FreeBSD Bugzilla – Attachment 224628 Details for
Bug 255552
security/vuxml: Document command injection vulnerability in RDoc
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Updated patch file
security_vuxml_rubygem-rdoc.patch (text/plain), 1.95 KB, created by
Yasuhiro Kimura
on 2021-05-03 11:47:40 UTC
(
hide
)
Description:
Updated patch file
Filename:
MIME Type:
Creator:
Yasuhiro Kimura
Created:
2021-05-03 11:47:40 UTC
Size:
1.95 KB
patch
obsolete
>From b3c9b3f53ad1f45a134c71f0e5a3d412add21c24 Mon Sep 17 00:00:00 2001 >From: Yasuhiro Kimura <yasu@utahime.org> >Date: Mon, 3 May 2021 05:02:31 +0900 >Subject: [PATCH] security/vuxml: Document command injection vulnerability in > RDoc > >Document command injection vulnerability in RDoc. >--- > security/vuxml/vuln.xml | 32 ++++++++++++++++++++++++++++++++ > 1 file changed, 32 insertions(+) > >diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml >index da24c21cf97a..d1d1dc61ccfb 100644 >--- a/security/vuxml/vuln.xml >+++ b/security/vuxml/vuln.xml >@@ -76,6 +76,38 @@ Notes: > * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) > --> > <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> >+ <vuln vid="57027417-ab7f-11eb-9596-080027f515ea"> >+ <topic>RDoc -- command injection vulnerability</topic> >+ <affects> >+ <package> >+ <name>rubygem-rdoc</name> >+ <range><lt>6.3.1</lt></range> >+ </package> >+ </affects> >+ <description> >+ <body xmlns="http://www.w3.org/1999/xhtml"> >+ <p>Alexandr Savca reports:</p> >+ <blockquote cite="https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/"> >+ <p> >+ RDoc used to call Kernel#open to open a local file. If a Ruby project >+ has a file whose name starts with | and ends with tags, the command >+ following the pipe character is executed. A malicious Ruby project >+ could exploit it to run an arbitrary command execution against a user >+ who attempts to run rdoc command. >+ </p> >+ </blockquote> >+ </body> >+ </description> >+ <references> >+ <cvename>CVE-2021-31799</cvename> >+ <url>https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/</url> >+ </references> >+ <dates> >+ <discovery>2021-05-02</discovery> >+ <entry>2021-05-02</entry> >+ </dates> >+ </vuln> >+ > <vuln vid="0add6e6b-6883-11eb-b0cb-f8b156c2bfe9"> > <topic>sympa -- Unauthorised full access via SOAP API due to illegal cookie</topic> > <affects> >-- >2.31.1 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 255552
:
224615
| 224628