GitHub Advisoryadvisory · RubyGems
GHSA-99ch-8mvp-g7m5 md2pdf allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename
CRITICAL
Official page ↗
- Aliases
- CVE-2013-1948
- Ecosystem
- RubyGems
- Packages
- md2pdf
- Severity
- Critical
- Reviewed
- 2020-06-16
Affected packages
• RubyGems md2pdf: <= 0.0.1 (no fix yet)
Description
`converter.rb` in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
Related
Alias · CVE (1)
- CVE-2013-1948 converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-1948 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83416 web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/md2pdf/CVE-2013-1948.yml web
- https://github.com/rwestgeest/md2pdf package
- https://web.archive.org/web/20130503194109/http://www.securityfocus.com/bid/59061 web
- http://vapid.dhs.org/advisories/md2pdf-remote-exec.html web