Remote Code Execution Vulnerability in ruby-git by Ruby
CVE-2022-46648

8HIGH

Key Information:

Vendor
Ruby-git
Status
Ruby-git
Vendor
CVE Published:
17 January 2023

Summary

The ruby-git product, prior to version 1.13.0, is susceptible to a remote code execution vulnerability. This issue arises when a remote authenticated attacker crafts a repository containing a specially engineered filename. When the victim user loads this repository, it can result in the execution of arbitrary Ruby code. It is crucial to update to the latest versions to mitigate this risk and ensure system security.

Affected Version(s)

ruby-git versions prior to v1.13.0

References

https://github.com/ruby-git/ruby-git
https://github.com/ruby-git/ruby-git/pull/602
https://jvn.jp/en/jp/JVN16765254/index.html

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.