What is GHSA-f7f4-5w9j-23p2?

GHSA-f7f4-5w9j-23p2 is a security advisory published by GitHub Security Advisories with Critical severity. festivaltts4r allows arbitrary command execution

Which CVE IDs does GHSA-f7f4-5w9j-23p2 cover?

GHSA-f7f4-5w9j-23p2 covers the following CVE IDs: CVE-2016-10194. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f7f4-5w9j-23p2?

GHSA-f7f4-5w9j-23p2 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-f7f4-5w9j-23p2?

GHSA-f7f4-5w9j-23p2 affects 1 product, including: rubygems/festivaltts4r:\u003c= 0.2.0.

GHSA-f7f4-5w9j-23p2CriticalCVSS 9.8

festivaltts4r allows arbitrary command execution

Vendor

GitHub Security Advisories

Published

October 24, 2017

Last Modified

January 25, 2023

🔗 CVE IDs covered (1)

CVE-2016-10194 →

📋 Description

The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to_speech or (2) to_mp3 method in lib/festivaltts4r/festival4r.rb.

🎯 Affected products1

rubygems/festivaltts4r:<= 0.2.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2016-10194
https://github.com/spejman/festivaltts4r/issues/1
http://www.openwall.com/lists/oss-security/2017/01/31/14
http://www.openwall.com/lists/oss-security/2017/02/02/5
https://github.com/advisories/GHSA-f7f4-5w9j-23p2