Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-rdocUpgrade ruby-docUpgrade rubygemsUpgrade ruby-irbUpgrade ruby-debuginfoUpgrade ruby-develUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade ruby-tcltkUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-psych | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby23Upgrade ruby24Upgrade ruby22Upgrade ruby20 | May 11, 2018 | Apr 3, 2018 |
| Apple Osx Ruby | — | Upgrade macOS to the latest versionApply Apple macOS Security Update 2018-002 High Sierra | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade ruby-tcltkUpgrade ruby-develUpgrade rubygem-rakeUpgrade ruby-libsUpgrade rubyUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-rdocUpgrade ruby-debuginfoUpgrade ruby-docUpgrade rubygems | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby1.9.1Upgrade ruby2.5Upgrade ruby1.8 | Aug 2, 2018 | Apr 3, 2018 |
| Freebsd | — | Upgrade ruby | Dec 10, 2025 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Jul 3, 2018 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Jul 3, 2018 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade ruby-libsUpgrade ruby-tcltkUpgrade rubygems-develUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade rubygem-minitestUpgrade ruby-develUpgrade rubyUpgrade rubygemsUpgrade ruby-docUpgrade rubygem-rdoc | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | Upgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygemsUpgrade rubygem-psychUpgrade ruby-libsUpgrade ruby-develUpgrade ruby-tcltkUpgrade ruby-irbUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubyNo solution existsUpgrade rubygem-json | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade yast2-ruby-bindingsUpgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.5-doc-riUpgrade ruby2.1-develUpgrade ruby2.1-stdlibUpgrade ruby2.5-stdlibUpgrade ruby2.1Upgrade libruby2_1-2_1Upgrade ruby2.5Upgrade ruby2.5-docUpgrade ruby2.5-develUpgrade ruby2.5-devel-extraUpgrade libruby2_5-2_5 | Jul 22, 2019 | Apr 3, 2018 |
| Ubuntu | — | Upgrade libruby1.9.1Upgrade ruby1.9.1Upgrade ruby2.0Upgrade ruby1.9.3Upgrade libruby2.3Upgrade ruby2.3Upgrade libruby2.0 | Apr 25, 2018 | Apr 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub