GHSA-5f2p-6vjv-2q2m

Sup Code Injection vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-4478

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	sup	< 0.13.2.1	0.13.2.1
RubyGems	sup	>= 0.14.0, < 0.14.1.1	0.14.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-4478 advisory
https://github.com/sup-heliotrope/sup/commit/8b46cdbfc14e07ca07d403aa28b0e7bc1c544785 web
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sup/CVE-2013-4478.yml web
https://github.com/sup-heliotrope/sup package
https://web.archive.org/web/20140524005344/http://rubyforge.org/pipermail/sup-talk/2013-October/004996.html web
https://web.archive.org/web/20140524012714/http://rubyforge.org/pipermail/sup-talk/2013-August/004993.html web
http://rubyforge.org/pipermail/sup-talk/2013-August/004993.html web
http://rubyforge.org/pipermail/sup-talk/2013-October/004996.html web
http://www.debian.org/security/2012/dsa-2805 web
http://www.openwall.com/lists/oss-security/2013/10/30/2 web
http://www.phenoelit.org/stuff/whatsup.txt web