Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from     version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of     mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's     Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and     passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download,     Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in     version 2.7.7. (CVE-2021-21289)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from
    version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of
    mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's
    Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and
    passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download,
    Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in
    version 2.7.7. (CVE-2021-21289)

The remote host is affected by the vulnerability described in GLSA-202107-17 (Mechanize: Command injection)

    Mechanize does not neutralize filename input and could allow arbitrary       code execution if an attacker can control filenames used by Mechanize.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Mechanize is an open source Ruby library that makes automated web interaction easy. In Mechanize, from v2.0.0 until v2.7.7, there is a command injection vulnerability.

Affected versions of Mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel#open method.

For Debian 9 stretch, this problem has been fixed in version 2.7.5-1+deb9u1.

We recommend that you upgrade your ruby-mechanize packages.

For the detailed security status of ruby-mechanize please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/ruby-mechanize

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-db8ebc547e advisory.

  - Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from     version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of     mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's     Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and     passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download,     Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in     version 2.7.7. (CVE-2021-21289)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-24fdc228e4 advisory.

  - Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from     version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of     mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's     Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and     passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download,     Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in     version 2.7.7. (CVE-2021-21289)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
259567	Linux Distros Unpatched Vulnerability : CVE-2021-21289	Nessus	Misc.	high
418306	SCA: security update for mechanize (GHSA-qrqm-fpv6-6r8g)	Tenable Cloud Security	SCA Checks	high
418306	SCA: security update for mechanize (GHSA-qrqm-fpv6-6r8g)	Tenable Self-Hosted Container Security	SCA Checks	high
157015	GLSA-202107-17 : Mechanize: Command injection	Nessus	Gentoo Local Security Checks	high
146555	Debian DLA-2561-1 : ruby-mechanize security update	Nessus	Debian Local Security Checks	high
146415	Fedora 33 : rubygem-mechanize (2021-db8ebc547e)	Nessus	Fedora Local Security Checks	high
146396	Fedora 32 : rubygem-mechanize (2021-24fdc228e4)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2021-21289

high

Tenable Plugins

high

high

high

high

high

high

high