GitHub Advisoryadvisory · RubyGems

GHSA-rp63-jfmw-532w Mail Gem Improper Input Validation vulnerability

HIGH Published 2017-10-24 Modified 2023-09-05 Official page ↗
Aliases
CVE-2012-2140
Ecosystem
RubyGems
Packages
mail
Severity
High
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• RubyGems mail: < 2.4.3 → fixed in 2.4.3

Description

The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.

Related

Alias · CVE (1)

  • CVE-2012-2140 The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2)… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References