Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2020-8130 (GCVE-0-2020-8130)
Vulnerability from cvelistv5 – Published: 2020-02-24 14:41 – Updated: 2024-08-04 09:48
VLAI?
EPSS
Summary
There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.
Severity ?
No CVSS data available.
CWE
- CWE-78 - OS Command Injection (CWE-78)
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | https://github.com/ruby/ruby |
Affected:
Fixed in Rake 12.3.3
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:48:25.624Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://hackerone.com/reports/651518"
},
{
"name": "[debian-lts-announce] 20200226 [SECURITY] [DLA 2120-1] rake security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html"
},
{
"name": "USN-4295-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/4295-1/"
},
{
"name": "openSUSE-SU-2020:0395",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
},
{
"name": "FEDORA-2020-28e06b5f08",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/"
},
{
"name": "FEDORA-2020-dc1ae17bb5",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "https://github.com/ruby/ruby",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Fixed in Rake 12.3.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "There is an OS command injection vulnerability in Ruby Rake \u003c 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection (CWE-78)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-27T06:06:07.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/651518"
},
{
"name": "[debian-lts-announce] 20200226 [SECURITY] [DLA 2120-1] rake security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html"
},
{
"name": "USN-4295-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/4295-1/"
},
{
"name": "openSUSE-SU-2020:0395",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
},
{
"name": "FEDORA-2020-28e06b5f08",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/"
},
{
"name": "FEDORA-2020-dc1ae17bb5",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"ID": "CVE-2020-8130",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "https://github.com/ruby/ruby",
"version": {
"version_data": [
{
"version_value": "Fixed in Rake 12.3.3"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "There is an OS command injection vulnerability in Ruby Rake \u003c 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "OS Command Injection (CWE-78)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://hackerone.com/reports/651518",
"refsource": "MISC",
"url": "https://hackerone.com/reports/651518"
},
{
"name": "[debian-lts-announce] 20200226 [SECURITY] [DLA 2120-1] rake security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html"
},
{
"name": "USN-4295-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4295-1/"
},
{
"name": "openSUSE-SU-2020:0395",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
},
{
"name": "FEDORA-2020-28e06b5f08",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/"
},
{
"name": "FEDORA-2020-dc1ae17bb5",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2020-8130",
"datePublished": "2020-02-24T14:41:26.000Z",
"dateReserved": "2020-01-28T00:00:00.000Z",
"dateUpdated": "2024-08-04T09:48:25.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CERTFR-2025-AVI-0899
Vulnerability from certfr_avis - Published: 2025-10-20 - Updated: 2025-10-20
De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | cbl2 gdb 11.2-7 | ||
| Microsoft | N/A | cbl2 binutils 2.37-16 | ||
| Microsoft | N/A | cbl2 redis 6.2.20-1 | ||
| Microsoft | N/A | cbl2 redis 6.2.18-3 | ||
| Microsoft | N/A | azl3 python3 3.12.9-4 versions antérieures à 3.12.9-5 | ||
| Microsoft | N/A | cbl2 crash 8.0.1-4 | ||
| Microsoft | N/A | cbl2 binutils 2.37-17 | ||
| Microsoft | N/A | cbl2 pytorch 2.0.0-9 | ||
| Microsoft | N/A | azl3 kernel 6.6.96.2-2 | ||
| Microsoft | N/A | azl3 binutils 2.41-7 | ||
| Microsoft | N/A | cbl2 qt5-qtsvg 5.12.11-6 versions antérieures à 5.12.11-7 | ||
| Microsoft | N/A | cbl2 python3 3.9.19-14 | ||
| Microsoft | N/A | azl3 openssh 9.8p1-4 | ||
| Microsoft | N/A | cbl2 kernel 5.15.186.1-1 | ||
| Microsoft | N/A | cbl2 rubygem-elasticsearch 8.3.0-1 | ||
| Microsoft | N/A | azl3 kernel 6.6.104.2-1 | ||
| Microsoft | N/A | cbl2 python3 3.9.19-15 versions antérieures à 3.9.19-16 | ||
| Microsoft | N/A | cbl2 qemu 6.2.0-24 | ||
| Microsoft | N/A | azl3 qemu 8.2.0-19 | ||
| Microsoft | N/A | cbl2 gdb 11.2-6 | ||
| Microsoft | N/A | cbl2 openssh 8.9p1-8 versions antérieures à 8.9p1-9 | ||
| Microsoft | N/A | azl3 valkey 8.0.4-1 versions antérieures à 8.0.6-1 | ||
| Microsoft | N/A | azl3 rubygem-elasticsearch 8.9.0-1 | ||
| Microsoft | N/A | azl3 pytorch 2.2.2-7 | ||
| Microsoft | N/A | azl3 ruby 3.3.5-5 | ||
| Microsoft | N/A | cbl2 redis 6.2.18-3 versions antérieures à 6.2.20-1 | ||
| Microsoft | N/A | azl3 qtsvg 6.6.1-2 versions antérieures à 6.6.1-3 | ||
| Microsoft | N/A | azl3 valkey 8.0.4-1 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "cbl2 gdb 11.2-7",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 binutils 2.37-16",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 redis 6.2.20-1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 redis 6.2.18-3",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 python3 3.12.9-4 versions ant\u00e9rieures \u00e0 3.12.9-5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 crash 8.0.1-4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 binutils 2.37-17",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 pytorch 2.0.0-9",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 kernel 6.6.96.2-2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 binutils 2.41-7",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 qt5-qtsvg 5.12.11-6 versions ant\u00e9rieures \u00e0 5.12.11-7",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 python3 3.9.19-14",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 openssh 9.8p1-4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 kernel 5.15.186.1-1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 rubygem-elasticsearch 8.3.0-1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 kernel 6.6.104.2-1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 python3 3.9.19-15 versions ant\u00e9rieures \u00e0 3.9.19-16",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 qemu 6.2.0-24",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 qemu 8.2.0-19",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 gdb 11.2-6",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 openssh 8.9p1-8 versions ant\u00e9rieures \u00e0 8.9p1-9",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 valkey 8.0.4-1 versions ant\u00e9rieures \u00e0 8.0.6-1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 rubygem-elasticsearch 8.9.0-1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 pytorch 2.2.2-7",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 ruby 3.3.5-5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 redis 6.2.18-3 versions ant\u00e9rieures \u00e0 6.2.20-1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 qtsvg 6.6.1-2 versions ant\u00e9rieures \u00e0 6.6.1-3",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 valkey 8.0.4-1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2022-49069",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-49069"
},
{
"name": "CVE-2025-39987",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39987"
},
{
"name": "CVE-2025-39947",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39947"
},
{
"name": "CVE-2025-39973",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39973"
},
{
"name": "CVE-2025-39945",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39945"
},
{
"name": "CVE-2025-55551",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55551"
},
{
"name": "CVE-2024-56709",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56709"
},
{
"name": "CVE-2025-39967",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39967"
},
{
"name": "CVE-2025-11234",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11234"
},
{
"name": "CVE-2025-39942",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39942"
},
{
"name": "CVE-2025-39929",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39929"
},
{
"name": "CVE-2025-39949",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39949"
},
{
"name": "CVE-2025-49844",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-49844"
},
{
"name": "CVE-2025-39953",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39953"
},
{
"name": "CVE-2025-39990",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39990"
},
{
"name": "CVE-2025-39969",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39969"
},
{
"name": "CVE-2025-61985",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61985"
},
{
"name": "CVE-2025-46819",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-46819"
},
{
"name": "CVE-2024-53234",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53234"
},
{
"name": "CVE-2025-8291",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8291"
},
{
"name": "CVE-2025-55552",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55552"
},
{
"name": "CVE-2024-40989",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40989"
},
{
"name": "CVE-2025-39940",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39940"
},
{
"name": "CVE-2025-39977",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39977"
},
{
"name": "CVE-2025-21645",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21645"
},
{
"name": "CVE-2025-46817",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-46817"
},
{
"name": "CVE-2024-39508",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39508"
},
{
"name": "CVE-2022-49133",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-49133"
},
{
"name": "CVE-2025-39970",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39970"
},
{
"name": "CVE-2025-39981",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39981"
},
{
"name": "CVE-2025-39994",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39994"
},
{
"name": "CVE-2025-61984",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61984"
},
{
"name": "CVE-2024-41079",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41079"
},
{
"name": "CVE-2025-39998",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39998"
},
{
"name": "CVE-2025-39968",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39968"
},
{
"name": "CVE-2022-49124",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-49124"
},
{
"name": "CVE-2024-53687",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53687"
},
{
"name": "CVE-2025-39955",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39955"
},
{
"name": "CVE-2025-39934",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39934"
},
{
"name": "CVE-2025-11495",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11495"
},
{
"name": "CVE-2025-39938",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39938"
},
{
"name": "CVE-2025-39982",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39982"
},
{
"name": "CVE-2025-39965",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39965"
},
{
"name": "CVE-2025-39932",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39932"
},
{
"name": "CVE-2025-11414",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11414"
},
{
"name": "CVE-2025-21629",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21629"
},
{
"name": "CVE-2022-50502",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-50502"
},
{
"name": "CVE-2025-39964",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39964"
},
{
"name": "CVE-2024-49568",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49568"
},
{
"name": "CVE-2024-53196",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53196"
},
{
"name": "CVE-2025-39971",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39971"
},
{
"name": "CVE-2024-46717",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-46717"
},
{
"name": "CVE-2024-40966",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40966"
},
{
"name": "CVE-2025-39972",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39972"
},
{
"name": "CVE-2024-56641",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56641"
},
{
"name": "CVE-2025-11413",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11413"
},
{
"name": "CVE-2025-39961",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39961"
},
{
"name": "CVE-2025-55554",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55554"
},
{
"name": "CVE-2025-37727",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-37727"
},
{
"name": "CVE-2025-10729",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10729"
},
{
"name": "CVE-2025-39957",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39957"
},
{
"name": "CVE-2025-39931",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39931"
},
{
"name": "CVE-2024-53195",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53195"
},
{
"name": "CVE-2025-39937",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39937"
},
{
"name": "CVE-2025-46818",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-46818"
},
{
"name": "CVE-2025-11412",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11412"
},
{
"name": "CVE-2022-48816",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-48816"
},
{
"name": "CVE-2025-39985",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39985"
},
{
"name": "CVE-2025-39946",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39946"
},
{
"name": "CVE-2025-39980",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39980"
},
{
"name": "CVE-2024-42321",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42321"
},
{
"name": "CVE-2020-8130",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8130"
},
{
"name": "CVE-2024-56592",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56592"
}
],
"initial_release_date": "2025-10-20T00:00:00",
"last_revision_date": "2025-10-20T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0899",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-10-20T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Microsoft. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39967",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39967"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39940",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39940"
},
{
"published_at": "2025-10-11",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-11412",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-11412"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39994",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39994"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39947",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39947"
},
{
"published_at": "2025-10-17",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-53687",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-53687"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39931",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39931"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39942",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39942"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-55551",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55551"
},
{
"published_at": "2025-10-06",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-50502",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-50502"
},
{
"published_at": "2025-10-11",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-42321",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-42321"
},
{
"published_at": "2025-10-10",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-53195",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-53195"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-39508",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-39508"
},
{
"published_at": "2025-10-10",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-53234",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-53234"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39981",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39981"
},
{
"published_at": "2025-10-10",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-46818",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-46818"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39998",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39998"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39972",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39972"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39953",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39953"
},
{
"published_at": "2025-10-17",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-49133",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-49133"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39934",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39934"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39968",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39968"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39932",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39932"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-49844",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49844"
},
{
"published_at": "2025-10-17",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-56709",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-56709"
},
{
"published_at": "2025-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39965",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39965"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39985",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39985"
},
{
"published_at": "2025-10-07",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-11234",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-11234"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39970",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39970"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39980",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39980"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39977",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39977"
},
{
"published_at": "2025-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39964",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39964"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39938",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39938"
},
{
"published_at": "2025-10-11",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-11495",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-11495"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-56641",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-56641"
},
{
"published_at": "2025-10-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2020-8130",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-8130"
},
{
"published_at": "2025-10-10",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-8291",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-8291"
},
{
"published_at": "2025-10-18",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-21645",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21645"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39982",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39982"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39987",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39987"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-40989",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-40989"
},
{
"published_at": "2025-10-17",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49568",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49568"
},
{
"published_at": "2025-10-11",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-37727",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-37727"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-49069",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-49069"
},
{
"published_at": "2025-10-10",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-46817",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-46817"
},
{
"published_at": "2025-10-11",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-46717",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-46717"
},
{
"published_at": "2025-10-11",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39961",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39961"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-55552",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55552"
},
{
"published_at": "2025-10-11",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-41079",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-41079"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39969",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39969"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-40966",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-40966"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-61985",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-61985"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39949",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39949"
},
{
"published_at": "2025-10-11",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-11414",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-11414"
},
{
"published_at": "2025-10-10",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-46819",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-46819"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39945",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39945"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-61984",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-61984"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-48816",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-48816"
},
{
"published_at": "2025-10-10",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39955",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39955"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39937",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39937"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-55554",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55554"
},
{
"published_at": "2025-10-10",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-56592",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-56592"
},
{
"published_at": "2025-10-07",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-10729",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-10729"
},
{
"published_at": "2025-10-11",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-11413",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-11413"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39929",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39929"
},
{
"published_at": "2025-10-17",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-49124",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-49124"
},
{
"published_at": "2025-10-05",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39946",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39946"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39973",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39973"
},
{
"published_at": "2025-10-18",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-21629",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21629"
},
{
"published_at": "2025-10-10",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-53196",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-53196"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39990",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39990"
},
{
"published_at": "2025-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39971",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39971"
},
{
"published_at": "2025-10-10",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-39957",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39957"
}
]
}
CNVD-2020-13472
Vulnerability from cnvd - Published: 2020-02-25
VLAI Severity ?
Title
Ruby Rake操作系统命令注入漏洞
Description
Rake是一款软件任务管理及组建自动化工具。
Ruby Rake 12.3.3之前版本中的Rake：：FileList中存在操作系统命令注入漏洞。该漏洞源于外部输入数据构造操作系统可执行命令过程中，网络系统或产品未正确过滤其中的特殊字符、命令等。攻击者可利用该漏洞执行非法操作系统命令。
Severity
高
Patch Name
Ruby Rake操作系统命令注入漏洞的补丁
Patch Description
Rake是一款软件任务管理及组建自动化工具。
Ruby Rake 12.3.3之前版本中的Rake：：FileList中存在操作系统命令注入漏洞。该漏洞源于外部输入数据构造操作系统可执行命令过程中，网络系统或产品未正确过滤其中的特殊字符、命令等。攻击者可利用该漏洞执行非法操作系统命令。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
目前厂商已发布升级补丁以修复漏洞，详情请关注厂商主页： https://github.com/ruby/rake
Reference
https://nvd.nist.gov/vuln/detail/CVE-2020-8130
Impacted products
| Name | Ruby Rake <12.3.3 |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2020-8130"
}
},
"description": "Rake\u662f\u4e00\u6b3e\u8f6f\u4ef6\u4efb\u52a1\u7ba1\u7406\u53ca\u7ec4\u5efa\u81ea\u52a8\u5316\u5de5\u5177\u3002\n\nRuby Rake 12.3.3\u4e4b\u524d\u7248\u672c\u4e2d\u7684Rake\uff1a\uff1aFileList\u4e2d\u5b58\u5728\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5916\u90e8\u8f93\u5165\u6570\u636e\u6784\u9020\u64cd\u4f5c\u7cfb\u7edf\u53ef\u6267\u884c\u547d\u4ee4\u8fc7\u7a0b\u4e2d\uff0c\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u672a\u6b63\u786e\u8fc7\u6ee4\u5176\u4e2d\u7684\u7279\u6b8a\u5b57\u7b26\u3001\u547d\u4ee4\u7b49\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u975e\u6cd5\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u3002",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttps://github.com/ruby/rake",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2020-13472",
"openTime": "2020-02-25",
"patchDescription": "Rake\u662f\u4e00\u6b3e\u8f6f\u4ef6\u4efb\u52a1\u7ba1\u7406\u53ca\u7ec4\u5efa\u81ea\u52a8\u5316\u5de5\u5177\u3002\r\n\r\nRuby Rake 12.3.3\u4e4b\u524d\u7248\u672c\u4e2d\u7684Rake\uff1a\uff1aFileList\u4e2d\u5b58\u5728\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5916\u90e8\u8f93\u5165\u6570\u636e\u6784\u9020\u64cd\u4f5c\u7cfb\u7edf\u53ef\u6267\u884c\u547d\u4ee4\u8fc7\u7a0b\u4e2d\uff0c\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u672a\u6b63\u786e\u8fc7\u6ee4\u5176\u4e2d\u7684\u7279\u6b8a\u5b57\u7b26\u3001\u547d\u4ee4\u7b49\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u975e\u6cd5\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Ruby Rake\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "Ruby Rake \u003c12.3.3"
},
"referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-8130",
"serverity": "\u9ad8",
"submitTime": "2020-02-25",
"title": "Ruby Rake\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e"
}
CVE-2020-8130
Vulnerability from fstec - Published: 24.02.2020
VLAI Severity ?
Title
Уязвимость реализации класса Rake::FileList инструмента для автоматизации сборки программного кода Rake, позволяющая нарушителю выполнить произвольные команды
Description
Уязвимость реализации класса Rake::FileList инструмента для автоматизации сборки программного кода Rake связана с непринятием мер по нейтрализации специальных элементов, используемых в командах операционной системы. Эксплуатация уязвимости может позволить нарушителю выполнить произвольные команды
Severity ?
Vendor
Canonical Ltd., ООО «РусБИТех-Астра», Novell Inc., Fedora Project, Сообщество свободного программного обеспечения, Jim Weirich, АО «Концерн ВНИИНС»
Software Name
Ubuntu, Astra Linux Special Edition (запись в едином реестре российских программ №369), Astra Linux Common Edition (запись в едином реестре российских программ №4433), OpenSUSE Leap, Fedora, Debian GNU/Linux, Astra Linux Special Edition для «Эльбрус» (запись в едином реестре российских программ №11156), Rake, ОС ОН «Стрелец» (запись в едином реестре российских программ №6177)
Software Version
16.04 LTS (Ubuntu), 18.04 LTS (Ubuntu), 1.6 «Смоленск» (Astra Linux Special Edition), 2.12 «Орёл» (Astra Linux Common Edition), 15.1 (OpenSUSE Leap), 30 (Fedora), 8 (Debian GNU/Linux), 31 (Fedora), 19.10 (Ubuntu), 8.1 «Ленинград» (Astra Linux Special Edition для «Эльбрус»), до 12.3.3 (Rake), до 16.01.2023 (ОС ОН «Стрелец»)
Possible Mitigations
Использование рекомендаций:
Для Rake:
https://rubygems.org/gems/rake/versions/12.3.3
Для Debian:
https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html
Для Fedora:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/
Для программных продуктов Novell Inc.:
https://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
Для Ubuntu:
https://ubuntu.com/security/notices/USN-4295-1
Для Astra Linux:
Обновление программного обеспечения (пакета rake) до 12.3.1-3+deb10u1 или более поздней версии
И использование рекомендаций производителя:
https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210730SE16
https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81
Для ОС ОН «Стрелец»:
Обновление программного обеспечения rake до версии 10.5.0-2+deb9u1
Reference
https://hackerone.com/reports/651518
https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/
https://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
https://nvd.nist.gov/vuln/detail/CVE-2020-8130
https://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-8130.html?_ga=2.176675554.635257685.1583121209-1733711738.1578988174
https://rubygems.org/gems/rake/versions/12.3.3
https://security-tracker.debian.org/tracker/CVE-2020-8130
https://ubuntu.com/security/notices/USN-4295-1
https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16
https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81
https://strelets.net/patchi-i-obnovleniya-bezopasnosti#16012023
CWE
CWE-78
{
"CVSS 2.0": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"CVSS 3.0": "AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Canonical Ltd., \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb, Novell Inc., Fedora Project, \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, Jim Weirich, \u0410\u041e \u00ab\u041a\u043e\u043d\u0446\u0435\u0440\u043d \u0412\u041d\u0418\u0418\u041d\u0421\u00bb",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "16.04 LTS (Ubuntu), 18.04 LTS (Ubuntu), 1.6 \u00ab\u0421\u043c\u043e\u043b\u0435\u043d\u0441\u043a\u00bb (Astra Linux Special Edition), 2.12 \u00ab\u041e\u0440\u0451\u043b\u00bb (Astra Linux Common Edition), 15.1 (OpenSUSE Leap), 30 (Fedora), 8 (Debian GNU/Linux), 31 (Fedora), 19.10 (Ubuntu), 8.1 \u00ab\u041b\u0435\u043d\u0438\u043d\u0433\u0440\u0430\u0434\u00bb (Astra Linux Special Edition \u0434\u043b\u044f \u00ab\u042d\u043b\u044c\u0431\u0440\u0443\u0441\u00bb), \u0434\u043e 12.3.3 (Rake), \u0434\u043e 16.01.2023 (\u041e\u0421 \u041e\u041d \u00ab\u0421\u0442\u0440\u0435\u043b\u0435\u0446\u00bb)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Rake:\nhttps://rubygems.org/gems/rake/versions/12.3.3\n\n\u0414\u043b\u044f Debian:\nhttps://lists.debian.org/debian-lts-announce/2020/02/msg00026.html\n\n\u0414\u043b\u044f Fedora:\nhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/\nhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Novell Inc.:\nhttps://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html\n\n\u0414\u043b\u044f Ubuntu:\nhttps://ubuntu.com/security/notices/USN-4295-1\n\n\u0414\u043b\u044f Astra Linux:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f (\u043f\u0430\u043a\u0435\u0442\u0430 rake) \u0434\u043e 12.3.1-3+deb10u1 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438\n\u0418 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://wiki.astralinux.ru/astra-linux-se16-bulletin-20210730SE16\nhttps://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81\n\n\u0414\u043b\u044f \u041e\u0421 \u041e\u041d \u00ab\u0421\u0442\u0440\u0435\u043b\u0435\u0446\u00bb:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f rake \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 10.5.0-2+deb9u1",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "24.02.2020",
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "21.11.2023",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "22.12.2020",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2020-05763",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2020-8130",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Ubuntu, Astra Linux Special Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), Astra Linux Common Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21164433), OpenSUSE Leap, Fedora, Debian GNU/Linux, Astra Linux Special Edition \u0434\u043b\u044f \u00ab\u042d\u043b\u044c\u0431\u0440\u0443\u0441\u00bb (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u211611156), Rake, \u041e\u0421 \u041e\u041d \u00ab\u0421\u0442\u0440\u0435\u043b\u0435\u0446\u00bb (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21166177)",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Canonical Ltd. Ubuntu 16.04 LTS 32-bit, Canonical Ltd. Ubuntu 16.04 LTS , Canonical Ltd. Ubuntu 18.04 LTS , \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 1.6 \u00ab\u0421\u043c\u043e\u043b\u0435\u043d\u0441\u043a\u00bb (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Common Edition 2.12 \u00ab\u041e\u0440\u0451\u043b\u00bb (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21164433), Novell Inc. OpenSUSE Leap 15.1 , Fedora Project Fedora 30 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 8 , Fedora Project Fedora 31 , Canonical Ltd. Ubuntu 19.10 , \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition \u0434\u043b\u044f \u00ab\u042d\u043b\u044c\u0431\u0440\u0443\u0441\u00bb 8.1 \u00ab\u041b\u0435\u043d\u0438\u043d\u0433\u0440\u0430\u0434\u00bb (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u211611156), \u0410\u041e \u00ab\u041a\u043e\u043d\u0446\u0435\u0440\u043d \u0412\u041d\u0418\u0418\u041d\u0421\u00bb \u041e\u0421 \u041e\u041d \u00ab\u0421\u0442\u0440\u0435\u043b\u0435\u0446\u00bb \u0434\u043e 16.01.2023 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21166177)",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 Rake::FileList \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 Rake, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435 \u043c\u0435\u0440 \u043f\u043e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b (\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b) (CWE-78)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 Rake::FileList \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 Rake \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0430\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u043d\u044a\u0435\u043a\u0446\u0438\u044f",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://hackerone.com/reports/651518\nhttps://lists.debian.org/debian-lts-announce/2020/02/msg00026.html\nhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/\nhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/\nhttps://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-8130\nhttps://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-8130.html?_ga=2.176675554.635257685.1583121209-1733711738.1578988174\nhttps://rubygems.org/gems/rake/versions/12.3.3\nhttps://security-tracker.debian.org/tracker/CVE-2020-8130\nhttps://ubuntu.com/security/notices/USN-4295-1\nhttps://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16\nhttps://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81\nhttps://strelets.net/patchi-i-obnovleniya-bezopasnosti#16012023",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-78",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,9)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,4)"
}
GHSA-JPPV-GW3R-W3Q8
Vulnerability from github – Published: 2020-02-28 16:54 – Updated: 2023-08-29 15:03
VLAI?
Summary
OS Command Injection in Rake
Details
There is an OS command injection vulnerability in Ruby Rake before 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.
Severity ?
6.4 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 12.3.2"
},
"package": {
"ecosystem": "RubyGems",
"name": "rake"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.3.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-8130"
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"github_reviewed": true,
"github_reviewed_at": "2020-02-25T15:50:03Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "There is an OS command injection vulnerability in Ruby Rake before 12.3.3 in `Rake::FileList` when supplying a filename that begins with the pipe character `|`.",
"id": "GHSA-jppv-gw3r-w3q8",
"modified": "2023-08-29T15:03:03Z",
"published": "2020-02-28T16:54:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8130"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rake/commit/5b8f8fc41a5d7d7d6a5d767e48464c60884d3aee"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/651518"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-jppv-gw3r-w3q8"
},
{
"type": "PACKAGE",
"url": "https://github.com/ruby/rake"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rake/CVE-2020-8130.yml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4295-1"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "OS Command Injection in Rake"
}
FKIE_CVE-2020-8130
Vulnerability from fkie_nvd - Published: 2020-02-24 15:15 - Updated: 2024-11-21 05:38
Severity ?
Summary
There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.
References
| URL | Tags | ||
|---|---|---|---|
| support@hackerone.com | http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html | Mailing List, Third Party Advisory | |
| support@hackerone.com | https://hackerone.com/reports/651518 | Exploit, Patch, Third Party Advisory | |
| support@hackerone.com | https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html | Mailing List, Third Party Advisory | |
| support@hackerone.com | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/ | ||
| support@hackerone.com | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/ | ||
| support@hackerone.com | https://usn.ubuntu.com/4295-1/ | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://hackerone.com/reports/651518 | Exploit, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://usn.ubuntu.com/4295-1/ | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ruby-lang | rake | * | |
| canonical | ubuntu_linux | 16.04 | |
| canonical | ubuntu_linux | 18.04 | |
| canonical | ubuntu_linux | 19.10 | |
| debian | debian_linux | 8.0 | |
| fedoraproject | fedora | 30 | |
| fedoraproject | fedora | 31 | |
| opensuse | leap | 15.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ruby-lang:rake:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9C92BC17-1CFE-43EF-907A-D28AFCC5D2A3",
"versionEndExcluding": "12.3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
"matchCriteriaId": "A31C8344-3E02-4EB8-8BD8-4C84B7959624",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "There is an OS command injection vulnerability in Ruby Rake \u003c 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`."
},
{
"lang": "es",
"value": "Se presenta una vulnerabilidad de inyecci\u00f3n de comandos de Sistema Operativo en Ruby Rake versiones anteriores a 12.3.3, en la funci\u00f3n Rake::FileList cuando se suministra un nombre de archivo que comienza con el car\u00e1cter de tuber\u00eda \"|\"."
}
],
"id": "CVE-2020-8130",
"lastModified": "2024-11-21T05:38:21.133",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.5,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-02-24T15:15:11.957",
"references": [
{
"source": "support@hackerone.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
},
{
"source": "support@hackerone.com",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://hackerone.com/reports/651518"
},
{
"source": "support@hackerone.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html"
},
{
"source": "support@hackerone.com",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/"
},
{
"source": "support@hackerone.com",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/"
},
{
"source": "support@hackerone.com",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4295-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://hackerone.com/reports/651518"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4295-1/"
}
],
"sourceIdentifier": "support@hackerone.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "support@hackerone.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GSD-2020-8130
Vulnerability from gsd - Updated: 2019-08-29 00:00Details
There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in
Rake::FileList when supplying a filename that begins with the pipe character
`|`.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2020-8130",
"description": "There is an OS command injection vulnerability in Ruby Rake \u003c 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.",
"id": "GSD-2020-8130",
"references": [
"https://www.suse.com/security/cve/CVE-2020-8130.html",
"https://access.redhat.com/errata/RHSA-2021:4702",
"https://ubuntu.com/security/CVE-2020-8130",
"https://advisories.mageia.org/CVE-2020-8130.html",
"https://alas.aws.amazon.com/cve/html/CVE-2020-8130.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "rake",
"purl": "pkg:gem/rake"
}
}
],
"aliases": [
"CVE-2020-8130",
"GHSA-jppv-gw3r-w3q8"
],
"details": "There is an OS command injection vulnerability in Ruby Rake \u003c 12.3.3 in\nRake::FileList when supplying a filename that begins with the pipe character\n`|`.\n",
"id": "GSD-2020-8130",
"modified": "2019-08-29T00:00:00.000Z",
"published": "2019-08-29T00:00:00.000Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/advisories/GHSA-jppv-gw3r-w3q8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": 9.3,
"type": "CVSS_V2"
},
{
"score": 8.1,
"type": "CVSS_V3"
}
],
"summary": "OS Command Injection in Rake"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"ID": "CVE-2020-8130",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "https://github.com/ruby/ruby",
"version": {
"version_data": [
{
"version_value": "Fixed in Rake 12.3.3"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "There is an OS command injection vulnerability in Ruby Rake \u003c 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "OS Command Injection (CWE-78)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://hackerone.com/reports/651518",
"refsource": "MISC",
"url": "https://hackerone.com/reports/651518"
},
{
"name": "[debian-lts-announce] 20200226 [SECURITY] [DLA 2120-1] rake security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html"
},
{
"name": "USN-4295-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4295-1/"
},
{
"name": "openSUSE-SU-2020:0395",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
},
{
"name": "FEDORA-2020-28e06b5f08",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/"
},
{
"name": "FEDORA-2020-dc1ae17bb5",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/"
}
]
}
},
"github.com/rubysec/ruby-advisory-db": {
"cve": "2020-8130",
"cvss_v2": 9.3,
"cvss_v3": 8.1,
"date": "2019-08-29",
"description": "There is an OS command injection vulnerability in Ruby Rake \u003c 12.3.3 in\nRake::FileList when supplying a filename that begins with the pipe character\n`|`.\n",
"gem": "rake",
"ghsa": "jppv-gw3r-w3q8",
"patched_versions": [
"\u003e= 12.3.3"
],
"title": "OS Command Injection in Rake",
"url": "https://github.com/advisories/GHSA-jppv-gw3r-w3q8"
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c12.3.3",
"affected_versions": "All versions before 12.3.3",
"cvss_v2": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"cvss_v3": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-78",
"CWE-937"
],
"date": "2020-06-30",
"description": "There is an OS command injection vulnerability in Ruby Rake in `Rake::FileList` when supplying a filename that begins with the pipe character `|`.",
"fixed_versions": [
"12.3.3"
],
"identifier": "CVE-2020-8130",
"identifiers": [
"CVE-2020-8130"
],
"not_impacted": "All versions starting from 12.3.3",
"package_slug": "gem/rake",
"pubdate": "2020-02-24",
"solution": "Upgrade to version 12.3.3 or above.",
"title": "OS Command Injection",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-8130"
],
"uuid": "c1b2e6f9-89e0-4903-b140-8f8860bffa36"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:ruby-lang:rake:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "12.3.3",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve-assignments@hackerone.com",
"ID": "CVE-2020-8130"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "There is an OS command injection vulnerability in Ruby Rake \u003c 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://hackerone.com/reports/651518",
"refsource": "MISC",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://hackerone.com/reports/651518"
},
{
"name": "[debian-lts-announce] 20200226 [SECURITY] [DLA 2120-1] rake security update",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html"
},
{
"name": "USN-4295-1",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4295-1/"
},
{
"name": "openSUSE-SU-2020:0395",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
},
{
"name": "FEDORA-2020-28e06b5f08",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/"
},
{
"name": "FEDORA-2020-dc1ae17bb5",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.5,
"impactScore": 5.9
}
},
"lastModifiedDate": "2020-06-30T14:00Z",
"publishedDate": "2020-02-24T15:15Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…