CVE-2013-4457: Recursive Interpolation Vulnerability

Due to the method of variable interpolation in Cocaine to, an attacker may be able to inject hostile commands into a command line via a crafted hash object which are not properly escaped. The impact is lessened on Ruby * because hashed are not ordered by default, and so an attacker must rely on luck for the attack to work. An attack of this sort cannot take place if there is only one value being interpolated into the command line. Users of the Paperclip gem are encouraged to upgrade to the latest version of Cocaine. Users of the branch of Paperclip will not need to upgrade as the version of Cocaine it uses is not vulnerable to this attack.