USN-6424-1 — ruby-kramdown vulnerability

Summary

It was discovered that kramdown did not restrict Rouge formatters to the
correct namespace. An attacker could use this issue to cause kramdown to
execute arbitrary code.

Fixed packages 1

Release	Package	Fixed in
Ubuntu · 20.04 LTS 20.04:LTS	ruby-kramdown	1.17.0-4ubuntu0.2

Vulnerabilities 1

Critical 9.8

CVE-2021-28834

Remote code execution in Kramdown

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

kramdown ruby-kramdown ruby-kramdown Debian Ubuntu RubyGems

Mar 19, 2021

References

report
https://ubuntu.com/security/CVE-2021-28834

ruby-kramdown vulnerability

Summary

Fixed packages 1

Vulnerabilities 1

Remote code execution in Kramdown

References