// For flags

CVE-2022-39224

Arbitrary shell execution when extracting or listing files contained in a malicious rpm.

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Arr-pm is an RPM reader/writer library written in Ruby. Versions prior to 0.0.12 are subject to OS command injection resulting in shell execution if the RPM contains a malicious "payload compressor" field. This vulnerability impacts the `extract` and `files` methods of the `RPM::File` class of this library. Version 0.0.12 patches these issues. A workaround for this issue is to ensure any RPMs being processed contain valid/known payload compressor values such as gzip, bzip2, xz, zstd, and lzma. The payload compressor field in an rpm can be checked by using the rpm command line tool.

Arr-pm es una biblioteca de lectura/escritura de RPM escrita en Ruby. Las versiones anteriores a 0.0.12 están sujetas a una inyección de comandos del Sistema Operativo, resultando en una ejecución de shell si el RPM contiene un campo "payload compressor" malicioso. Esta vulnerabilidad afecta a los métodos "extract" y "files" de la clase "RPM::File" de esta biblioteca. La versión 0.0.12 parchea estos problemas. Una mitigación para este problema es asegurarse de que cualquier RPM que es procedido contenga valores de compresores de carga útil válidos/conocidos como gzip, bzip2, xz, zstd y lzma. El campo del compresor de carga útil en un rpm puede comprobarse al usar la herramienta de línea de comandos rpm

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-02 CVE Reserved
  • 2022-09-21 CVE Published
  • 2024-05-12 EPSS Updated
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ruby-arr-pm Project
Search vendor "Ruby-arr-pm Project"
 Ruby-arr-pm
Search vendor "Ruby-arr-pm Project" for product "Ruby-arr-pm"
 < 0.0.12
Search vendor "Ruby-arr-pm Project" for product "Ruby-arr-pm" and version " < 0.0.12"
ruby
Affected