Debian/ruby-kramdown: critical 9.8
The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded R
Action: Upgrade ruby-kramdown to 2.3.0-3 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.3.0-3 | - |
Fixed versions
| 2.3.0-3 |
Sources
- osv: DEBIAN-CVE-2020-14001#Debian:13/ruby-kramdown
- https://security-tracker.debian.org/tracker/CVE-2020-14001
published · modified · JSON