CVE-2022-39224
1 advisory.
RubyGems/arr-pm CVE-2022-39224: high 7, EPSS 1.46%
arr-pm vulnerable to arbitrary shell execution when extracting or listing files contained in a malicious rpm.
Action: Upgrade arr-pm to 0.0.12 or later.
bundle update arr-pmAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.0.12 | - |
Fixed versions
| 0.0.12 |
Sources
- osv: GHSA-88cv-mj24-8w3q
- https://github.com/jordansissel/ruby-arr-pm/security/advisories/GHSA-88cv-mj24-8w3q
- https://nvd.nist.gov/vuln/detail/CVE-2022-39224
- https://github.com/jordansissel/ruby-arr-pm/pull/14
- https://github.com/jordansissel/ruby-arr-pm/pull/15
- https://github.com/jordansissel/ruby-arr-pm
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/arr-pm/CVE-2022-39224.yml
CVE-2022-39224 · published · modified · JSON