CVE-2022-39224 – Arbitrary shell execution when extracting or listing files contained in a malicious rpm.

https://notcve.org/view.php?id=CVE-2022-39224

Arr-pm is an RPM reader/writer library written in Ruby. Versions prior to 0.0.12 are subject to OS command injection resulting in shell execution if the RPM contains a malicious "payload compressor" field. This vulnerability impacts the `extract` and `files` methods of the `RPM::File` class of this library. Version 0.0.12 patches these issues. A workaround for this issue is to ensure any RPMs being processed contain valid/known payload compressor values such as gzip, bzip2, xz, zstd, and lzma. • https://github.com/jordansissel/ruby-arr-pm/pull/14 https://github.com/jordansissel/ruby-arr-pm/pull/15 https://github.com/jordansissel/ruby-arr-pm/security/advisories/GHSA-88cv-mj24-8w3q • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •