GitHub Advisoryadvisory · RubyGems
GHSA-qrgf-jqqm-x7xv Code injection in dragonfly gem
HIGH
Official page ↗
- Aliases
- CVE-2013-5671
- Ecosystem
- RubyGems
- Packages
- dragonfly, fog-dragonfly
- Severity
- High
- Weaknesses
- CWE-74
- Reviewed
- 2020-06-16
Affected packages
• RubyGems dragonfly: < 1.0.0 → fixed in 1.0.0
• RubyGems fog-dragonfly: <= 0.9.15 (no fix yet)
Description
`lib/dragonfly/imagemagickutils.rb` in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors.
Related
Alias · CVE (1)
- CVE-2013-5671 lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via… vulnerability
Weakness · CWE (1)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-5671 advisory
- https://github.com/markevans/dragonfly/issues/520 web
- https://github.com/github/advisory-database/pull/486 web
- https://github.com/markevans/dragonfly package
- https://web.archive.org/web/20201208033320/http://www.vapid.dhs.org/advisories/fog-dragonfly-0.8.2-cmd-inj.html web
- http://seclists.org/fulldisclosure/2013/Sep/18 web
- http://seclists.org/oss-sec/2013/q3/526 web
- http://seclists.org/oss-sec/2013/q3/528 web