GitHub Advisoryadvisory · RubyGems

GHSA-m6f7-46hw-grcj Creme Fraiche contains OS Command Injection

CRITICAL Published 2017-10-24 Modified 2023-03-14 Official page ↗
Aliases
CVE-2013-2090
Ecosystem
RubyGems
Packages
cremefraiche
Severity
Critical
Weaknesses
CWE-78
Reviewed
2020-06-16

Affected packages

• RubyGems cremefraiche: < 0.6.1 → fixed in 0.6.1

Description

The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment. NOTE: some of these details are obtained from third party information.

Related

Alias · CVE (1)

  • CVE-2013-2090 The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References