Description
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High
Affected Packages3 packages
Also affects: Debian Linux 8.0, 9.0
🔴Vulnerability Details
5GHSARubyzip gem contains a Directory Traversal vulnerability in zip file component↗2018-09-06 OSVDirectory traversal vulnerability in RubyZip↗2017-10-24 GHSADirectory traversal vulnerability in RubyZip↗2017-10-24 OSVCVE-2017-5946: The Zip::File component in the rubyzip gem before 1↗2017-02-27 CVEListCVE-2017-5946: The Zip::File component in the rubyzip gem before 1↗2017-02-27 📋Vendor Advisories
2Red Hatrubygem-rubyzip: Directory traversal in the Zip::File component↗2017-02-04 DebianCVE-2017-5946: ruby-zip - The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory...↗2017 💬Community
1BugzillaCVE-2017-5946 rubygem-rubyzip: Directory traversal in the Zip::File component↗2017-03-01