Updated ruby-mechanize packages fix a security vulnerability

2021-03-1204:25:47

Gentoo Foundation

advisories.mageia.org

mechanize

command injection

vulnerability

os commands

cve-2021-21289

ruby

kernel#open

unix

CVSS2

7.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS3

8.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

0.003

Percentile

69.7%

JSON

In Mechanize, from v2.0.0 until v2.7.7, there is a command injection vulnerability. Affected versions of Mechanize allow for OS commands to be injected using several classes’ methods which implicitly use Ruby’s Kernel#open method (CVE-2021-21289).

OSVersionArchitecturePackageVersionFilename
Mageia7noarchruby-mechanize< 2.7.6-2.1ruby-mechanize-2.7.6-2.1.mga7
Mageia8noarchruby-mechanize< 2.7.6-3.1ruby-mechanize-2.7.6-3.1.mga8