[RUBYSEC:RDOC-2021-31799] RDoc OS command injection vulnerability
Severity
High
Affected Packages
1
Fixed Packages
3
CVEs
1
RDoc used to call Kernel#open
to open a local file. If a Ruby project has
a file whose name starts with |
and ends with tags
, the command following
the pipe character is executed. A malicious Ruby project could exploit it to
run an arbitrary command execution against a user who attempts to run rdoc
command.
Package | Affected Version |
---|---|
pkg:gem/rdoc | < 6.3.1 |
Package | Fixed Version |
---|---|
pkg:gem/rdoc | = 6.1.2.1 |
pkg:gem/rdoc | = 6.2.1.1 |
pkg:gem/rdoc | >= 6.3.1 |
- ID
- RUBYSEC:RDOC-2021-31799
- Severity
- high
- URL
- https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/
- Published
-
2021-05-02T00:00:00
(3 years ago) - Modified
-
2023-05-03T23:49:55
(16 months ago) - Rights
- RubySec Security Team
- Other Advisories
-
- ALAS-2021-1505
- ALAS-2021-1506
- ALAS2-2021-1641
- ALPINE:CVE-2021-31799
- ALSA-2021:3020
- ALSA-2022:0543
- ALSA-2022:0672
- ASA-202107-18
- DSA-5066-1
- ELSA-2021-3020
- ELSA-2022-0543
- ELSA-2022-0672
- FEDORA-2021-36cdab1f8d
- FREEBSD:57027417-AB7F-11EB-9596-080027F515EA
- FREEBSD:7ED5779C-E4C7-11EB-91D7-08002728F74C
- GLSA-202401-05
- openSUSE-SU-2021:1535-1
- openSUSE-SU-2021:3838-1
- RHSA-2021:3020
- RHSA-2022:0543
- RHSA-2022:0672
- RLSA-2021:3020
- RLSA-2022:0543
- RLSA-2022:0672
- SUSE-SU-2021:3837-1
- SUSE-SU-2021:3838-1
- SUSE-SU-2022:1512-1
- USN-5020-1
Source | # ID | Name | URL |
---|---|---|---|
Security Advisory | GHSA-ggxm-pgc9-g7fp | https://github.com/advisories/GHSA-ggxm-pgc9-g7fp |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |