In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rubyzip | Rubyzip_project | * | 1.3.0 (excluding) |
| Ruby-zip | Ubuntu | bionic | * |
| Ruby-zip | Ubuntu | disco | * |
| Ruby-zip | Ubuntu | eoan | * |
| Ruby-zip | Ubuntu | esm-apps/bionic | * |
| Ruby-zip | Ubuntu | esm-apps/xenial | * |
| Ruby-zip | Ubuntu | trusty | * |
| Ruby-zip | Ubuntu | xenial | * |
| CloudForms Management Engine 5.10 | RedHat | cfme-0:5.10.13.1-1.el7cf | * |
| CloudForms Management Engine 5.10 | RedHat | cfme-amazon-smartstate-0:5.10.13.1-1.el7cf | * |
| CloudForms Management Engine 5.10 | RedHat | cfme-appliance-0:5.10.13.1-1.el7cf | * |
| CloudForms Management Engine 5.10 | RedHat | cfme-gemset-0:5.10.13.1-1.el7cf | * |
| CloudForms Management Engine 5.10 | RedHat | ruby-0:2.4.9-93.el7cf | * |
| CloudForms Management Engine 5.11 | RedHat | cfme-0:5.11.1.2-1.el8cf | * |
| CloudForms Management Engine 5.11 | RedHat | cfme-amazon-smartstate-0:5.11.1.2-1.el8cf | * |
| CloudForms Management Engine 5.11 | RedHat | cfme-appliance-0:5.11.1.2-1.el8cf | * |
| CloudForms Management Engine 5.11 | RedHat | cfme-gemset-0:5.11.1.2-1.el8cf | * |
| CloudForms Management Engine 5.11 | RedHat | ovirt-ansible-hosted-engine-setup-0:1.0.28-1.el8ev | * |
| CloudForms Management Engine 5.11 | RedHat | v2v-conversion-host-0:1.15.0-1.el8ev | * |