Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTIyOXItcHFwNi04dzZn
sprout Arbitrary Code Execution vulnerability
The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTIyOXItcHFwNi04dzZn
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 7 years ago
Updated: about 1 year ago
EPSS Percentage: 0.00458
EPSS Percentile: 0.75011
Identifiers: GHSA-229r-pqp6-8w6g, CVE-2013-6421
References:
- https://nvd.nist.gov/vuln/detail/CVE-2013-6421
- http://vapid.dhs.org/advisories/sprout-0.7.246-command-inj.html
- http://www.openwall.com/lists/oss-security/2013/12/03/1
- http://www.openwall.com/lists/oss-security/2013/12/03/6
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sprout/CVE-2013-6421.yml
- http://archives.neohapsis.com/archives/bugtraq/2013-12/0077.html
- https://github.com/advisories/GHSA-229r-pqp6-8w6g
Affected Packages
rubygems:sprout
Dependent packages: 35Dependent repositories: 31
Downloads: 930,033 total
Affected Version Ranges: = 0.7.246
No known fixed version
All affected versions: