High severityNVD Advisory· Published Jul 29, 2021· Updated Oct 15, 2024
CVE-2021-31799
CVE-2021-31799
Description
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
rdocRubyGems | >= 3.11, < 6.1.2.1 | 6.1.2.1 |
rdocRubyGems | >= 6.2.0, < 6.2.1.1 | 6.2.1.1 |
rdocRubyGems | >= 6.3.0, < 6.3.1 | 6.3.1 |
Affected products
83- RDoc/RDocdescription
- ghsa-coords82 versionspkg:gem/rdocpkg:rpm/almalinux/rubypkg:rpm/almalinux/ruby-default-gemspkg:rpm/almalinux/ruby-develpkg:rpm/almalinux/ruby-docpkg:rpm/almalinux/rubygem-abrtpkg:rpm/almalinux/rubygem-abrt-docpkg:rpm/almalinux/rubygem-bigdecimalpkg:rpm/almalinux/rubygem-bsonpkg:rpm/almalinux/rubygem-bson-docpkg:rpm/almalinux/rubygem-bundlerpkg:rpm/almalinux/rubygem-bundler-docpkg:rpm/almalinux/rubygem-did_you_meanpkg:rpm/almalinux/rubygem-io-consolepkg:rpm/almalinux/rubygem-irbpkg:rpm/almalinux/rubygem-jsonpkg:rpm/almalinux/rubygem-minitestpkg:rpm/almalinux/rubygem-mongopkg:rpm/almalinux/rubygem-mongo-docpkg:rpm/almalinux/rubygem-mysql2pkg:rpm/almalinux/rubygem-mysql2-docpkg:rpm/almalinux/rubygem-net-telnetpkg:rpm/almalinux/rubygem-opensslpkg:rpm/almalinux/rubygem-pgpkg:rpm/almalinux/rubygem-pg-docpkg:rpm/almalinux/rubygem-power_assertpkg:rpm/almalinux/rubygem-psychpkg:rpm/almalinux/rubygem-rakepkg:rpm/almalinux/rubygem-rdocpkg:rpm/almalinux/rubygemspkg:rpm/almalinux/rubygems-develpkg:rpm/almalinux/rubygem-test-unitpkg:rpm/almalinux/rubygem-xmlrpcpkg:rpm/almalinux/ruby-irbpkg:rpm/almalinux/ruby-libspkg:rpm/opensuse/ruby2.5&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/ruby2.5&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/ruby2.5&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/ruby2.7&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ruby3.0&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ruby3.1&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ruby3.2&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ruby3.3&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ruby3.4&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ruby4.0&distro=openSUSE%20Tumbleweedpkg:rpm/suse/ruby2.1&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSSpkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/ruby2.1&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/ruby2.1&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/ruby2.1&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/ruby2.1&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209pkg:rpm/suse/ruby2.5&distro=SUSE%20Enterprise%20Storage%206pkg:rpm/suse/ruby2.5&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-ESPOSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Micro%205.0pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP2pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCLpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-BCLpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/ruby2.5&distro=SUSE%20Manager%20Proxy%204.1pkg:rpm/suse/ruby2.5&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.1pkg:rpm/suse/ruby2.5&distro=SUSE%20Manager%20Server%204.1
>= 3.11, < 6.1.2.1+ 81 more
- (no CPE)range: >= 3.11, < 6.1.2.1
- (no CPE)range: < 2.7.4-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 2.7.4-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 2.7.4-137.module_el8.5.0+117+35d1289b
- (no CPE)range: < 2.7.4-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 0.4.0-1.module_el8.4.0+2399+4e3a532a
- (no CPE)range: < 0.4.0-1.module_el8.5.0+118+1ab773e1
- (no CPE)range: < 2.0.0-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 4.8.1-1.module_el8.5.0+117+35d1289b
- (no CPE)range: < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4
- (no CPE)range: < 2.2.24-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 1.16.1-4.module_el8.5.0+2625+ec418553
- (no CPE)range: < 1.3.0-108.module_el8.5.0+2623+08a8ba32
- (no CPE)range: < 0.5.6-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 1.2.6-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 2.3.0-137.module_el8.5.0+117+35d1289b
- (no CPE)range: < 5.13.0-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 2.11.3-1.module_el8.3.0+6147+d0dfc1e4
- (no CPE)range: < 2.11.3-1.module_el8.3.0+6147+d0dfc1e4
- (no CPE)range: < 0.5.3-1.module_el8.4.0+2399+4e3a532a
- (no CPE)range: < 0.5.3-1.module_el8.5.0+118+1ab773e1
- (no CPE)range: < 0.2.0-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 2.1.2-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 1.2.3-1.module_el8.3.0+6147+d0dfc1e4
- (no CPE)range: < 1.2.3-1.module_el8.3.0+6147+d0dfc1e4
- (no CPE)range: < 1.1.7-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 3.1.0-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 13.0.1-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 6.2.1.1-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 3.1.6-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 3.1.6-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 3.3.4-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 0.3.0-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 2.5.9-109.module_el8.5.0+259+8cec6917
- (no CPE)range: < 2.7.4-137.module_el8.4.0+2515+f744ca41
- (no CPE)range: < 2.5.9-lp152.2.9.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.7.4-1.1
- (no CPE)range: < 3.0.2-1.1
- (no CPE)range: < 3.1.0-1.1
- (no CPE)range: < 3.2.1-1.1
- (no CPE)range: < 3.3.0-1.2
- (no CPE)range: < 3.4.1-1.1
- (no CPE)range: < 4.0.0~preview2-1.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-4.20.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
- (no CPE)range: < 2.5.9-150000.4.23.1
Patches
Vulnerability mechanics
References
12- github.com/advisories/GHSA-ggxm-pgc9-g7fpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-31799ghsaADVISORY
- security.gentoo.org/glsa/202401-05ghsavendor-advisoryWEB
- github.com/ruby/rdoc/commit/a7f5d6ab88632b3b482fe10611382ff73d14eed7ghsaWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rdoc/CVE-2021-31799.ymlghsaWEB
- lists.debian.org/debian-lts-announce/2021/10/msg00009.htmlghsamailing-listWEB
- security-tracker.debian.org/tracker/CVE-2021-31799ghsaWEB
- security.netapp.com/advisory/ntap-20210902-0004ghsaWEB
- www.oracle.com/security-alerts/cpuapr2022.htmlghsaWEB
- www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdocghsaWEB
- security.netapp.com/advisory/ntap-20210902-0004/mitre
- www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/mitre
News mentions
0No linked articles in our index yet.