Arbitrary Command Execution Affecting dragonfly package, versions < 0.9.6
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-DRAGONFLY-20016
- published 31 Aug 2011
- disclosed 31 Aug 2011
- credit Unknown
Overview
dragonfly
is a framework that enables on-the-fly processing for any content type. This gem was renamed from fog-dragonfly
to dragonfly
.
Affected versions of this gem are vulnerable to a remote attacker executing arbitrary commands, due to a failure to properly escape a shell that contains injected characters.
Related to SNYK-RUBY-DRAGONFLY-20017
References
CVSS Scores
version 3.1