{
"id": "GHSA-qrgf-jqqm-x7xv",
"aliases": [
"CVE-2013-5671"
],
"details": "`lib/dragonfly/imagemagickutils.rb` in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors.",
"summary": "Code injection in dragonfly gem",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.0"
}
]
}
],
"package": {
"name": "dragonfly",
"ecosystem": "RubyGems"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.9.15"
}
]
}
],
"package": {
"name": "fog-dragonfly",
"ecosystem": "RubyGems"
}
}
],
"modified": "2023-01-24T14:54:19Z",
"severity": [],
"published": "2017-10-24T18:33:37Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5671",
"type": "ADVISORY"
},
{
"url": "https://github.com/markevans/dragonfly/issues/520",
"type": "WEB"
},
{
"url": "https://github.com/github/advisory-database/pull/486",
"type": "WEB"
},
{
"url": "https://github.com/markevans/dragonfly",
"type": "PACKAGE"
},
{
"url": "https://web.archive.org/web/20201208033320/http://www.vapid.dhs.org/advisories/fog-dragonfly-0.8.2-cmd-inj.html",
"type": "WEB"
},
{
"url": "http://seclists.org/fulldisclosure/2013/Sep/18",
"type": "WEB"
},
{
"url": "http://seclists.org/oss-sec/2013/q3/526",
"type": "WEB"
},
{
"url": "http://seclists.org/oss-sec/2013/q3/528",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2014-05-12T14:55:05Z",
"github_reviewed_at": "2020-06-16T21:52:41Z"
}
}