CVE-2022-47318: Code Injection
ruby-git is a Ruby library that can be used to create, read and operate Git repositories. ruby-git contains multiple code injection vulnerabilities. If a repository containing a specially crafted filename is loaded to the product, an arbitrary ruby code may be executed.
Other sources
ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-47318?
CVE-2022-47318 has a critical severity rating due to the potential for remote code execution.
How do I fix CVE-2022-47318?
To fix CVE-2022-47318, update ruby-git to version 1.13.0 or later.
What versions of ruby-git are affected by CVE-2022-47318?
All versions of ruby-git prior to 1.13.0 are affected by CVE-2022-47318.
Can CVE-2022-47318 be exploited remotely?
Yes, CVE-2022-47318 can be exploited by a remote authenticated attacker.
What platforms are affected by CVE-2022-47318?
CVE-2022-47318 affects ruby-git installations on certain Linux distributions, including Debian 10.0 and Fedora 37.