Sha256: dd60ddacc00d7954f32ac3bbfd3198ba1b16b15b11653b76adc2e2fdf7069f45
Contents?: true
Size: 1.17 KB
Versions: 19
Compression:
Stored size: 1.17 KB
Contents
module Dawn
module Kb
# Automatically created with rake on 2014-02-06
class CVE_2013_2516
include DependencyCheck
def initialize
message = "fileutils Gem for Ruby contains a flaw in file_utils.rb. The issue is triggered when handling a specially crafted URL containing a command after a delimiter (;). This may allow a remote attacker to potentially execute arbitrary commands."
super({
:name=>"CVE-2013-2516",
:cvss=>"",
:release_date => Date.new(2013, 2, 28),
:cwe=>"",
:owasp=>"A9",
:applies=>["rails", "sinatra", "padrino"],
:kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
:message=>message,
:mitigation=>"At the time of writing this, there is no solution to this vulnerability by software upgrade since latest version is still 0.7. You may want to sanitize your input before passing to offendend library.",
:aux_links=>["http://packetstormsecurity.com/files/120579/Fileutils-Ruby-Gem-Remote-Command-Execution.html"]
})
self.safe_dependencies = [{:name=>"fileutils", :version=>['0.8']}]
end
end
end
end
Version data entries
19 entries across 19 versions & 1 rubygems