open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution

ALTO 7.8CVE-2015-3649 · GHSA-7m2w-9gw7-c3xp · Published 18/08/2017 · updated 17/06/2026

Em resumo

CVE-2015-3649 é uma vulnerabilidade ALTO (CVSS 7.8) que afeta open-uri-cached, open-uri-cached (open-uri-cached project).
Chance de exploração nos próximos 30 dias (EPSS): 0.39%, maior que 33.2% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
open-uri-cached RubyGems	`≤ 1.0.0`	No fix yet
open-uri-cached open-uri-cached_project	`= 0.0.5`	No fix yet

Description

The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a metafile is created.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2015-3649 · ADVISORY
tigris/open-uri-cached · WEB
rubysec/ruby-advisory-db · WEB
tigris/open-uri-cached · PACKAGE
tigris/open-uri-cached · WEB
web.archive.org/web/20210119122105/http://www.securityfocus.com/bid/74469 · WEB
seclists.org/oss-sec/2015/q2/373 · WEB
benjaminfleischer.com/2013/03/20/yaml-and-security-in-ruby · WEB
openwall.com/lists/oss-security/2015/05/06/2 · WEB
benjaminfleischer.com/2013/03/20/yaml-and-security-in-ruby · Third Party Advisory
securityfocus.com/bid/74469 · Third Party Advisory
tigris/open-uri-cached · Third Party Advisory
tigris/open-uri-cached · Third Party Advisory
tigris/open-uri-cached · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free