Open mend-bolt-for-github[bot] opened 3 months ago
RDoc produces HTML and command-line documentation for Ruby projects. RDoc includes the +rdoc+ and +ri+ tools for generating and displaying documentation from the command-line.
Library home page: https://rubygems.org/gems/rdoc-6.2.1.gem
Path to vulnerable library: /nges/vendor/bundle/ruby/2.5.0/cache/rdoc-6.2.1.gem,/ependencies/vendor/bundle/ruby/2.5.0/cache/rdoc-6.2.1.gem
Dependency Hierarchy: - :x: **rdoc-6.2.1.gem** (Vulnerable Library)
Found in HEAD commit: 27e1f740a162e55490d9ca929f243afbaa92476c
Found in base branch: master
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
Publish Date: 2021-07-30
URL: CVE-2021-31799
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
Type: Upgrade version
Origin: https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/
Release Date: 2021-07-30
Fix Resolution: rdoc - 6.3.1
Step up your Open Source Security Game with Mend here
CVE-2021-31799 - High Severity Vulnerability
RDoc produces HTML and command-line documentation for Ruby projects. RDoc includes the +rdoc+ and +ri+ tools for generating and displaying documentation from the command-line.
Library home page: https://rubygems.org/gems/rdoc-6.2.1.gem
Path to vulnerable library: /nges/vendor/bundle/ruby/2.5.0/cache/rdoc-6.2.1.gem,/ependencies/vendor/bundle/ruby/2.5.0/cache/rdoc-6.2.1.gem
Dependency Hierarchy: - :x: **rdoc-6.2.1.gem** (Vulnerable Library)
Found in HEAD commit: 27e1f740a162e55490d9ca929f243afbaa92476c
Found in base branch: master
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
Publish Date: 2021-07-30
URL: CVE-2021-31799
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/
Release Date: 2021-07-30
Fix Resolution: rdoc - 6.3.1
Step up your Open Source Security Game with Mend here