CVE-2018-1000073

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2018-1000073
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000073.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-1000073
Aliases
Related
Published
2018-03-13T15:29:00Z
Modified
2024-09-18T02:53:32.584411Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.

References

Affected packages

Debian:12 / jruby

Package

Name
jruby
Purl
pkg:deb/debian/jruby?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.1.17.0-2.1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / jruby

Package

Name
jruby
Purl
pkg:deb/debian/jruby?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.1.17.0-2.1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:11 / rubygems

Package

Name
rubygems
Purl
pkg:deb/debian/rubygems?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.0~rc.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / rubygems

Package

Name
rubygems
Purl
pkg:deb/debian/rubygems?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.0~rc.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / rubygems

Package

Name
rubygems
Purl
pkg:deb/debian/rubygems?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.0~rc.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/rubygems/rubygems

Affected ranges

Type
GIT
Repo
https://github.com/rubygems/rubygems
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1b931fc03b819b9a0214be3eaca844ef534175e2

Affected versions

v1.*

v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.8.0
v1.8.1
v1.8.2

v2.*

v2.0.0
v2.0.0.preview2
v2.0.0.preview2.1
v2.0.0.preview2.2
v2.0.0.rc.1
v2.0.0.rc.2
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.0.rc.1
v2.1.0.rc.2
v2.1.1
v2.1.2
v2.1.3
v2.2.0.preview.1
v2.2.0.rc.1
v2.2.1
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.5.0
v2.5.1
v2.5.2
v2.6.0
v2.6.1
v2.6.10
v2.6.11
v2.6.12
v2.6.13
v2.6.14
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.6.7
v2.6.8
v2.6.9
v2.7.0
v2.7.1
v2.7.2
v2.7.3
v2.7.4
v2.7.5