Description
There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | https://github.com/ruby/ruby | Fixed in Rake 12.3.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rake | 12.3.3-1 | — |
| Debian 13 | rake | 12.3.3-1 | — |
| Debian 12 | rake | 12.3.3-1 | — |
| Debian 8 | rake | 10.3.2-2+deb8u1 | DLA-2120-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | rake | 12.3.1-1ubuntu0.1 | USN-4295-1 |
| Ubuntu 16.04 LTS | rake | 10.5.0-2ubuntu0.1 | USN-4295-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | foreman | 2.5.2.17-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-aiohttp | 3.7.4-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-ecdsa +1 | 0.13.3-2.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-pyyaml +1 | 5.4.1-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-urllib3 +1 | 1.26.5-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python3-django | 2.2.24-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | satellite +1 | 6.10.0-3.el7sat | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | tfm-rubygem-nokogiri | 1.11.3-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | candlepin | 4.0.9-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | foreman | 2.5.2.17-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-aiohttp | 3.7.4-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-ecdsa +1 | 0.13.3-2.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-pyyaml +1 | 5.4.1-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-urllib3 +1 | 1.26.5-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python3-django | 2.2.24-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | satellite | 6.10.0-3.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-activerecord-session_store | 2.0.0-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-addressable | 2.8.0-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-nokogiri | 1.11.3-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-puma | 5.3.2-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-rails +1 | 6.0.3.7-1.el7sat | RHSA-2021:4702 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | ruby2.5 | 2.5.7-4.8.1 | SUSE-SU-2020:0737-1 |
| SLES 15 | ruby2.5 | 2.5.7-4.8.1 | SUSE-SU-2020:0737-1 |
| SLES 12 | rubygem-rake | 10.3.2-9.7.1 | SUSE-SU-2022:3212-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 | ruby2.5 | 2.5.7-4.8.1 | SUSE-SU-2020:0737-1 |
| SLE HPC 15 | ruby2.5 | 2.5.7-4.8.1 | SUSE-SU-2020:0737-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | ruby2.5 | 2.5.7-lp151.4.6.1 | openSUSE-SU-2020:0395-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rake | < 12.3.3 | 12.3.3 | GHSA-jppv-gw3r-w3q8 |
Advisories 6
- RHSA-2021:4702 Red Hat Security Advisory: Satellite 6.10 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- DLA-2120-1 rake - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4295-1 rake vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2022:3212-1 Security update for rubygem-rake SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0395-1 Recommended update for ruby2.5 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0737-1 Recommended update for ruby2.5 SUSE / openSUSE Security Updates · May 2, 2025
References
- https://hackerone.com/reports/651518
- [debian-lts-announce] 20200226 [SECURITY] [DLA 2120-1] rake security update mailing-list
- USN-4295-1 vendor-advisory
- openSUSE-SU-2020:0395 vendor-advisory
- FEDORA-2020-28e06b5f08 vendor-advisory
- FEDORA-2020-dc1ae17bb5 vendor-advisory