What’s Vulnerable › Vulnerabilities

CVE-2019-16892

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-09-25 · updated 2026-06-17

Description

In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

Affected products

• Fedoraproject Fedora: 29, 30, 31
• CloudForms: 4.7, 5.11
• Rubyzip Project Rubyzip: before 1.3.0 — fixed in 1.3.0

How to fix

Upgrade to a fixed version: Rubyzip Project Rubyzip 1.3.0. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHBA-2019:4047
• https://access.redhat.com/errata/RHSA-2019:4201
• https://github.com/rubyzip/rubyzip/commit/d65fe7bd283ec94f9d6dc7605f61a6b0dd00f55e
• https://github.com/rubyzip/rubyzip/pull/403
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWWPORMSBHZTMP4PGF4DQD22TTKBQMMC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X255K6ZBAQC462PQN2ND5HOTTQEJ2G2X/
• https://access.redhat.com/errata/RHBA-2019:4047
• https://access.redhat.com/errata/RHSA-2019:4201
• https://github.com/rubyzip/rubyzip/commit/d65fe7bd283ec94f9d6dc7605f61a6b0dd00f55e
• https://github.com/rubyzip/rubyzip/pull/403
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO6/

Get alerted when CVE-2019-16892 or the next vulnerability affects your stack