Sha256: 391d8af6ad0e955966d93171033e08ae13cd9527b6ac592ee0114800cbae1de2
Contents?: true
Size: 836 Bytes
Versions: 6
Compression:
Stored size: 836 Bytes
Contents
--- gem: gollum-grit_adapter cve: 2014-9489 url: https://github.com/gollum/gollum/issues/913 title: | gollum-grit_adapter Search Functionality Allows Arbitrary Command Execution date: 2014-12-04 description: | The gollum-grit_adapter gem contains a flaw that can allow arbitrary command execution. Grit implements its search functionality by shelling out to `git grep`. In turn, `git grep` takes a `-O` or `--open-files-in-pages` option that will pipe the results of `grep` to an arbitrary process. By failing to properly sanitize user input search parameters, an attacker can thus perform command execution. Note that the grep result must find the string 'master' (or whatever is the default branch that gollum uses) in any of the wiki's documents for this to succeed. patched_versions: - ">= 0.1.1"
Version data entries
6 entries across 6 versions & 2 rubygems