CVE-2014-0156 OS Command Injection in awesome spawn
Attackers can execute arbitrary OS commands via untrusted input in awesome_spawn arguments, requiring an upgrade to the Ruby gem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-0156?
CVE-2014-0156 is a critical command injection vulnerability in awesome_spawn, published on 30 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command.
Weakness: CWE-78
Which versions are affected by CVE-2014-0156?
2 open source packages ship an affected version, including awesome_spawn. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
awesome_spawn RubyGems | All versions | 1.2.0 |
awesome_spawn RubyGems | All versions | 1.2.0 |
Products include Manageiq Awesomespawn.
How do I fix CVE-2014-0156?
Upgrade awesome_spawn to 1.2.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2014-0156 being exploited?
There is no known exploitation of CVE-2014-0156 in the wild and no public exploit code.
Sources
Also known as GHSA-qpqw-mc85-qvm9.