UBUNTU-CVE-2021-21289

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2021-21289
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-21289.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-21289
Related
Published
2021-02-02T19:15:00Z
Modified
2024-10-15T14:08:00Z
Severity
  • 8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#saveas, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#readbody. This is fixed in version 2.7.7.

References

Affected packages

Ubuntu:Pro:16.04:LTS / ruby-mechanize

Package

Name
ruby-mechanize
Purl
pkg:deb/ubuntu/ruby-mechanize?arch=src?distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.7.3-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / ruby-mechanize

Package

Name
ruby-mechanize
Purl
pkg:deb/ubuntu/ruby-mechanize?arch=src?distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.7.5-1
2.7.5-2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / ruby-mechanize

Package

Name
ruby-mechanize
Purl
pkg:deb/ubuntu/ruby-mechanize?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.7.6-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / ruby-mechanize

Package

Name
ruby-mechanize
Purl
pkg:deb/ubuntu/ruby-mechanize?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.7.7-1
2.7.7-3

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}