Arbitrary Code Execution Affecting ruby-jss package, versions <1.6.0


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.95% (84th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Arbitrary Code Execution vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RUBY-RUBYJSS-1729742
  • published8 Oct 2021
  • disclosed8 Oct 2021
  • creditUnknown

Introduced: 8 Oct 2021

CVE-2021-33575  (opens in a new tab)
CWE-94  (opens in a new tab)

How to fix?

Upgrade ruby-jss to version 1.6.0 or higher.

Overview

ruby-jss is a provides native ruby access to the REST APIs of Jamf Pro, an enterprise/education tool for managing Apple devices, from jamf.com.

Affected versions of this package are vulnerable to Arbitrary Code Execution. The Pixar ruby-jss gem allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing.

References

CVSS Scores

version 3.1