Alerts This Week
Warning Icon 1 1,154
Alerts This Week
Warning Icon 1 1,154

Gentoo GLSA-202401-05: RDoc Command Injection Vulnerability Alert

gentoo
Calendar Grey January 5, 2024
Dist Gentoo Esm H88
An important security flaw has been identified in Gentoo's RDoc; it is essential for users to perform updates immediately to address potential threats.
A vulnerability has been found in RDoc which allows for command injection.

Summary

A vulnerability has been discovered in RDoc. Please review the CVE identifier referenced below for details.

Topics%20covered

Topics Covered

security advisory Gentoo software update command injection normal severity RDoc

Resolution

All RDoc users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/rdoc-6.3.2"

References

[ 1 ] CVE-2021-31799 https://nvd.nist.gov/vuln/detail/CVE-2021-31799

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202401-05
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: RDoc: Command Injection
Date: January 05, 2024
Bugs: #801301
ID: 202401-05

Topics%20covered

Topics Covered

security advisory Gentoo software update command injection normal severity RDoc

Synopsis

A vulnerability has been found in RDoc which allows for command injection.

Background

RDoc produces HTML and command-line documentation for Ruby projects.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

Package Vulnerable Unaffected ------------- ------------ ------------ dev-ruby/rdoc < 6.3.2 >= 6.3.2

Impact

RDoc used to call Kernel#open to open a local file. If a Ruby project has a file whose name starts with | and ends with tags, the command following the pipe character is executed. A malicious Ruby project could exploit it to run an arbitrary command execution against a user who attempts to run the rdoc command.

Workaround

There is no known workaround at this time.

Your message here