Skip to content
OpenAdvisories
High DLA-3303-1 3 CVEs

ruby-git - security update

Published Jan 31, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 ruby-git 1.2.8-1+deb10u1

Vulnerabilities 3

  • High 8.8
    CVE-2022-47318

    Code injection in ruby git

    ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648.

    ruby-git ruby-git ruby-git git Debian Ubuntu RubyGems
  • High 8.1
    CVE-2022-25648

    Command Injection

    The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. …

    git ruby-git ruby-git Debian Ubuntu RubyGems
  • High 8.0
    CVE-2022-46648

    ruby-git has potential remote code execution vulnerability

    ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318.

    ruby-git ruby-git git ruby-git Debian Ubuntu RubyGems