ADVISORIES

• CVE-2013-6421 (NVD)
• GHSA-229r-pqp6-8w6g
• OSVDB-100598

GEM

sprout

SEVERITY

CVSS v2.0: 7.5 (High)

UNAFFECTED VERSIONS

• < 0.7.246

PATCHED VERSIONS

None.

DESCRIPTION

sprout Gem for Ruby contains a flaw in the unpack_zip() function in archive_unpacker.rb. The issue is due to the program failing to properly sanitize input passed via the ‘zip_file’, ‘dir’, ‘zip_name’, and ‘output’ parameters. This may allow a context-dependent attacker to execute arbitrary code.