CVE-2024-42360: Command Injection in sequenceserver
Impact Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands Patches Fixed in 3.1.2 Workarounds No known workarounds
Published Aug 13, 2024 · Updated Aug 14, 2024
Affected packages
sequenceserver
- Ecosystem
- RubyGems
- Affected
- < 3.1.2
- Fixed in
- 3.1.2
- Check
bundle info sequenceserver
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands
Patches
Fixed in 3.1.2
Workarounds
No known workarounds
Credited to drpowell, tadast.
References
- https://github.com/wurmlab/sequenceserver/security/advisories/GHSA-qv32-5wm2-p32h
- https://github.com/wurmlab/sequenceserver/commit/457e52709f7f9ed2fceed59b3db564cb50785dba
- https://nvd.nist.gov/vuln/detail/CVE-2024-42360
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sequenceserver/CVE-2024-42360.yml
- https://github.com/advisories/GHSA-qv32-5wm2-p32h
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology