GitHub Advisoryadvisory · RubyGems

GHSA-pm9x-4392-2c2p RubyGems may allow a maliciously crafted gem to overwrite files

HIGH Published 2022-05-13 Modified 2023-03-09 Official page ↗
Aliases
CVE-2017-0901
Ecosystem
RubyGems
Packages
rubygems-update
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20, CWE-22
Reviewed
2023-03-09

Affected packages

• RubyGems rubygems-update: < 2.6.13 → fixed in 2.6.13

Description

RubyGems versions 2.6.12 and earlier fail to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

Related

Alias · CVE (1)

  • CVE-2017-0901 RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References