CVE-2014-4991

Name of the Vulnerable Software and Affected Versions codders-dataset gem version 1.3.2.1

Description The issue affects the lib/dataset/database/mysql.rb and lib/dataset/database/postgresql.rb files in the codders-dataset gem for Ruby. It allows local users to obtain sensitive information by listing the process, as credentials are placed on the mysqldump command line.

Recommendations For codders-dataset gem version 1.3.2.1, consider restricting access to the lib/dataset/database/mysql.rb and lib/dataset/database/postgresql.rb files until a patch is available. As a temporary workaround, avoid using the mysqldump command line with sensitive credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.