[CVE-2019-15224] Version 1.6.13 published with malicious backdoor.
# Summary On August 14, attackers published a series of rest-client versions from 1.6.10 to 1.6.13 using the credentials of a rest-client maintainer whose RubyGems.org account was compromised. The affected versions were downloaded a small number of times (~1000). On August 19, @juskoljo observed the malicious gem version and created this issue. Later that day, the RubyGems security team yanked the offending gem version and locked the affected maintainer's account. Several other gems were similarly affected. https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019 We have released version 1.6.14, identical to version 1.6.9, in order to supersede the affected versions in the legacy 1.6.x series. For checking dependencies, versions `<= 1.6.9` or `>= 1.6.14` are unaffected. ## Impact The malicious backdoor in version 1.6.13 would activate in Rails installations where Rails.env started with "p" (as in "production"). It would then download code from a Pastebin.com URL and execute it. The pastebin is now gone, but it reportedly phoned home to execute instructions from `mironanoru.zzz.com.ua`, which has also disappeared. This was reportedly used to mine cryptocurrency, but could have been used for any purpose. Most rest-client users were not affected because the 1.6.x series is very old and was superseded by 1.7.0 in 2014. Only users who pin to 1.6.x and updated to 1.6.13 in the last week could have been affected, and only then in Rails product
Posted by juskoljo on Aug 19, 2019, 10:45 AM
Tags
Related issues
Raise real-world problems, find people facing the same issue, and discuss solutions.3,500 issues0 comments
github (E-commerce)
proposal: cmd/cgo: cgo without a C toolchain
Replace PowerToys Run with Command Palette
VPS with a vRack leg
Possibility of Portal 1 Code Inclusion
Introducing NewPlayer
Metrics for PRs are never expiring ("memory leak")
ship even more of the compiler in source form
Flatpak Application TRACKING ISSUE
[CVE-2019-15224] Version 1.6.13 published with malicious backdoor.
# Summary On August 14, attackers published a series of rest-client versions from 1.6.10 to 1.6.13 using the credentials of a rest-client maintainer whose RubyGems.org account was compromised. The affected versions were downloaded a small number of times (~1000). On August 19, @juskoljo observed the malicious gem version and created this issue. Later that day, the RubyGems security team yanked the offending gem version and locked the affected maintainer's account. Several other gems were similarly affected. https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019 We have released version 1.6.14, identical to version 1.6.9, in order to supersede the affected versions in the legacy 1.6.x series. For checking dependencies, versions `<= 1.6.9` or `>= 1.6.14` are unaffected. ## Impact The malicious backdoor in version 1.6.13 would activate in Rails installations where Rails.env started with "p" (as in "production"). It would then download code from a Pastebin.com URL and execute it. The pastebin is now gone, but it reportedly phoned home to execute instructions from `mironanoru.zzz.com.ua`, which has also disappeared. This was reportedly used to mine cryptocurrency, but could have been used for any purpose. Most rest-client users were not affected because the 1.6.x series is very old and was superseded by 1.7.0 in 2014. Only users who pin to 1.6.x and updated to 1.6.13 in the last week could have been affected, and only then in Rails product
Comments (0)
No comments yet. Start the discussion.