CVE-2020-8130 – rake: OS Command Injection via egrep in Rake::FileList

https://notcve.org/view.php?id=CVE-2020-8130

There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`. Se presenta una vulnerabilidad de inyección de comandos de Sistema Operativo en Ruby Rake versiones anteriores a 12.3.3, en la función Rake::FileList cuando se suministra un nombre de archivo que comienza con el carácter de tubería "|". • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html https://hackerone.com/reports/651518 https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44 https://usn.ubuntu.com/4295-1 https://access.redhat.com/security/cve/CVE-2020-8130 https:&#x • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •