GHSA-pm9x-4392-2c2p

Source

https://github.com/advisories/GHSA-pm9x-4392-2c2p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pm9x-4392-2c2p/GHSA-pm9x-4392-2c2p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pm9x-4392-2c2p

Aliases

CVE-2017-0901

Published

2022-05-13T01:38:26Z

Modified

2024-02-22T05:34:28.892562Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

RubyGems may allow a maliciously crafted gem to overwrite files

Details

RubyGems versions 2.6.12 and earlier fail to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

Database specific

{
    "github_reviewed": true,
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-20",
        "CWE-22"
    ],
    "nvd_published_at": "2017-08-31T20:29:00Z",
    "github_reviewed_at": "2023-03-09T00:38:35Z"
}

References

Affected packages

RubyGems / rubygems-update

Package

Name: rubygems-update
Purl: pkg:gem/rubygems-update

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.6.13

Affected versions

0.*

0.8.3

0.8.4

0.8.5

0.8.6

0.8.8

0.8.10

0.8.11

0.9.0

0.9.1

0.9.2

0.9.3

0.9.4

0.9.5

1.*

1.0.0

1.0.1

1.1.0

1.1.1

1.2.0

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.4.0

1.4.1

1.4.2

1.5.0

1.5.2

1.5.3

1.6.0

1.6.1

1.6.2

1.7.0

1.7.1

1.7.2

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.8.10

1.8.11

1.8.12

1.8.13

1.8.14

1.8.15

1.8.16

1.8.17

1.8.18

1.8.19

1.8.20

1.8.21

1.8.22

1.8.23

1.8.23.2

1.8.24

1.8.25

1.8.26

1.8.27

1.8.28

1.8.29

1.8.30

2.*

2.0.0.preview2

2.0.0.preview2.1

2.0.0.preview2.2

2.0.0.rc.1

2.0.0.rc.2

2.0.0

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.15

2.0.16

2.0.17

2.1.0.rc.1

2.1.0.rc.2

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.1.10

2.1.11

2.2.0.rc.1

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.3.0

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

2.4.6

2.4.7

2.4.8

2.5.0

2.5.1

2.5.2

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.6.6

2.6.7

2.6.8

2.6.9

2.6.10

2.6.11

2.6.12