Lucene search
Veracode Vulnerability DatabaseVERACODE:35770HistoryMay 30, 2022 - 6:53 a.m.
OS Command Injection
2022-05-3006:53:55
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
14
0.005 Low
EPSS
Percentile
75.5%
rack is vulnerable to OS command injection. The vulnerability exists in log function in CommonLogger and Lint middleware because of the escape sequences which allows an attacker to execute shell commands.
References
discuss.rubyonrails.org/t/cve-2022-30123-possible-shell-escape-sequence-injection-vulnerability-in-rack/80728
github.com/advisories/GHSA-wq4h-7r42-5hrr
github.com/rack/rack/commit/b426cc224908ec6ed6eb8729325392b048215d88
github.com/rack/rack/pull/1903
github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2022-30123.yml
groups.google.com/g/ruby-security-ann/c/LWB10kWzag8
Related
hackerone
hackerone
Ruby on Rails: Escape Sequence Injection vulnerability in Rack
2021-11-29 12:44:26
nvd
nvd
CVE-2022-30123
2022-12-05 22:15:10
github
github
Possible shell escape sequence injection vulnerability in Rack
2022-05-27 16:36:51
redhatcve
redhatcve
CVE-2022-30123
2022-06-21 08:00:05
cve
cve
CVE-2022-30123
2022-12-05 22:15:10
osv
osv
Possible shell escape sequence injection vulnerability in Rack
2022-05-27 16:36:51
CVE-2022-30123
2022-12-05 22:15:10
ruby-rack - security update
2022-09-04 00:00:00
debiancve
debiancve
CVE-2022-30123
2022-12-05 22:15:10
ubuntucve
ubuntucve
CVE-2022-30123
2022-12-05 00:00:00
cvelist
cvelist
CVE-2022-30123
2022-12-05 00:00:00
prion
prion
Design/Logic Flaw
2022-12-05 22:15:00
oraclelinux
oraclelinux
pcs security update
2022-11-03 00:00:00
nessus
nessus
Oracle Linux 7 : pcs (ELSA-2022-7343)
2022-11-03 00:00:00
Amazon Linux 2 : pcs (ALAS-2022-1895)
2022-12-07 00:00:00
GLSA-202310-18 : Rack: Multiple Vulnerabilities
2023-10-30 00:00:00
amazon
amazon
Important: pcs
2022-12-01 20:31:00
openvas
openvas
Ubuntu: Security Advisory (USN-5896-1)
2023-02-28 00:00:00
openSUSE: Security Advisory for rubygem-rack (SUSE-SU-2022:2192-1)
2022-06-28 00:00:00
Mageia: Security Advisory (MGASA-2022-0252)
2022-07-06 00:00:00
rubygems
rubygems
Possible shell escape sequence injection vulnerability in Rack
2022-06-26 21:00:00
debian
debian
[SECURITY] [DLA 3095-1] ruby-rack security update
2022-09-03 20:51:48
[SECURITY] [DSA 5530-1] ruby-rack security update
2023-10-22 12:35:21
redos
redos
ROS-20220706-02
2022-07-06 00:00:00
ubuntu
ubuntu
Rack vulnerabilities
2023-02-27 00:00:00
Rack vulnerabilities
2022-12-13 00:00:00
suse
suse
Security update for rubygem-rack (critical)
2022-06-27 00:00:00
mageia
mageia
Updated ruby-rack packages fix security vulnerability
2022-07-05 22:11:26
gentoo
gentoo
Rack: Multiple Vulnerabilities
2023-10-30 00:00:00
redhat
redhat
(RHSA-2022:7343) Important: pcs security update
2022-11-02 16:05:00