OS Command Injection

2020-02-2604:45:34

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

36.8%

JSON

rake is vulnerable to OS command injection. The vulnerability exists as it improperly handles the value of the command file name in Rake::FileList, allowing OS command injection when list.egrep is called with a malicious file name such as | touch evil.txt.

CPENameOperatorVersion
rakele12.3.2
satelliteeq6.2.0__21.2.el7sat
satelliteeq6.7.4__1.el7sat
satelliteeq6.4.3__2.el7sat
satelliteeq6.5.3__1.el7sat
satelliteeq6.2.10__4.0.el7sat
satelliteeq6.2.14__4.0.el7sat
satelliteeq6.2.11__2.0.el7sat
satelliteeq6.5.3.2__1.el7sat
satelliteeq6.7.2__1.el7sat

Name	Operator	Version
rake	le	12.3.2
satellite	eq	6.2.0__21.2.el7sat
satellite	eq	6.7.4__1.el7sat
satellite	eq	6.4.3__2.el7sat
satellite	eq	6.5.3__1.el7sat
satellite	eq	6.2.10__4.0.el7sat
satellite	eq	6.2.14__4.0.el7sat
satellite	eq	6.2.11__2.0.el7sat
satellite	eq	6.5.3.2__1.el7sat
satellite	eq	6.7.2__1.el7sat