[RUBYSEC:RDOC-2021-31799] RDoc OS command injection vulnerability

Severity High
Affected Packages 1
Fixed Packages 3
CVEs 1

RDoc used to call Kernel#open to open a local file. If a Ruby project has
a file whose name starts with | and ends with tags, the command following
the pipe character is executed. A malicious Ruby project could exploit it to
run an arbitrary command execution against a user who attempts to run rdoc
command.

Package Affected Version
pkg:gem/rdoc < 6.3.1
Package Fixed Version
pkg:gem/rdoc = 6.1.2.1
pkg:gem/rdoc = 6.2.1.1
pkg:gem/rdoc >= 6.3.1
Source # ID Name URL
Security Advisory GHSA-ggxm-pgc9-g7fp https://github.com/advisories/GHSA-ggxm-pgc9-g7fp
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Fixed pkg:gem/rdoc rdoc = 6.1.2.1
Fixed pkg:gem/rdoc rdoc = 6.2.1.1
Fixed pkg:gem/rdoc rdoc >= 6.3.1
Affected pkg:gem/rdoc rdoc < 6.3.1
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date
Loading...