-appliance-tools","fixed_in":["0:5.11.1.2-1.el8cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme-gemset","fixed_in":["0:5.11.1.2-1.el8cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"ovirt-ansible-hosted-engine-setup","fixed_in":["0:1.0.28-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"v2v-conversion-host","fixed_in":["0:1.15.0-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"v2v-conversion-host-ansible","fixed_in":["0:1.15.0-1.el8ev"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"vagrant","fixed_in":["2.2.18-1.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rubyzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"rubyzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0"}]}],"versions":["0.5.11","0.5.12","0.5.7","0.5.8","0.5.9","0.9.1","0.9.4","0.9.5","0.9.6.1","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0.beta1","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-rubyzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"rubygem-rubyzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"rubygem-rubyzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.13.1-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-amazon-smartstate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.13.1-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.13.1-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.13.1-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.13.1-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.13.1-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.13.1-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-gemset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.13.1-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-gemset-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.13.1-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ruby-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.2-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-did_you_mean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.6-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.1-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-net-telnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.1-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.9-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.0.0-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.1-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.1-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14.4-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14.4-93.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.11.1.2-1.el8cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme-amazon-smartstate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.11.1.2-1.el8cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme-appliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.11.1.2-1.el8cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme-appliance-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.11.1.2-1.el8cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme-appliance-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.11.1.2-1.el8cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme-gemset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.11.1.2-1.el8cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"ovirt-ansible-hosted-engine-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.28-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"v2v-conversion-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.0-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"v2v-conversion-host-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.0-1.el8ev"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.7-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-1","1.2.1-1.1~build0.18.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vagrant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-1.3"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redhat","product":"cloudforms"},{"vendor":"rubyzip_project","product":"rubyzip"}],"references":[{"url":"https://github.com/rubyzip/rubyzip/pull/403","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWWPORMSBHZTMP4PGF4DQD22TTKBQMMC/","tags":["vendor-advisory","x_transferred","Mailing List","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO6/","tags":["vendor-advisory","x_transferred","Mailing List","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X255K6ZBAQC462PQN2ND5HOTTQEJ2G2X/","tags":["vendor-advisory","x_transferred","Mailing List","article"]},{"url":"https://access.redhat.com/errata/RHBA-2019:4047","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4201","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/rubyzip/rubyzip/commit/d65fe7bd283ec94f9d6dc7605f61a6b0dd00f55e","tags":["x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16892","tags":["advisory"]},{"url":"https://github.com/jdleesmiller/ruby-advisory-db/blob/master/gems/rubyzip/CVE-2019-16892.yml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO6/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWWPORMSBHZTMP4PGF4DQD22TTKBQMMC/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X255K6ZBAQC462PQN2ND5HOTTQEJ2G2X/"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubyzip/CVE-2019-16892.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5m2v-hc64-56h6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-16892","tags":["advisory"]},{"url":"https://github.com/rubyzip/rubyzip","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO6","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWWPORMSBHZTMP4PGF4DQD22TTKBQMMC","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X255K6ZBAQC462PQN2ND5HOTTQEJ2G2X","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO6","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWWPORMSBHZTMP4PGF4DQD22TTKBQMMC","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X255K6ZBAQC462PQN2ND5HOTTQEJ2G2X","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1542","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.7/html/release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1757026","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768457","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1770938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1771720","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1772641","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1772642","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1772932","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1773577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1773626","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1773630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1773631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1773701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1774063","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_4047.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16892","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1771298","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16892","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_cloudforms/5.0/html/release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1713400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1730066","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1747179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767548","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767549","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767550","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767660","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767776","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767783","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767784","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767789","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767790","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767791","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767796","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767819","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767823","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767833","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767834","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767835","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767836","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767837","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767881","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767886","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767895","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767901","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768456","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768520","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768525","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768530","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768638","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1771737","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1773666","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1773667","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775684","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4201.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-16892","tags":["report"]},{"url":"https://github.com/rubyzip/rubyzip/commit/4167f0ce67e42b082605bca75c7bdfd01eb23804","tags":["report"]},{"url":"https://github.com/rubyzip/rubyzip/commit/7849f7362ab0cd23d5730ef8b6f2c39252da2285","tags":["report"]},{"url":"https://github.com/rubyzip/rubyzip/commit/97cb6aefe6d12bd2429d7a2e119ccb26f259d71d","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16892","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-16892","description":"In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).","status":"published","published":"2019-09-25T00:00:00Z","modified":"2024-08-05T01:24:47.239Z","updated_at":"2026-11-02T14:32:23.485011Z"}],"euvd":[{"id":"EUVD-2019-0653","description":"In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).","status":"published","published":"2019-09-25T00:00:00Z","modified":"2024-08-05T01:24:47Z","updated_at":"2026-11-03T02:40:32.32735Z"}],"ghsa":[{"id":"GHSA-5m2v-hc64-56h6","title":"Rubyzip denial of service ","description":"In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).","status":"published","published":"2019-09-30T16:05:32Z","modified":"2023-11-17T22:49:38Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:22.040291Z"}],"nvd":[{"id":"CVE-2019-16892","description":"In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).","status":"published","published":"2019-09-25T22:15:10.023Z","modified":"2026-06-17T02:22:54.73Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":7.1,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:05:30.039477Z"}],"osv":[{"id":"CVE-2019-16892","description":"In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).","status":"published","published":"2019-09-25T22:15:10.023Z","modified":"2026-10-20T10:51:37.668471545Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-16892","description":"In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).","status":"published","published":"2019-09-25T22:15:10.023Z","modified":"2026-09-21T07:02:50.053703428Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"GHSA-5m2v-hc64-56h6","title":"Rubyzip denial of service ","description":"In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).","status":"published","published":"2019-09-30T16:05:32Z","modified":"2024-02-16T08:20:45.798772Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"OESA-2022-1542","title":"rubygem-rubyzip security update","description":"A ruby module for reading and writing zip files.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).(CVE-2019-16892)","status":"published","published":"2022-03-07T11:04:49Z","modified":"2026-08-18T01:16:21.590055935Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHBA-2019:4047","title":"Red Hat Bug Fix Advisory: CloudForms 4.7.13 bug fix and enhancement update","status":"published","published":"2024-09-16T03:14:48Z","modified":"2026-06-27T10:06:43Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2019:4201","title":"Red Hat Security Advisory: CloudForms 5.0.1 security, bug fix and enhancement update","status":"published","published":"2024-09-16T03:14:55Z","modified":"2026-06-27T10:08:43Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2019-16892","description":"In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).","status":"published","published":"2019-09-25T22:15:00Z","modified":"2025-10-24T04:47:54Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"openSUSE-SU-2024:11491-1","title":"vagrant-2.2.18-1.3 on GA media","description":"These are all security issues fixed in the vagrant-2.2.18-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:51:06.476522Z","updated_at":"2026-11-02T16:58:35.195147Z"}]}}