Bug 1697482 (CVE-2019-10842)

Summary:	CVE-2019-10842 rubygem-bootstrap-sass: backdoor code allows arbitrary code execution when downloaded from rubygems.org
Product:	[Other] Security Response	Reporter:	msiddiqu
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	axilleas, dajohnso, dmetzger, gblomqui, gmccullo, gtanzill, jfrey, jhardy, jprause, kdixon, obarenbo, roliveri, simaishi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-04-09 18:27:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1697483
Bug Blocks:	1697502

Description msiddiqu 2019-04-08 13:53:41 UTC

Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An unauthenticated attacker can craft the ___cfduid cookie value with base64 arbitrary code to be executed via eval(), which can be leveraged to execute arbitrary code on the target system. Note that there are three underscore characters in the cookie name. This is unrelated to the __cfduid cookie that is legitimately used by Cloudflare.

Upstream issue:
https://github.com/twbs/bootstrap-sass/issues/1195


References:
https://snyk.io/blog/malicious-remote-code-execution-backdoor-discovered-in-the-popular-bootstrap-sass-ruby-gem/
https://snyk.io/vuln/SNYK-RUBY-BOOTSTRAPSASS-174093
https://www.cyberscoop.com/bootstrap-sass-infected-snyk-rubygems/

Comment 1 msiddiqu 2019-04-08 13:53:52 UTC

Created rubygem-bootstrap-sass tracking bugs for this issue:

Affects: fedora-all [bug 1697483]

Comment 3 Richard Maciel Costa 2019-04-09 18:25:20 UTC

Statement:

Red Hat CloudForms is not affected by this issue, since the only affected version of bootstrap-sass gem is the 3.2.0.3 and CloudForms only ships version 3.3.7.