markevans/dragonfly · Security
Code injection in dragonfly gem
- GHSA ID
- GHSA-qrgf-jqqm-x7xv
- CVE ID
- CVE-2013-5671
- Severity
- high
- Published
- Updated
Description
lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors.
CWEs
- CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-5671 ↗
- http://seclists.org/fulldisclosure/2013/Sep/18 ↗
- http://seclists.org/oss-sec/2013/q3/526 ↗
- http://seclists.org/oss-sec/2013/q3/528 ↗
- https://github.com/markevans/dragonfly/issues/520 ↗
- https://github.com/github/advisory-database/pull/486 ↗
- https://web.archive.org/web/20201208033320/http://www.vapid.dhs.org/advisories/fog-dragonfly-0.8.2-cmd-inj.html ↗
- https://github.com/advisories/GHSA-qrgf-jqqm-x7xv ↗