RubyGems may allow a maliciously crafted gem to overwrite files

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2017-0901 · ADVISORY
• rubygems/rubygems commit ad5c0a5 · WEB
• hackerone.com/reports/243156 · WEB
• access.redhat.com/errata/RHSA-2017:3485 · WEB
• access.redhat.com/errata/RHSA-2018:0378 · WEB
• access.redhat.com/errata/RHSA-2018:0583 · WEB
• access.redhat.com/errata/RHSA-2018:0585 · WEB
• rubygems/rubygems · PACKAGE
• lists.debian.org/debian-lts-announce/2018/07/msg00012.html · WEB
• security.gentoo.org/glsa/201710-01 · WEB
• usn.ubuntu.com/3553-1 · WEB
• usn.ubuntu.com/3685-1 · WEB
• web.archive.org/web/20170907215801/http://www.securitytracker.com/id/1039249

Lỗ hổng khác của rubygems-update

• CVE-2019-8323CAO 7.5An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout…
• CVE-2019-8322CAO 7.5An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to …
• CVE-2019-8321CAO 7.5An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape seque…
• CVE-2019-8325CAO 7.5An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape se…
• CVE-2019-8324CAO 8.8An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, a…