CVE-2022-46648: Code Injection
ruby-git is a Ruby library that can be used to create, read and operate Git repositories. ruby-git contains multiple code injection vulnerabilities. If a repository containing a specially crafted filename is loaded to the product, an arbitrary ruby code may be executed.
Other sources
ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318.
The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the git ls-files command using eval() to unescape quoted file names. If a file name was added to the git repository contained special characters, such as \n, then the git ls-files command would print the file name in quotes and escape any special characters. If the Git#lsfiles method encountered a quoted file name it would use eval() to unquote and unescape any special characters, leading to potential remote code execution. Version 1.13.0 of the git gem was released which correctly parses any quoted file names.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-46648?
CVE-2022-46648 is classified as a medium severity vulnerability.
How do I fix CVE-2022-46648?
To fix CVE-2022-46648, upgrade ruby-git to version 1.13.0 or later.
Who is affected by CVE-2022-46648?
CVE-2022-46648 affects all ruby-git versions prior to 1.13.0.
What type of attack is possible with CVE-2022-46648?
CVE-2022-46648 allows a remote authenticated attacker to execute arbitrary Ruby code.
What is the impact of CVE-2022-46648?
The impact of CVE-2022-46648 is the potential unauthorized execution of Ruby code from a malicious repository.