SB2022092365 - openEuler 20.03 LTS SP3 update for rubygem-bundler
Published: September 23, 2022
Security Bulletin ID
SB2022092365
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2021-43809)
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability occurs when working with untrusted and apparently harmless `Gemfile`'s. A local user can trick the victim into opening a specially crafted directory containing a `Gemfile` file that declares a dependency that is located in a Git repository and execute arbitrary code on the target system.
Remediation
Install update from vendor's website.