ruby-git/ruby-git · Security
Code injection in ruby git
- GHSA ID
- GHSA-pphf-gfrm-v32r
- CVE ID
- CVE-2022-47318
- Severity
- high
- Published
- Updated
- CVSS
- 8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- CVSS v3
- 8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Description
ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648.
CWEs
- CWE-94 · Improper Control of Generation of Code ('Code Injection')
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-47318 ↗
- https://github.com/ruby-git/ruby-git/pull/602 ↗
- https://github.com/ruby-git/ruby-git ↗
- https://jvn.jp/en/jp/JVN16765254/index.html ↗
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4KPFLSZPUM7APWVBRM5DCAY5OUVQBF4K/ ↗
- https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html ↗
- https://github.com/advisories/GHSA-pphf-gfrm-v32r ↗