RubyGems Link Following vulnerability

2022-05-1301:18:44

Google

osv.dev

0.006 Low

EPSS

Percentile

77.7%

JSON

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.

CPENameOperatorVersion
rubygems-updateeq0.8.5
org.jruby:jruby-stdlibeq1.7.2
rubygems-updateeq1.8.8
rubygems-updateeq1.8.25
rubygems-updateeq2.2.0.rc.1
rubygems-updateeq1.8.20
rubygems-updateeq1.0.0
rubygems-updateeq0.9.2
org.jruby:jruby-stdlibeq1.7.23
rubygems-updateeq2.0.5

Name	Operator	Version
rubygems-update	eq	0.8.5
org.jruby:jruby-stdlib	eq	1.7.2
rubygems-update	eq	1.8.8
rubygems-update	eq	1.8.25
rubygems-update	eq	2.2.0.rc.1
rubygems-update	eq	1.8.20
rubygems-update	eq	1.0.0
rubygems-update	eq	0.9.2
org.jruby:jruby-stdlib	eq	1.7.23
rubygems-update	eq	2.0.5