GHSA-p463-639r-q9g9

Dragonfly Code Injection vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2013-1756

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	dragonfly	>= 0.7, < 0.8.6	0.8.6
RubyGems	dragonfly	>= 0.9, < 0.9.13	0.9.13

Details

As written in the advisory (Markdown source, shown as plain text).

The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-1756 advisory
https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277 web
https://exchange.xforce.ibmcloud.com/vulnerabilities/82476 web
https://github.com/markevans/dragonfly package
https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo web
https://web.archive.org/web/20200229103538/http://www.securityfocus.com/bid/58225 web