CVE-2020-8130
N/A
N/A
Summary
There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | https://github.com/ruby/ruby | Fixed in Rake 12.3.3 | affected |
Weaknesses
- CWE-78: OS Command Injection (CWE-78)
ADP Enrichment
CVE Program Container
Additional References
- https://hackerone.com/reports/651518
- https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html
- https://usn.ubuntu.com/4295-1/
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/
References
- https://hackerone.com/reports/651518
- https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html
- https://usn.ubuntu.com/4295-1/
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.