RubyGems Path Traversal vulnerability

2022-05-1401:54:40

Google

osv.dev

0.01 Low

EPSS

Percentile

83.9%

JSON

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem writing to arbitrary filesystem locations during installation. This attack appears to be exploitable via installation of a malicious gem. This vulnerability is fixed in 2.7.6.

CPENameOperatorVersion
rubygems-updateeq0.8.5
org.jruby:jruby-stdlibeq1.7.2
rubygems-updateeq1.8.8
rubygems-updateeq1.8.25
rubygems-updateeq2.2.0.rc.1
rubygems-updateeq1.8.20
rubygems-updateeq1.0.0
rubygems-updateeq0.9.2
org.jruby:jruby-stdlibeq1.7.23
rubygems-updateeq2.0.5

Name	Operator	Version
rubygems-update	eq	0.8.5
org.jruby:jruby-stdlib	eq	1.7.2
rubygems-update	eq	1.8.8
rubygems-update	eq	1.8.25
rubygems-update	eq	2.2.0.rc.1
rubygems-update	eq	1.8.20
rubygems-update	eq	1.0.0
rubygems-update	eq	0.9.2
org.jruby:jruby-stdlib	eq	1.7.23
rubygems-update	eq	2.0.5