PT-2016-1114 · Ruby · Colorscore

Dirk Zittersteyn + 1 · Publicado 2016-01-08 · Atualizado 2018-08-15 · CVE-2015-7541

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions colorscore gem versions prior to 0.0.5

Description The issue is related to the initialize method in the Histogram class, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in the image path, colors, or depth variable. This is due to a lack of input data sanitization measures. The exploitation of this issue can enable a remote attacker to execute arbitrary code.

Recommendations For versions prior to 0.0.5, update to version 0.0.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the image path, colors, and depth variables in the initialize method of the Histogram class to minimize the risk of exploitation.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2016-00359

CVE-2015-7541

GHSA-73QW-WW62-M54X

GHSA-9WCM-RRVH-QJC8

Produtos afetados

Colorscore

Referências · 11

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/colorscore/CVE-2015-7541.yml · Exploit
• https://github.com/quadule/colorscore/commit/570b5e854cecddd44d2047c44126aed951b61718 · Correção
• https://github.com/quadule/colorscore · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7541 · Nota de Segurança
• https://github.com/advisories/GHSA-9wcm-rrvh-qjc8 · Nota
• https://bdu.fstec.ru/vul/2016-00359 · Nota de Segurança
• http://rubysec.com/advisories/CVE-2015-7541 · Nota
• http://openwall.com/lists/oss-security/2016/01/05/2 · Nota
• http://seclists.org/oss-sec/2016/q1/17 · Nota
• https://osv.dev/vulnerability/GHSA-73qw-ww62-m54x · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-9wcm-rrvh-qjc8 · Aviso do Fabricante