Lucene search

K

HackeroneCVELIST:CVE-2020-8130

HistoryFeb 24, 2020 - 2:41 p.m.

CVE-2020-8130

2020-02-2414:41:26

CWE-78

hackerone

www.cve.org

1

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.6%

There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.

CNA Affected

[
  {
    "product": "https://github.com/ruby/ruby",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in Rake 12.3.3"
      }
    ]
  }
]

References

lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html

hackerone.com/reports/651518

lists.debian.org/debian-lts-announce/2020/02/msg00026.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/

usn.ubuntu.com/4295-1/

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.6%

Related for CVELIST:CVE-2020-8130

fedora2 veracode1 osv3 openvas14 cve1 nessus16 mageia1 redhatcve1 nvd1 amazon2 hackerone1 prion1 cloudfoundry1 ubuntucve1 debian1 debiancve1 ubuntu1 github1 suse1 redhat1