Description
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| savonrb | savon | >= 0.9.8, < 2.17.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | savon | >= 0.9.8, < 2.17.2 | 2.17.2 | GHSA-mx5j-mp4f-g8jg |