CVE-2020-8130: canonical ubuntu_linux
Vulnerability summary
CVE-2020-8130 is a medium (CVSS 6.9) vulnerability in canonical ubuntu_linux. EPSS estimates a 1.36% chance of exploitation in the next 30 days, higher than 71.7% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.4, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 24-02-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · DebianEcosystem advisory · calculated6.4MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · RubygemsEcosystem advisory · calculated6.4MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- NVDNIST6.4MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.36%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.36% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- rake< 10.3.2-2+deb8u1 | < 12.3.3-1
- debian_linuxEOL8.0
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 19.10
Fedoraproject1 product
- fedoraEOL30 | 31
Mageia1 product
- ruby-rake< 12.3.0-21.mga7
Opensuse1 product
- leapEOL15.1
Ruby-lang1 product
- rake< 12.3.3
RubyGems1 product
- rake< 12.3.3
Suse1 product
- rubygem-rake&distro=SUSE Linux Enterprise Module for Containers 12< 10.3.2-9.7.1
Ubuntu1 product
- rake< 10.5.0-2ubuntu0.1 | < 12.3.1-1ubuntu0.1
9 vendors · 10 products
References
24 links
lists.debian.org/debian-lts-announce/2020/02/msg00026.htmlMailing ListX Refsource MLISTWEBThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
Show all 24 references
- github.com/ruby/rakePACKAGE