Описание
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise MRG 2 | rubygem-rack | Not affected | ||
| Red Hat Subscription Asset Manager | rubygem-rack | Not affected | ||
| RHEL 6 Version of OpenShift Enterprise | jenkins | Fixed | RHSA-2013:0638 | 12.03.2013 |
| RHEL 6 Version of OpenShift Enterprise | openshift-origin-cartridge-jenkins-1.4 | Fixed | RHSA-2013:0638 | 12.03.2013 |
| RHEL 6 Version of OpenShift Enterprise | ruby193-rubygem-rack | Fixed | RHSA-2013:0638 | 12.03.2013 |
| RHEL 6 Version of OpenShift Enterprise | ruby193-rubygem-rack | Fixed | RHSA-2013:0638 | 12.03.2013 |
| RHEL 6 Version of OpenShift Enterprise | rubygem-rack | Fixed | RHSA-2013:0638 | 12.03.2013 |
Показывать по
Дополнительная информация
Статус:
4.3 Medium
CVSS2
Связанные уязвимости
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before ...
4.3 Medium
CVSS2