CVE-2014-5000

Name of the Vulnerable Software and Affected Versions lawn-login gem version 0.0.7

Description The issue concerns the login function in the lawn-login gem for Ruby, which places credentials on the curl command line. This allows local users to obtain sensitive information by listing the process. The lib/lawn.rb file is specifically affected.

Recommendations For version 0.0.7, consider modifying the login function to avoid placing credentials on the command line, or restrict access to process listings to minimize the risk of exploitation. As a temporary workaround, consider disabling the login function until a patch is available.