RDoc: Command Injection — GLSA 202401-05

A vulnerability has been found in RDoc which allows for command injection.

Affected packages

Background

RDoc produces HTML and command-line documentation for Ruby projects.

Description

A vulnerability has been discovered in RDoc. Please review the CVE identifier referenced below for details.

Impact

RDoc used to call Kernel#open to open a local file. If a Ruby project has a file whose name starts with | and ends with tags, the command following the pipe character is executed. A malicious Ruby project could exploit it to run an arbitrary command execution against a user who attempts to run the rdoc command.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-ruby/rdoc-6.3.2"
 

References

• CVE-2021-31799

Release date
January 05, 2024

Latest revision
January 05, 2024: 1

Severity
normal

Exploitable
remote

Bugzilla entries

• 801301