vulnerability
Ubuntu: USN-7497-1 (CVE-2021-21305): CarrierWave vulnerabilities
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:N/C:P/I:P/A:P) | Feb 8, 2021 | May 7, 2025 | May 8, 2025 |
Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
Feb 8, 2021
Added
May 7, 2025
Modified
May 8, 2025
Description
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1.
Solution
ubuntu-pro-upgrade-ruby-carrierwave
References
- CVE-2021-21305
- https://attackerkb.com/topics/CVE-2021-21305
- UBUNTU-USN-7497-1
- URL-https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08
- URL-https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08
- URL-https://github.com/carrierwaveuploader/carrierwave/commit/387116f5c72efa42bc3938d946b4c8d2f22181b7
- URL-https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4
- URL-https://rubygems.org/gems/carrierwave
- URL-https://ubuntu.com/security/notices/USN-7497-1
- URL-https://www.cve.org/CVERecord?id=CVE-2021-21305
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.