CVE-2019-17268.yml

---
gem: omniauth-weibo-oauth2
cve: 2019-17268
ghsa: vr22-43gj-rx3f
url: https://github.com/beenhero/omniauth-weibo-oauth2/issues/36
title: omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third-party
date: 2022-05-24
description: |
  The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org,
  included a code-execution backdoor inserted by a third party. Versions through 0.4.5,
  and 0.5.1 and later, are unaffected.
cvss_v3: 9.8
unaffected_versions:
  - "< 0.4.6"
patched_versions:
  - ">= 0.5.1"
related:
  url:
    - https://diff.coditsu.io/diffs/09a05c37-1b34-49e1-ac94-d4dda40d1ad1#d2h-971595