CVE ID:	CVE-2019-16255
Description:	Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
Test IDs:	1.3.6.1.4.1.25623.1.0.892330   1.3.6.1.4.1.25623.1.1.1.2.2023.3408   1.3.6.1.4.1.25623.1.0.892007
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2019-16255 Bugtraq: 20191217 [SECURITY] [DSA 4586-1] ruby2.5 security update (Google Search) https://seclists.org/bugtraq/2019/Dec/32 Bugtraq: 20191217 [SECURITY] [DSA 4587-1] ruby2.3 security update (Google Search) https://seclists.org/bugtraq/2019/Dec/31 Debian Security Information: DSA-4587 (Google Search) https://www.debian.org/security/2019/dsa-4587 https://security.gentoo.org/glsa/202003-06 https://hackerone.com/reports/327512 https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html https://www.oracle.com/security-alerts/cpujan2020.html https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html SuSE Security Announcement: openSUSE-SU-2020:0395 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html