Description
The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | cocaine | >= 0.4.0, < 0.5.3 | 0.5.3 | GHSA-c43v-hrmg-56r4 |
References
- https://github.com/thoughtbot/cocaine/blob/master/NEWS.md
- 98835 vdb-entry
- [oss-security] 20131022 Recursive Interpolation Vulnerability in Cocaine rubygem (CVE-2013-4457) mailing-list
- 55365 third-party-advisory