GHSA-cwp3-834g-x79g

Source

https://github.com/advisories/GHSA-cwp3-834g-x79g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-cwp3-834g-x79g/GHSA-cwp3-834g-x79g.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cwp3-834g-x79g

Withdrawn

2020-06-16T21:33:06Z

Published

2018-08-21T17:07:36Z

Modified

2024-12-02T05:40:22Z

Summary

Moderate severity vulnerability that affects archive-tar-minitar and minitar

Details

Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.

Database specific

{
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:33:06Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

RubyGems / minitar

Package

Name: minitar
Purl: pkg:gem/minitar

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.6

Affected versions

0.*

0.5.3

0.5.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-cwp3-834g-x79g/GHSA-cwp3-834g-x79g.json"

RubyGems / archive-tar-minitar

Package

Name: archive-tar-minitar
Purl: pkg:gem/archive-tar-minitar

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.6

Affected versions

0.*

0.5.1

0.5.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-cwp3-834g-x79g/GHSA-cwp3-834g-x79g.json"