GitHub Advisoryadvisory · RubyGems

GHSA-49pj-69vf-c689 netaddr before 1.5.3 and 2.0.4 has Incorrect Default Permissions

CRITICAL Published 2019-10-14 Modified 2024-10-23 Official page ↗
Aliases
CVE-2019-17383
Ecosystem
RubyGems
Packages
netaddr
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-276
Reviewed
2019-10-14

Affected packages

• RubyGems netaddr: >= 2.0.0, < 2.0.4 → fixed in 2.0.4 • RubyGems netaddr: < 1.5.3 → fixed in 1.5.3

Description

The netaddr gem before 1.5.3 and 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.

Related

Alias · CVE (1)

  • CVE-2019-17383 The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References