GHSA-8474-rc7c-wrhp

Source

https://github.com/advisories/GHSA-8474-rc7c-wrhp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-8474-rc7c-wrhp/GHSA-8474-rc7c-wrhp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8474-rc7c-wrhp

Withdrawn

2020-06-17T15:14:40Z

Published

2018-08-08T22:29:10Z

Modified

2024-12-02T05:39:20Z

Summary

High severity vulnerability that affects safemode

Details

Withdrawn, accidental duplicate publish.

The safemode rubygem, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.

Database specific

{
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-17T15:14:40Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

RubyGems / safemode

Package

Name: safemode
Purl: pkg:gem/safemode

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.3.3

Affected versions

0.*

0.0.2

1.*

1.0.0

1.0.1

1.0.2

1.1.0

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.3.1

1.3.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-8474-rc7c-wrhp/GHSA-8474-rc7c-wrhp.json"