Hub Package Arbitrary File Overwrite

BASSO 3.6CVE-2014-0177 · GHSA-x5m6-jh4r-34mv · Published 27/05/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/github/hub Go	`< 1.12.1`	`1.12.1`
hub RubyGems	`< 1.12.1`	`1.12.1`
hub github	`≤ 1.12.0`	No fix yet

Description

The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file.

NVD description

The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file.

References

nvd.nist.gov/vuln/detail/CVE-2014-0177 · ADVISORY
github/hub commit 016ec99 · WEB
mislav/hub commit 016ec99 · WEB
mislav/hub · PACKAGE
mislav/hub release v1.12.1 · WEB
rubysec/ruby-advisory-db · WEB
secunia.com/advisories/58273 · URL Repurposed

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free