Описание
RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
It was found that rubygems did not sanitize gem names during installation of a given gem. A specially crafted gem could use this flaw to install files outside of the regular directory.
Отчет
This issue affects the versions of ruby as shipped with Red Hat Enterprise Linux 6, and 7 and the versions of rh-ruby22-ruby and rh-ruby23-ruby as shipped with Red Hat Software Collections. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | rubygems | Will not fix | ||
| Red Hat Enterprise MRG 2 | rubygems | Under investigation | ||
| Red Hat Satellite 6 | rubygems | Under investigation | ||
| Red Hat Subscription Asset Manager | ruby193-rubygems | Under investigation | ||
| Red Hat Enterprise Linux 7 | ruby | Fixed | RHSA-2018:0378 | 28.02.2018 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | rh-ruby24-ruby | Fixed | RHSA-2017:3485 | 19.12.2017 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | rh-ruby22-ruby | Fixed | RHSA-2018:0583 | 26.03.2018 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | rh-ruby23-ruby | Fixed | RHSA-2018:0585 | 26.03.2018 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS | rh-ruby24-ruby | Fixed | RHSA-2017:3485 | 19.12.2017 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS | rh-ruby22-ruby | Fixed | RHSA-2018:0583 | 26.03.2018 |
Показывать по
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
RubyGems version 2.6.12 and earlier fails to validate specification na ...
RubyGems may allow a maliciously crafted gem to overwrite files
Уязвимость менеджера пакетов rubygems, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю осуществить перезапись любого файла
6.5 Medium
CVSS3