The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade icinga2 | Aug 22, 2024 | Jul 17, 2020 |
| Debian | — | Upgrade ruby-kramdown | Aug 10, 2020 | Jul 17, 2020 |
| Freebsd | — | Upgrade rubygem-kramdownUpgrade gitlab-ce | Aug 6, 2020 | Aug 6, 2020 |
| Suse | — | Upgrade ruby2.5-rubygem-kramdownUpgrade ruby2.5-rubygem-kramdown-testsuiteUpgrade ruby2.5-rubygem-kramdown-doc | Aug 9, 2024 | Jul 17, 2020 |
| Ubuntu | — | Upgrade ruby-kramdownUpgrade kramdown | Oct 1, 2020 | Jun 28, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub