ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/–search-zip or –pre flag.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ripgrep | Ripgrep_project | * | 13.0.0 (excluding) |
| Ripgrep | Ubuntu | trusty | * |
| Ripgrep | Ubuntu | upstream | * |
| Ripgrep | Ubuntu | xenial | * |
| Rust-ripgrep | Ubuntu | focal | * |
| Rust-ripgrep | Ubuntu | kinetic | * |
| Rust-ripgrep | Ubuntu | trusty | * |
| Rust-ripgrep | Ubuntu | upstream | * |
| Rust-ripgrep | Ubuntu | xenial | * |
References
- https://github.com/BurntSushi/ripgrep/blob/e48a17e1891e1ea9dd06ba0e48d5fb140ca7c0c4/CHANGELOG.md
- https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md
- https://github.com/BurntSushi/ripgrep/blob/e48a17e1891e1ea9dd06ba0e48d5fb140ca7c0c4/CHANGELOG.md
- https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md