CVE-2018-1000073
Last modified
CVE-2018-1000073 is a vulnerability of currently unknown severity. RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.. EPSS estimates a 5.08% chance of exploitation in the next 30 days.
Description
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Rubygems | Rubygems | <= 2.2.9 |
| Rubygems | Rubygems | <= 2.3.6 |
| Rubygems | Rubygems | <= 2.4.3 |
| Rubygems | Rubygems | <= 2.5.0 |
References
- http://blog.rubygems.org/2018/02/15/2.7.6-released.htmlVendor Advisory
- https://github.com/rubygems/rubygems/commit/1b931fc03b819b9a0214be3eaca844ef534175e2Patch, Third Party Advisory
- http://blog.rubygems.org/2018/02/15/2.7.6-released.htmlVendor Advisory
- https://github.com/rubygems/rubygems/commit/1b931fc03b819b9a0214be3eaca844ef534175e2Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-1000073?
How severe is CVE-2018-1000073?
How do I fix CVE-2018-1000073?
Are you affected by CVE-2018-1000073?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST