critical9.8
CVE-2022-33127
Improper handling of double quotes in file name in Diffy in Windows environment
Impact
The function that calls the diff tool in versions of Diffy prior to 3.4.1 does not properly handle double quotes in a filename when run in a Windows environment. This allows attackers to execute arbitrary commands via a crafted string.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | diffy | < 3.4.1 | 3.4.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Diffy Project | Diffy | Version 3.4.1 |
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/samg/diffy/blob/56fd935aea256742f7352b050592542d3d153bf6/CHANGELOG#L1
- https://github.com/samg/diffy/commit/478f392082b66d38f54a02b4bb9c41be32fd6593
- https://github.com/advisories/GHSA-5ww9-9qp2-x524
- https://nvd.nist.gov/vuln/detail/CVE-2022-33127
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/diffy/CVE-2022-33127.yml