The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ruby-zipUpgrade libzip-ruby | Mar 5, 2017 | Feb 27, 2017 |
| Suse | — | Upgrade ruby2.3-rubygem-rubyzipUpgrade ruby2.3-rubygem-rubyzip-docUpgrade ruby2.3-rubygem-rubyzip-testsuiteUpgrade ruby2.2-rubygem-rubyzipUpgrade ruby2.4-rubygem-rubyzip-testsuiteUpgrade ruby2.2-rubygem-rubyzip-docUpgrade ruby2.4-rubygem-rubyzip-docUpgrade ruby2.1-rubygem-rubyzip-docUpgrade ruby2.1-rubygem-rubyzipUpgrade ruby2.4-rubygem-rubyzipUpgrade ruby2.2-rubygem-rubyzip-testsuiteUpgrade ruby2.1-rubygem-rubyzip-testsuite | Aug 10, 2017 | Feb 27, 2017 |
| Ubuntu | — | Upgrade libzip-ruby | Nov 19, 2024 | Feb 27, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub