Lack of data validation In cocoapods-downloader
Description
Command injection in cocoapods-downloader The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 rubygems | 1.6.0, 1.6.3 |
Aliases
1. 2. 3. 4.
References
1. 2. 3. 4. 5.