ruby-mysql Client File Read
Published: June 28, 2022
SECURITY IDENTIFIERS
- CVE: CVE-2021-3779 (NVD)
- GHSA: GHSA-73pr-g6jj-5hc9
- Vendor Advisory: https://www.rapid7.com/blog/post/2022/06/28/cve-2021-3779-ruby-mysql-gem-client-file-read-fixed/
GEM
SEVERITY
CVSS v3.x: 6.5 (Medium)
PATCHED VERSIONS
>= 2.10.0
DESCRIPTION
A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later.