GitHub Advisoryadvisory · RubyGems

GHSA-g982-9r8g-6qxw Ciborg gem for Ruby allows local users to write files and gain privileges via Symlink

MEDIUM Published 2018-07-23 Modified 2023-07-05 Official page ↗
Aliases
CVE-2014-5003
Ecosystem
RubyGems
Packages
ciborg
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• RubyGems ciborg: 3.0.0 (no fix yet)

Description

There is a /tmp file race condition in `chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb` in the ciborg gem 3.0.0 when creating `/tmp/perlbrew-installer`. If a malicious local user creates the file first they can overwrite the contents with their own code executing it as the ciborg process owner.

Related

Alias · CVE (1)

  • CVE-2014-5003 chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References