CVE-2020-26222
Description
Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$({curl,127.0.0.1})", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. The fix was applied to version 0.125.1. As a workaround, one can escape the branch name prior to passing it to the Dependabot::Source class.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
dependabot-omnibusRubyGems | >= 0.119.0.beta1, < 0.125.1 | 0.125.1 |
dependabot-commonRubyGems | >= 0.119.0.beta1, < 0.125.1 | 0.125.1 |
Affected products
6cpe:2.3:a:dependabot_project:dependabot:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:dependabot_project:dependabot:*:*:*:*:*:*:*:*range: >=0.119.1,<0.125.1
- cpe:2.3:a:dependabot_project:dependabot:0.119.0:-:*:*:*:*:*:*
- cpe:2.3:a:dependabot_project:dependabot:0.119.0:beta1:*:*:*:*:*:*
- ghsa-coords2 versions
>= 0.119.0.beta1, < 0.125.1+ 1 more
- (no CPE)range: >= 0.119.0.beta1, < 0.125.1
- (no CPE)range: >= 0.119.0.beta1, < 0.125.1
- Range: < 0.125.1
Patches
Vulnerability mechanics
References
9- github.com/dependabot/dependabot-core/commit/e089116abbe284425b976f7920e502b8e83a61b5nvdPatchThird Party AdvisoryWEB
- github.com/dependabot/dependabot-core/pull/2727nvdPatchThird Party AdvisoryWEB
- github.com/dependabot/dependabot-core/security/advisories/GHSA-23f7-99jx-m54rnvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-23f7-99jx-m54rghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-26222ghsaADVISORY
- github.com/rubysec/ruby-advisory-db/blob/master/gems/dependabot-common/CVE-2020-26222.ymlghsaWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/dependabot-omnibus/CVE-2020-26222.ymlghsaWEB
- rubygems.org/gems/dependabot-commonghsaWEB
- rubygems.org/gems/dependabot-omnibusghsaWEB
News mentions
0No linked articles in our index yet.