Vulnerability · Published Feb 24, 2020 · Assigned by hackerone
CVE-2020-8130
Medium 6.4
In plain English
A medium-severity OS command injection in https://github.com/ruby/ruby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.4Medium
Exploit odds (30 days)1.4%top 28.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rake | 12.3.3-1 | DEBIAN-CVE-2020-8130 |
| Debian:13 | rake | 12.3.3-1 | DEBIAN-CVE-2020-8130 |
| Debian:14 | rake | 12.3.3-1 | DEBIAN-CVE-2020-8130 |
| RubyGems | rake | 12.3.3 | GHSA-jppv-gw3r-w3q8 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/ruby/ruby | Fixed in Rake 12.3.3 |
Weakness: CWE-78
References
- https://hackerone.com/reports/651518 x_refsource_MISC
- [debian-lts-announce] 20200226 [SECURITY] [DLA 2120-1] rake security update mailing-list, x_refsource_MLIST
- USN-4295-1 vendor-advisory, x_refsource_UBUNTU
- openSUSE-SU-2020:0395 vendor-advisory, x_refsource_SUSE
- FEDORA-2020-28e06b5f08 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-dc1ae17bb5 vendor-advisory, x_refsource_FEDORA