Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade ruby-debuginfoUpgrade rubygem-rdocUpgrade ruby-develUpgrade rubygems-develUpgrade ruby-docUpgrade ruby-irbUpgrade rubyUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade ruby-tcltkUpgrade rubygem-rake | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby23Upgrade ruby24Upgrade ruby20Upgrade ruby22 | May 11, 2018 | Apr 3, 2018 |
| Apple Osx Ruby | — | Apply Apple macOS Security Update 2018-002 High SierraUpgrade macOS to the latest version | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade ruby-docUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygemsUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade ruby-irbUpgrade ruby-tcltkUpgrade rubygem-rakeUpgrade rubyUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubygem-minitest | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby1.9.1Upgrade ruby2.5Upgrade ruby1.8 | Aug 2, 2018 | Apr 3, 2018 |
| Freebsd | — | Upgrade ruby | Dec 10, 2025 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Jul 3, 2018 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Jul 3, 2018 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygems-develUpgrade ruby-tcltkUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubygemsUpgrade ruby-docUpgrade rubyUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade ruby-devel | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | Upgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygemsUpgrade ruby-debuginfoUpgrade rubygems-develUpgrade rubygem-rdocNo solution existsUpgrade rubyUpgrade ruby-tcltkUpgrade ruby-irbUpgrade ruby-develUpgrade rubygem-jsonUpgrade ruby-doc | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade ruby2.1-develUpgrade ruby2.1-stdlibUpgrade ruby2.5-doc-riUpgrade yast2-ruby-bindingsUpgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.5-devel-extraUpgrade ruby2.1Upgrade ruby2.5Upgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.5-develUpgrade libruby2_1-2_1Upgrade ruby2.5-stdlib | Jul 22, 2019 | Apr 3, 2018 |
| Ubuntu | — | Upgrade libruby2.3Upgrade libruby2.0Upgrade ruby2.3Upgrade ruby1.9.3Upgrade libruby1.9.1Upgrade ruby1.9.1Upgrade ruby2.0 | Apr 25, 2018 | Apr 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub