GitHub Advisoryadvisory · RubyGems

GHSA-c43v-hrmg-56r4 Cocaine Gem OS Command Injection vulnerability

MEDIUM Published 2017-10-24 Modified 2023-09-05 Official page ↗
Aliases
CVE-2013-4457
Ecosystem
RubyGems
Packages
cocaine
Severity
Moderate
Weaknesses
CWE-78
Reviewed
2020-06-16

Affected packages

• RubyGems cocaine: >= 0.4.0, < 0.5.3 → fixed in 0.5.3

Description

The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation.

Related

Alias · CVE (1)

  • CVE-2013-4457 The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object,… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References