GHSA-vmfh-c547-v45h

Remote code execution in ruby-jss

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-33575

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	ruby-jss	< 1.6.0	1.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-33575 advisory
https://github.com/PixarAnimationStudios/ruby-jss package
https://github.com/PixarAnimationStudios/ruby-jss/blob/e6d48dd8c77f9275c76787d60d3472615fcd9b77/CHANGES.md#160---2021-05-24 web
https://github.com/advisories/GHSA-vmfh-c547-v45h advisory
https://github.com/patsplat/plist/tree/ce8f9ae42a114f603ea200c955e420782bffc4ad#label-Security+considerations web
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-jss/CVE-2021-33575.yml web