GitHub Advisoryadvisory · Go, RubyGems
GHSA-x5m6-jh4r-34mv Hub Package Arbitrary File Overwrite
MEDIUM
Official page ↗
- Aliases
- CVE-2014-0177
- Ecosystem
- Go, RubyGems
- Packages
- github.com/github/hub, hub
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weaknesses
- CWE-377
- Reviewed
- 2021-05-20
Affected packages
• Go github.com/github/hub: < 1.12.1 → fixed in 1.12.1
• RubyGems hub: < 1.12.1 → fixed in 1.12.1
Description
The `am` function in `lib/hub/commands.rb` in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file.
Related
Weakness · not in database (1)
Alias · CVE (1)
- CVE-2014-0177 The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-0177 advisory
- https://github.com/github/hub/commit/016ec99d25b1cb83cb4367e541177aa431beb600 web
- https://github.com/mislav/hub/commit/016ec99d25b1cb83cb4367e541177aa431beb600 web
- https://github.com/mislav/hub package
- https://github.com/mislav/hub/releases/tag/v1.12.1 web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/hub/CVE-2014-0177.yml web