Alpine/ruby: high 8.8
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument start
Action: Upgrade ruby to 2.4.3-r0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.2 | 2.4.3-r0 | - |
Fixed versions
| 2.4.3-r0 |
Sources
published · modified · JSON