From e238b07df3abe333ff66add8c8b0b859146f79d0 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Sat, 30 Jan 2021 13:18:42 -0500 Subject: [PATCH] changelog: note the patched command injection vulnerabilities --- CHANGELOG.rdoc | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/CHANGELOG.rdoc b/CHANGELOG.rdoc index 31f96028..26ebd49a 100644 --- a/CHANGELOG.rdoc +++ b/CHANGELOG.rdoc @@ -2,6 +2,22 @@ === Unreleased +* Security + + Mechanize `>= v2.0`, `< v2.7.7` allows for OS commands to be injected into several classes' + methods via implicit use of Ruby's `Kernel.open` method. Exploitation is possible only if + untrusted input is used as a local filename and passed to any of these calls: + + - `Mechanize::CookieJar#load`: since v2.0 (see 208e3ed) + - `Mechanize::CookieJar#save_as`: since v2.0 (see 5b776a4) + - `Mechanize#download`: since v2.2 (see dc91667) + - `Mechanize::Download#save` and `#save!` since v2.1 (see 98b2f51, bd62ff0) + - `Mechanize::File#save` and `#save_as`: since v2.1 (see 2bf7519) + - `Mechanize::FileResponse#read_body`: since v2.0 (see 01039f5) + + See https://github.com/sparklemotion/mechanize/security/advisories/GHSA-qrqm-fpv6-6r8g for more + information. + * New Features * Support for Ruby 3.0 by adding `webrick` as a runtime dependency. (#557) @pvalena