CVE-2021-31799: Command Injection
An operating system command injection flaw was found in RDoc. Using the rdoc command to generate documentation for a malicious Ruby source code could lead to execution of arbitrary commands with the privileges of the user running rdoc.
Other sources
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
RDoc used to call Kernel#open to open a local file. If a Ruby project has a file whose name starts with | and ends with tags, the command following the pipe character is executed. A malicious Ruby project could exploit it to run an arbitrary command execution against a user who attempts to run rdoc command.
References:
https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-ruby27-rubyto a version that resolves this vulnerability.Fixed in 0:2.7.4-130.el7 - Upgrade
Upgrade
redhat/rh-ruby30-rubyto a version that resolves this vulnerability.Fixed in 0:3.0.2-148.el7 - Upgrade
Upgrade
redhat/rh-ruby26-rubyto a version that resolves this vulnerability.Fixed in 0:2.6.9-120.el7 - Upgrade
Upgrade
rubygems/rdocto a version that resolves this vulnerability.Fixed in 6.3.1 - Upgrade
Upgrade
rubygems/rdocto a version that resolves this vulnerability.Fixed in 6.2.1.1 - Upgrade
Upgrade
rubygems/rdocto a version that resolves this vulnerability.Fixed in 6.1.2.1 - Upgrade
Upgrade
debian/ruby2.7to a version that resolves this vulnerability.Fixed in 2.7.4-1+deb11u1Fixed in 2.7.4-1+deb11u5 - Upgrade
Upgrade
redhat/rubygem-rdocto a version that resolves this vulnerability.Fixed in 6.3.1 - Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 3.0.2 - Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 2.7.4 - Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 2.6.8
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-31799?
CVE-2021-31799 is an operating system command injection vulnerability found in RDoc.
How does CVE-2021-31799 impact Ruby?
CVE-2021-31799 allows an attacker to execute arbitrary commands with the privileges of the user running rdoc in Ruby through version 3.0.1.
What is the severity of CVE-2021-31799?
CVE-2021-31799 has a severity rating of 7, indicating a high severity vulnerability.
How do I fix CVE-2021-31799?
To fix CVE-2021-31799, update RDoc to version 6.3.1 or higher.
Where can I find more information about CVE-2021-31799?
You can find more information about CVE-2021-31799 in the references provided: [Link 1](https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/), [Link 2](https://github.com/ruby/rdoc/commit/a7f5d6ab88632b3b482fe10611382ff73d14eed7), [Link 3](https://www.ruby-lang.org/en/news/2021/07/07/ruby-3-0-2-released/).