Most recent entries from all

bdu:2024-02311

EUVD-2026-227201

fkie_cve-2022-46648

ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318.

GHSA-pfpr-3463-c6jh — ruby-git has potential remote code execution vulnerability

Affected: RubyGems: git

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the `git ls-files` command using `eval()` to unescape quoted file names. If a file name was added to the git repository contained special characters, such as `\n`, then the `git ls-files` command would print the file name in quotes and escape any special characters. If the `Git#ls_files` method encountered a quoted file name it would use `eval()` to unquote and unescape any special characters, leading to potential remote code execution. Version 1.13.0 of the git gem was released which correctly parses any quoted file names.

gsd-2022-46648

jvndb-2023-000001

ruby-git is a Ruby library that can be used to create, read and operate Git repositories. ruby-git contains multiple code injection vulnerabilities (CWE-94). Yuki Kokubun of DeNA Co., Ltd. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

RHSA-2023:5931 — Red Hat Security Advisory: Satellite 6.13.5 Async Security Update

openssl: c_rehash script allows command injection openssl: the c_rehash script allows command injection foreman: OS command injection via ct_command and fcct_command GitPython: improper user input validation leads into a RCE ruby-git: code injection vulnerability ruby-git: code injection vulnerability Satellite/Foreman: Arbitrary code execution through yaml global parameters OpenSSL: Excessive time spent checking DH q parameter value python-django: Potential bypass of validation when uploading multiple files using one form field python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) GitPython: Insecure non-multi options in clone and clone_from is not blocked HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

UBUNTU-CVE-2022-46648

Affected: Ubuntu:16.04:LTS: ruby-git, Ubuntu:18.04:LTS: ruby-git, Ubuntu:20.04:LTS: ruby-git, Ubuntu:22.04:LTS: ruby-git

WID-SEC-W-2023-2723 — Red Hat Satellite: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Satellite ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.