Skip to content
OpenAdvisories
High · 8.0 CVE-2022-46648 EUVD-2023-0518GHSA-pfpr-3463-c6jh

ruby-git has potential remote code execution vulnerability

Published Jan 17, 2023 · Updated Apr 4, 2025 · Assigned by jpcert

Vendor: ruby-git Product: ruby-git Package: git Package: ruby-git Package: ruby-git Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318.

Affected products

VendorProductAffectedFixed
ruby-git ruby-git versions prior to v1.13.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 ruby-git 1.13.1-1 —
Debian 13 ruby-git 1.13.1-1 —
Debian 12 ruby-git 1.13.1-1 —
Debian 11 ruby-git 1.7.0-1+deb11u1 DLA-4406-1
Debian 10 ruby-git 1.2.8-1+deb10u1 DLA-3303-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS ruby-git No fix yet —
Ubuntu 20.04 LTS ruby-git No fix yet —
Ubuntu 18.04 LTS ruby-git No fix yet —
Ubuntu 16.04 LTS ruby-git No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Satellite Utils 6 foreman +1 3.1.1.27-1.el7sat RHSA-2023:6818, RHSA-2023:5980, RHSA-2023:5979
Red Hat Satellite Capsule 6 foreman +1 3.1.1.27-1.el7sat RHSA-2023:6818, RHSA-2023:5980, RHSA-2023:5979
Red Hat Satellite Capsule 6 puppet-agent 7.26.0-3.el7sat RHSA-2023:6818, RHSA-2023:5980, RHSA-2023:5979
Red Hat Satellite Capsule 6 puppetserver 7.11.0-1.el8sat RHSA-2023:6818
Red Hat Satellite Capsule 6 python-django +1 3.2.21-1.el8pc RHSA-2023:6818, RHSA-2023:5931
Red Hat Satellite Capsule 6 python-future +1 0.18.3-1.el8pc RHSA-2023:6818
Red Hat Satellite Capsule 6 python-gitpython +1 3.1.32-1.el8pc RHSA-2023:6818, RHSA-2023:5931
Red Hat Satellite Capsule 6 python-pulp-ansible +1 1:0.16.0-1.el8pc RHSA-2023:6818
Red Hat Satellite Capsule 6 python-requests +1 2.31.0-1.el8pc RHSA-2023:6818
Red Hat Satellite Capsule 6 python-sqlparse +1 0.4.4-1.el8pc RHSA-2023:6818
Red Hat Satellite Capsule 6 rubygem-rack 2.2.7-1.el8sat RHSA-2023:6818
Red Hat Satellite 6 foreman +13 3.1.1.27-1.el7sat RHSA-2023:6818, RHSA-2023:5980, RHSA-2023:5979
Red Hat Satellite 6 foreman-redis 3.7.0.9-1.el8sat RHSA-2023:6818
Red Hat Satellite 6 puppet-agent 7.26.0-3.el7sat RHSA-2023:6818, RHSA-2023:5980, RHSA-2023:5979
Red Hat Satellite 6 puppetserver 7.11.0-1.el8sat RHSA-2023:6818
Red Hat Satellite 6 python-django +1 3.2.21-1.el8pc RHSA-2023:6818, RHSA-2023:5931
Red Hat Satellite 6 python-future +1 0.18.3-1.el8pc RHSA-2023:6818
Red Hat Satellite 6 python-gitpython +1 3.1.32-1.el8pc RHSA-2023:6818, RHSA-2023:5931
Red Hat Satellite 6 python-pulp-ansible +1 1:0.16.0-1.el8pc RHSA-2023:6818
Red Hat Satellite 6 python-requests +1 2.31.0-1.el8pc RHSA-2023:6818
Red Hat Satellite 6 python-sqlparse +1 0.4.4-1.el8pc RHSA-2023:6818
Red Hat Satellite 6 rubygem-actionpack +2 6.1.7.3-1.el8sat RHSA-2023:6818
Red Hat Satellite 6 rubygem-git 1.18.0-0.1.el8sat RHSA-2023:6818, RHSA-2023:5980, RHSA-2023:5979
Red Hat Satellite 6 rubygem-globalid 1.1.0-1.el8sat RHSA-2023:6818
Red Hat Satellite 6 rubygem-kubeclient 4.10.1-1.el8sat RHSA-2023:6818
Red Hat Satellite 6 rubygem-rack 2.2.7-1.el8sat RHSA-2023:6818
Red Hat Satellite 6 rubygem-safemode 1.3.8-1.el8sat RHSA-2023:5979
Red Hat Satellite 6 tfm-rubygem-git 1.18.0-0.1.el7sat RHSA-2023:5980
Red Hat Satellite 6 yggdrasil-worker-forwarder 0.0.3-1.el7sat RHSA-2023:6818, RHSA-2023:5980, RHSA-2023:5979

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems git >= 1.2.0, < 1.13.0 1.13.0 GHSA-pfpr-3463-c6jh

Advisories 7

References