CVE-2021-21289

Published: 2 February 2021

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.

Priority

CVSS 3 base score: 8.3

Status

Package	Release	Status
ruby-mechanize Launchpad, Ubuntu, Debian	bionic	Needs triage
	focal	Needs triage
	groovy	Ignored (reached end-of-life)
	hirsute	Ignored (reached end-of-life)
	impish	Ignored (reached end-of-life)
	jammy	Needs triage
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (2.7.7-1)
	xenial	Ignored (end of standard support, was needs-triage)

CVE-2021-21289

Medium

Status

References

Join the discussion

Canonical is offering Extended Security Maintenance

Further reading