UBUNTU-CVE-2020-14001: Critical severity ubuntu/ruby-kramdown vulnerability
The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= ). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ruby-kramdownto a version that resolves this vulnerability.Fixed in 1.10.0-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/ruby-kramdownto a version that resolves this vulnerability.Fixed in 1.15.0-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/ruby-kramdownto a version that resolves this vulnerability.Fixed in 1.17.0-4ubuntu0.1
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Deployments that process untrusted Kramdown documents are exposed, because the template option is processed by default. This includes environments using kramdown directly or through Jekyll, GitLab Pages, GitHub Pages, or Thredded Forum.
What does an attacker need to exploit it?
An attacker needs a way to supply or influence Kramdown document content that will be processed by a vulnerable kramdown gem. No authentication, user interaction, or special access is indicated by the provided severity vector.
What could successful exploitation allow?
A crafted template option can cause unintended file reads, such as reading /etc/passwd. It can also cause embedded Ruby code execution through a template string.
Are default settings affected?
Yes. The vulnerable behavior occurs because kramdown processes the template option inside Kramdown documents by default.
What version resolves the issue?
kramdown versions before 2.3.0 are affected. Upgrading to version 2.3.0 or later removes the described vulnerable behavior.