Fluid Attacks Database

Description

OS Command Injection in Rake There is an OS command injection vulnerability in Ruby Rake before 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rubygems	rake	>=0 <12.3.3	12.3.3
debian 14	rake	>=0 <12.3.3-1	12.3.3-1
debian 13	rake	>=0 <12.3.3-1	12.3.3-1
debian 12	rake	>=0 <12.3.3-1	12.3.3-1

Aliases

1. CVE-2020-81302. NVD-2020-81303. OSV-2020-81304. OSV-DEBIAN-2020-81305. GHSA-jppv-gw3r-w3q86. GCVE-2020-81307. lists.debian.org8. SECURITY-TRACKER-CVE-2020-8130

References

1. https://github.com/ruby/rake/commit/5b8f8fc41a5d7d7d6a5d767e48464c60884d3aee2. https://hackerone.com/reports/6515183. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rake/CVE-2020-8130.yml4. https://lists.fedoraproject.org/archives/list/[email protected]/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B5. https://lists.fedoraproject.org/archives/list/[email protected]/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI446. https://usn.ubuntu.com/4295-17. http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.