Rebar3: Command Injection

Background

A sophisticated build-tool for Erlang projects that follows OTP principles.

Description

Rebar3 is vulnerable to OS command injection via the URL parameter of a dependency specification.

Impact

A vulnerability has been discovered in Rebar3. Please review the CVE identifier referenced below for details.

Workaround

There is no known workaround at this time.

Resolution

Gentoo has discontinued support for Rebar3 binary package. We recommend that users unmerge it:

 # emerge --ask --depclean "dev-util/rebar-bin"