CVE-2021-31799 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7 HIGH	LOCAL	HIGH	LOW	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 57%

Affected Products (NVD)

Vendor	Product	Version
debian	debian_linux	9.0
debian	debian_linux	10.0
ruby-lang	rdoc	3.11 ≤ 𝑥 < 6.3.1
oracle	jd_edwards_enterpriseone_tools	𝑥 < 9.2.6.1

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ruby2.7

bullseye	2.7.4-1+deb11u1 fixed
bullseye (security)	2.7.4-1+deb11u2 fixed

Ubuntu Releases

Ubuntu Product

Codename

ruby1.9.1

bionic	dne
focal	dne
groovy	dne
hirsute	dne
impish	dne
jammy	dne
trusty	dne
xenial	dne

ruby2.0

bionic	dne
focal	dne
groovy	dne
hirsute	dne
impish	dne
jammy	dne
trusty	dne
xenial	dne

ruby2.3

bionic	dne
focal	dne
groovy	dne
hirsute	dne
impish	dne
jammy	dne
trusty	dne
xenial	Fixed 2.3.1-2~ubuntu16.04.16+esm1 released

ruby2.5

bionic	Fixed 2.5.1-1ubuntu1.10 released
focal	dne
groovy	dne
hirsute	dne
impish	dne
jammy	dne
trusty	dne
xenial	dne

ruby2.7

bionic	dne
focal	Fixed 2.7.0-5ubuntu1.5 released
groovy	Fixed 2.7.1-3ubuntu1.4 released
hirsute	Fixed 2.7.2-4ubuntu1.2 released
impish	Fixed 2.7.4-1ubuntu1 released
trusty	dne
xenial	dne

openSUSE / SLES Releases

openSUSE Product

Release

libruby2_1-2_1

suse enterprise sap 12 SP3	2.1.9-19.6.1 fixed
suse enterprise sap 12 SP4	2.1.9-19.6.1 fixed
suse enterprise sap 12 SP5	2.1.9-19.6.1 fixed
suse enterprise server 12 SP2	2.1.9-19.6.1 fixed
suse enterprise server 12 SP3	2.1.9-19.6.1 fixed
suse enterprise server 12 SP4	2.1.9-19.6.1 fixed
suse enterprise server 12 SP5	2.1.9-19.6.1 fixed

libruby2_5-2_5

suse enterprise desktop 15 SP2	2.5.9-4.20.1 fixed
suse enterprise desktop 15 SP3	2.5.9-150000.4.23.1 fixed
suse enterprise desktop 15 SP4	2.5.9-4.20.1 fixed
suse enterprise desktop 15 SP5	2.5.9-4.20.1 fixed
suse enterprise desktop 15 SP6	2.5.9-4.20.1 fixed
suse enterprise desktop 15 SP7	2.5.9-150700.22.16 fixed
suse enterprise sap 15	2.5.9-150000.4.23.1 fixed
suse enterprise sap 15 SP1	2.5.9-150000.4.23.1 fixed
suse enterprise sap 15 SP2	2.5.9-150000.4.23.1 fixed
suse enterprise sap 15 SP3	2.5.9-150000.4.23.1 fixed
suse enterprise sap 15 SP4	2.5.9-4.20.1 fixed
suse enterprise sap 15 SP5	2.5.9-4.20.1 fixed
suse enterprise sap 15 SP6	2.5.9-4.20.1 fixed
suse enterprise sap 15 SP7	2.5.9-150700.22.16 fixed
suse enterprise server 15	2.5.9-150000.4.23.1 fixed
suse enterprise server 15 SP1	2.5.9-150000.4.23.1 fixed
suse enterprise server 15 SP2	2.5.9-150000.4.23.1 fixed
suse enterprise server 15 SP3	2.5.9-150000.4.23.1 fixed
suse enterprise server 15 SP4	2.5.9-4.20.1 fixed
suse enterprise server 15 SP5	2.5.9-4.20.1 fixed
suse enterprise server 15 SP6	2.5.9-4.20.1 fixed
suse enterprise server 15 SP7	2.5.9-150700.22.16 fixed

libruby3_4-3_4

suse enterprise desktop 15 SP7	3.4.1-150700.1.11 fixed
suse enterprise sap 15 SP7	3.4.1-150700.1.11 fixed
suse enterprise server 15 SP7	3.4.1-150700.1.11 fixed

Common Weakness Enumeration

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References

https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html

https://security-tracker.debian.org/tracker/CVE-2021-31799

https://security.gentoo.org/glsa/202401-05

https://security.netapp.com/advisory/ntap-20210902-0004/