Vulnerability GHSA-vqcq-mrmw-mcmg
Critical
CRITICAL RISK
CVSS Score: 9.8
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
8 years ago
September 06, 2018 at 03:27 AM UTC
Rubyzip gem contains a Directory Traversal vulnerability in zip file component
0.5.7 - 1.2.1
0.5.7 - 1.2.1
Summary
Rubyzip gem contains a Directory Traversal vulnerability in zip file component
Details
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem..
This is similar to CVE-2017-5946 which was patched in 1.2.1 but the fix in that case was incomplete.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
24 days ago
rubyzip path traversal vulnerability
0.5.7 - 3.3.1 GHSA-47m2-wp7j-p9vc
0.5.7 - 3.3.1 GHSA-47m2-wp7j-p9vc
Medium Risk
6 years ago
Rubyzip denial of service
0.5.7 - 1.2.4 GHSA-5m2v-hc64-56h6
0.5.7 - 1.2.4 GHSA-5m2v-hc64-56h6
Critical
8 years ago
Directory traversal vulnerability in RubyZip
0.5.7 - 1.2.0 GHSA-gcqq-w6gr-h9j9
0.5.7 - 1.2.0 GHSA-gcqq-w6gr-h9j9
Impacted packages
Timeline
Published
8 years ago
September 06, 2018 at 03:27 AM UTC
Fixed (1.2.2)
8 years ago
August 31, 2018 at 04:20 PM UTC
Last Modified
2 years ago
February 16, 2024 at 08:10 AM UTC