~ / search / GHSA-jg4m-q6w8-vrjp

GHSA-jg4m-q6w8-vrjp

rgpg Code Injection vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2013-4203

Packages

EcosystemPackageAffectedFixed in
RubyGems rgpg < 0.2.3 0.2.3

Details

As written in the advisory (Markdown source, shown as plain text).

The `self.run_gpg` function in `lib/rgpg/gpg_helper.rb` in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.

References

External links from the advisory. They lead to third-party sites.