CVE-2018-3779: Command Injection

August 10, 2018 (updated October 9, 2019)

active-support could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker could exploit this vulnerability to execute arbitrary code on the system.

References

hackerone.com/reports/392311
nvd.nist.gov/vuln/detail/CVE-2018-3779

Code Behaviors & Features

Detect and mitigate CVE-2018-3779 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →