CRITICAL9.8

GHSA-5vx5-9q73-wgp4

Safemode Gem Has Incomplete List of Disallowed Inputs

Quick fix

GHSA-5vx5-9q73-wgp4 — safemode: upgrade to the fixed version with the command below.

bundle update safemode

Details

rubygem-safemode, as used in Foreman, versions 1.3.1 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/safemode

Introduced in: 0Fixed in: 1.3.2

Fixbundle update safemode

References

https://nvd.nist.gov/vuln/detail/CVE-2017-7540[ADVISORY]
https://github.com/svenfuchs/safemode/pull/23[WEB]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/safemode/CVE-2017-7540.yml[WEB]
https://github.com/svenfuchs/safemode[PACKAGE]