Directory Traversal

2022-07-2212:16:41

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

68.6%

JSON

tzinfo is vulnerable to Directory Traversal. Whilte Time zone files are loaded with require on demand, it fails to properly validate the time zone identifiers with correct regular expressions, causing a new line character in the identifier. Therefore, an attacker can use TZInfo::Timezone.get to load malicious files and execute within the Ruby process.

CPENameOperatorVersion
tzinfole1.2.9
tzinfole0.3.60
ruby-tzinfo:sideq1.2.6-1
tfm-rubygem-tzinfoeq1.2.6__1.el7sat
tfm-rubygem-tzinfoeq1.2.6__2.el7sat
rubygem-tzinfoeq1.2.5__1.el7
rubygem-tzinfoeq1.2.2__3.el7
rubygem-tzinfoeq1.2.2__2.1.el7rhgs
rubygem-tzinfoeq1.2.5__3.el8ost
rubygem-tzinfoeq1.2.2__2.el7ost

Name	Operator	Version
tzinfo	le	1.2.9
tzinfo	le	0.3.60
ruby-tzinfo:sid	eq	1.2.6-1
tfm-rubygem-tzinfo	eq	1.2.6__1.el7sat
tfm-rubygem-tzinfo	eq	1.2.6__2.el7sat
rubygem-tzinfo	eq	1.2.5__1.el7
rubygem-tzinfo	eq	1.2.2__3.el7
rubygem-tzinfo	eq	1.2.2__2.1.el7rhgs
rubygem-tzinfo	eq	1.2.5__3.el8ost
rubygem-tzinfo	eq	1.2.2__2.el7ost