GitHub Advisoryadvisory · RubyGems

GHSA-x2h8-qmj4-g62f ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.

MEDIUM Published 2024-03-18 Modified 2025-12-05 Official page ↗
Aliases
CVE-2024-28862
Ecosystem
RubyGems
Packages
rotp
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-276
Reviewed
2024-03-18

Affected packages

• RubyGems rotp: >= 6.2.1, < 6.3.0 → fixed in 6.3.0

Description

The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation.

Related

Alias · CVE (1)

  • CVE-2024-28862 The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References