Skip to content
Fencer Vulns
high 8.0

CVE-2022-46648 json

ruby-git has potential remote code execution vulnerability

published 2023-01-09 3 y ago modified 2026-06-17 4 mo ago also GHSA-pfpr-3463-c6jh , EUVD-2023-0518

cvss
8.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318.

Patch / fix

  • rubygems git 1.13.0
  • ruby-git_project ruby-git 1.13.0
  • ruby-git Debian 14, Debian 13, Debian 12 1.13.1-1

debian advisories DEBIAN-CVE-2022-46648

  • foreman satellite utils 6.14, satellite capsule 6.14, satellite 6.14 3.7.0.9-1.el8sat
  • foreman-cli satellite utils 6.14, satellite 6.14 3.7.0.9-1.el8sat
  • foreman-ec2 satellite 6.14 3.7.0.9-1.el8sat
  • rubygem-git satellite 6.14, satellite 6.13, satellite 6.12 1.18.0-1.el8sat
  • puppet-agent satellite capsule 6.14, satellite capsule 6.13, satellite capsule 6.12 +5 more 7.26.0-3.el8sat
  • puppetserver satellite capsule 6.14, satellite 6.14 7.11.0-1.el8sat
  • rubygem-rack satellite capsule 6.14, satellite 6.14 2.2.7-1.el8sat
  • foreman-ovirt satellite 6.14 3.7.0.9-1.el8sat

red hat advisories RHSA-2023:6818RHSA-2023:5980RHSA-2023:5979RHSA-2023:5931

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-46648 updated cvss 8.0

ruby-git: code injection vulnerability

  • Red Hat Satellite 6.11 for RHEL 7 tfm-rubygem-git 1.18.0-0.1.el7sat Red Hat Satellite 6.11 for RHEL 8 rubygem-git 1.18.0-0.1.el8sat
    fixed: vendor fix RHSA-2023:5980
  • Red Hat Satellite 6.12 for RHEL 8 rubygem-git 1.18.0-1.el8sat
    fixed: vendor fix RHSA-2023:5979
  • Red Hat Satellite 6.13 for RHEL 8 rubygem-git 1.18.0-1.el8sat
    fixed: vendor fix RHSA-2023:5931
  • Red Hat Satellite 6.14 for RHEL 8 rubygem-git 1.18.0-1.el8sat
    fixed: vendor fix RHSA-2023:6818
  • Red Hat Satellite 6.11 for RHEL 7 foreman 3.1.1.27-1.el7sat, satellite 6.11.5.6-1.el7sat, puppet-agent 7.26.0-3.el7sat, foreman-cli 3.1.1.27-1.el7sat, foreman-ec2 3.1.1.27-1.el7sat, foreman-gce 3.1.1.27-1.el7sat, +15 more Red Hat Satellite 6.11 for RHEL 8 foreman 3.1.1.27-1.el8sat, satellite 6.11.5.6-1.el8sat, puppet-agent 7.26.0-3.el8sat, foreman-cli 3.1.1.27-1.el8sat, foreman-ec2 3.1.1.27-1.el8sat, foreman-gce 3.1.1.27-1.el8sat, +15 more Red Hat Satellite 6.12 for RHEL 8 foreman 3.3.0.23-1.el8sat, satellite 6.12.5.2-1.el8sat, puppet-agent 7.26.0-3.el8sat, foreman-cli 3.3.0.23-1.el8sat, foreman-ec2 3.3.0.23-1.el8sat, foreman-gce 3.3.0.23-1.el8sat, +14 more Red Hat Satellite 6.13 for RHEL 8 foreman 3.5.1.23-1.el8sat, satellite 6.13.5-1.el8sat, puppet-agent 7.26.0-3.el8sat, python-django 3.2.21-1.el8pc, foreman-cli 3.5.1.23-1.el8sat, foreman-ec2 3.5.1.23-1.el8sat, +25 more Red Hat Satellite 6.14 for RHEL 8 cjson 1.7.14-5.el8sat, katello 4.9.0-1.el8sat, libsolv 0.7.22-4.el8pc, libcomps 0.1.18-4.el8pc, python-idna 3.3-2.el8pc, candlepin 4.3.1-1.el8sat, +668 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
19 mo ago

Exploit prediction

1.41% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CNA 3.1 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
rubygems git
>=1.2.0, <1.13.0
1.13.0

Affected products

  • ruby-git ruby-git

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.