CVE-2012-2140: Input Validation
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.
Other sources
Two flaws were corrected in rubygem-mail version 2.4.4:
A file system traversal in filedelivery method [1].
Arbitrary command execution when using exim or sendmail from the commandline [2],[3].
[1] https://github.com/mikel/mail/commit/29aca25218e4c82991400eb9b0c933626aefc98f [2] https://github.com/mikel/mail/commit/36b7fa23d38cb59dd79b7efa258ef0e7ddab5a11 [3] https://github.com/mikel/mail/commit/ac56f03bdfc30b379aeecd4ff317d08fdaa328c2
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2140?
CVE-2012-2140 is considered a critical vulnerability due to the potential for arbitrary command execution.
How do I fix CVE-2012-2140?
To fix CVE-2012-2140, upgrade the Mail gem to version 2.4.4 or later.
Which versions of the Mail gem are affected by CVE-2012-2140?
CVE-2012-2140 affects Mail gem versions before 2.4.3, including 2.3.2 and 2.3.3.
Can CVE-2012-2140 be exploited remotely?
Yes, CVE-2012-2140 can be exploited remotely by attackers through shell metacharacters.
What impact does CVE-2012-2140 have on system security?
The impact of CVE-2012-2140 on system security can lead to unauthorized execution of commands, compromising the affected system.