CVE:CVE-2013-2090
CNNVD:CNNVD-201305-313
Creme Fraiche gem for Ruby是一套基于Ruby的可将电子邮件转换为PDF文件格式的软件。
Creme Fraiche gem for Ruby的lib/cremefraiche.rb文件中的‘set_meta_data’函数存在安全漏洞。远程攻击者可借助电子邮件附件文件名中的shell元字符利用该漏洞执行任意命令。Creme Fraiche gem 0.6及之前的版本受到影响。
solution:Upgrade uplawski creme_fraiche to a higher version than 0.6,0.4.5,0.4.5.1,0.4.5.2,0.4.5.4,0.4.5.5,0.4.5.6,0.5,0.5.1,0.5.2,0.5.3,and avoid the version (,0.6],0.4.5,0.4.5.1,0.4.5.2,0.4.5.4,0.4.5.5,0.4.5.6,0.5,0.5.1,0.5.2,0.5.3