GitHub Advisoryadvisory · RubyGems

GHSA-h5g2-38x9-4gv3 archive-tar-minitar and minitar vulnerable to Path Traversal

HIGH Published 2017-10-24 Modified 2023-09-05 Official page ↗
Aliases
CVE-2016-10173
Ecosystem
RubyGems
Packages
archive-tar-minitar, minitar
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• RubyGems archive-tar-minitar: < 0.5.2 → fixed in 0.5.2 • RubyGems minitar: < 0.6 → fixed in 0.6

Description

Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a `..` (dot dot) in a TAR archive entry.

Related

Alias · CVE (1)

  • CVE-2016-10173 Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References