CVE-2021-21305

描述

CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1.

如何修補 CVE-2021-21305

要修補 CVE-2021-21305,請將受影響套件升級到下列已修補版本。

• —升級至 1.3.2 或更新版本

CVE-2021-21305 正在被利用嗎?

中等 — EPSS 為 12.7%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, < 1.3.2

CVSS 分數

參考連結(8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-21305
• PATCHgithub.com/carrierwaveuploader/carrierwave
• WEBgithub.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08
• WEBgithub.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08