Description
The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | sprout | 0.7.246 | — | GHSA-229r-pqp6-8w6g |
References
- 20131214 Command injection vulnerability in Ruby Gem sprout 0.7.246 mailing-list
- [oss-security] 20131202 Command injection vulnerability in Ruby Gem sprout 0.7.246 mailing-list
- [oss-security] 20131202 Re: Command injection vulnerability in Ruby Gem sprout 0.7.246 mailing-list
- http://vapid.dhs.org/advisories/sprout-0.7.246-command-inj.html