RCE in Richard Cook Rgpg

CVE-2013-4203

The self.run_gpg function in lib/rgpg/gpg_helper.rb in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.021 (79.5th percentile) — read the EPSS interpretation.

Affected products

Richard_cook Rgpg — versions 0.2.0, 0.2.1
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch)