PT-2022-5132 · Arr-Pm · Arr-Pm

Joernchen · Published 2022-09-21 · Updated 2022-09-26 · CVE-2022-39224

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arr-pm versions prior to 0.0.12

Description The issue is related to OS command injection, which can result in shell execution if an RPM contains a malicious payload compressor field. This impacts the extract and files methods of the RPM::File class. To mitigate, ensure RPMs being processed contain valid payload compressor values such as gzip, bzip2, xz, zstd, and lzma. The payload compressor field in an RPM can be checked using the rpm command line tool.

Recommendations For versions prior to 0.0.12, update to version 0.0.12 to patch the issue. As a temporary workaround, ensure any RPMs being processed contain valid/known payload compressor values such as gzip, bzip2, xz, zstd, and lzma. Restrict access to the extract and files methods of the RPM::File class until the issue is resolved.

Exploit

Fix

XSS

OS Command Injection

Weakness Enumeration

CWE-79

CWE-78

Related Identifiers

BDU:2022-06388

CVE-2022-39224

GHSA-88CV-MJ24-8W3Q

Affected Products

Arr-Pm

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39224.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/arr-pm/CVE-2022-39224.yml · Exploit
• 🔥 https://github.com/jordansissel/ruby-arr-pm/security/advisories/GHSA-88cv-mj24-8w3q · Exploit
• https://github.com/jordansissel/ruby-arr-pm/pull/14 · Patch
• https://github.com/jordansissel/ruby-arr-pm/pull/15 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39224 · Security Note
• https://osv.dev/vulnerability/GHSA-88cv-mj24-8w3q · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06388 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39224 · Vendor Advisory
• https://github.com/jordansissel/ruby-arr-pm · Note
• https://t.me/cibsecurity/50247 · Telegram Post