[GLSA-202406-03] RDoc: Remote Code Execution

Severity High

Affected Packages 1

Unaffected Packages 1

CVEs 1

A vulnerability has been discovered in RDoc, which can lead to execution of arbitrary code.

Background
RDoc produces HTML and command-line documentation for Ruby projects.

Description
A vulnerability has been discovered in RDoc. Please review the CVE identifier referenced below for details.

Impact
When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored.
When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.

Workaround
There is no known workaround at this time.

Resolution
All RDoc users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-ruby/rdoc-6.6.3.1"

Package	Affected Version
pkg:ebuild/dev-ruby/rdoc?distro=gentoo	< 6.6.3.1

Package	Unaffected Version
pkg:ebuild/dev-ruby/rdoc?distro=gentoo	>= 6.6.3.1

ID

GLSA-202406-03

Severity

high

URL

https://security.gentoo.org/glsa/202406-03

Published

2024-06-22T00:00:00
(2 months ago)

Modified

2024-06-22T00:00:00
(2 months ago)

Rights

Gentoo Foundation, Inc.

Other Advisories

Source	# ID	Name	URL
CVE	CVE-2024-27281	CVE-2024-27281	https://nvd.nist.gov/vuln/detail/CVE-2024-27281
Bugzilla	927565	Bugzilla #927565	https://bugs.gentoo.org/show_bug.cgi?id=927565

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:ebuild/dev-ruby/rdoc?distro=gentoo	dev-ruby	rdoc	< 6.6.3.1	gentoo
Unaffected	pkg:ebuild/dev-ruby/rdoc?distro=gentoo	dev-ruby	rdoc	>= 6.6.3.1	gentoo

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date