Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-tcltkUpgrade rubygem-psychUpgrade rubygem-rakeUpgrade rubygem-jsonUpgrade rubygem-rdocUpgrade ruby-irbUpgrade ruby-develUpgrade ruby-debuginfoUpgrade ruby-docUpgrade rubygems-develUpgrade rubyUpgrade rubygemsUpgrade rubygem-minitest | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby24Upgrade ruby23Upgrade ruby22Upgrade ruby20 | May 11, 2018 | Apr 3, 2018 |
| Apple Osx Ruby | — | Apply Apple macOS Security Update 2018-002 High SierraUpgrade macOS to the latest version | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade ruby-tcltkUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-psychUpgrade ruby-develUpgrade rubygem-minitestUpgrade ruby-irbUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-rdoc | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby1.9.1Upgrade ruby2.5Upgrade ruby1.8 | Aug 2, 2018 | Apr 3, 2018 |
| Freebsd | — | Upgrade ruby | Dec 10, 2025 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Jul 3, 2018 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jul 3, 2018 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade ruby-tcltkUpgrade rubygem-rakeUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade rubygemsUpgrade ruby-docUpgrade ruby-irbUpgrade rubygem-minitestUpgrade ruby-develUpgrade ruby | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | Upgrade ruby-irbUpgrade rubygem-jsonUpgrade ruby-tcltkUpgrade rubyUpgrade ruby-docNo solution existsUpgrade rubygem-rdocUpgrade ruby-develUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade ruby-libsUpgrade rubygem-bigdecimal | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade ruby2.5-doc-riUpgrade ruby2.1-stdlibUpgrade ruby2.1-develUpgrade ruby-bundled-gems-rpmhelperUpgrade yast2-ruby-bindingsUpgrade ruby2.5-docUpgrade ruby2.1Upgrade ruby2.5Upgrade ruby2.5-devel-extraUpgrade libruby2_1-2_1Upgrade libruby2_5-2_5Upgrade ruby2.5-develUpgrade ruby2.5-stdlib | Jul 22, 2019 | Apr 3, 2018 |
| Ubuntu | — | Upgrade ruby2.3Upgrade libruby2.3Upgrade libruby2.0Upgrade ruby1.9.3Upgrade libruby1.9.1Upgrade ruby1.9.1Upgrade ruby2.0 | Apr 25, 2018 | Apr 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub