CVE:CVE-2020-8130
CNNVD:CNNVD-202002-1102
Ruby是松本行弘软件开发者的一种跨平台、面向对象的动态类型编程语言。
Ruby Rake 12.3.3之前版本中的Rake::FileList存在操作系统命令注入漏洞。远程攻击者可借助以管道字符“ |”开头的文件名利用该漏洞在系统上执行任意命令。
solution:Upgrade ruby-lang rake to a higher version than 12.3.3,and avoid the version (,12.3.3); Upgrade canonical ubuntu_linux to a higher version than 16.04,18.04,19.10,and avoid the version 16.04,18.04,19.10; Upgrade debian debian_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade fedoraproject fedora to a higher version than 30,31,and avoid the version 30,31; Upgrade opensuse leap to a higher version than 15.1,and avoid the version 15.1