CNVD-2018-07055

Vulnerability from cnvd - Published: 2018-04-04
VLAI
Title
RubyGems目录遍历漏洞
Description
RubyGems是Ruby的一个包管理器，提供了分发Ruby程序和函式库的标准格式“gem”，旨在方便地管理gem安装的工具，以及用于分发gem的服务器。 RubyGems的gem安装存在目录遍历漏洞。攻击者可通过安装恶意gem利用该漏洞在安装过程中写入任意文件系统位置。
Severity
中
Patch Name
RubyGems目录遍历漏洞的补丁
Patch Description
RubyGems是Ruby的一个包管理器，提供了分发Ruby程序和函式库的标准格式“gem”，旨在方便地管理gem安装的工具，以及用于分发gem的服务器。 RubyGems的gem安装存在目录遍历漏洞。攻击者可通过安装恶意gem利用该漏洞在安装过程中写入任意文件系统位置。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

厂商已发布漏洞修复程序，请及时关注更新： https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759

Reference
https://nvd.nist.gov/vuln/detail/CVE-2018-1000079
Impacted products
Name
['RubyGems Ruby 2.2 series <=2.2.9', 'RubyGems Ruby 2.3 series <=2.3.6', 'RubyGems Ruby 2.4 series <=2.4.3', 'RubyGems Ruby 2.5 series <=2.5.0']
Show details on source website
To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-1000079"
    }
  },
  "description": "RubyGems\u662fRuby\u7684\u4e00\u4e2a\u5305\u7ba1\u7406\u5668\uff0c\u63d0\u4f9b\u4e86\u5206\u53d1Ruby\u7a0b\u5e8f\u548c\u51fd\u5f0f\u5e93\u7684\u6807\u51c6\u683c\u5f0f\u201cgem\u201d\uff0c\u65e8\u5728\u65b9\u4fbf\u5730\u7ba1\u7406gem\u5b89\u88c5\u7684\u5de5\u5177\uff0c\u4ee5\u53ca\u7528\u4e8e\u5206\u53d1gem\u7684\u670d\u52a1\u5668\u3002\r\n\r\nRubyGems\u7684gem\u5b89\u88c5\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5b89\u88c5\u6076\u610fgem\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u5b89\u88c5\u8fc7\u7a0b\u4e2d\u5199\u5165\u4efb\u610f\u6587\u4ef6\u7cfb\u7edf\u4f4d\u7f6e\u3002",
  "discovererName": "unknown",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-07055",
  "openTime": "2018-04-04",
  "patchDescription": "RubyGems\u662fRuby\u7684\u4e00\u4e2a\u5305\u7ba1\u7406\u5668\uff0c\u63d0\u4f9b\u4e86\u5206\u53d1Ruby\u7a0b\u5e8f\u548c\u51fd\u5f0f\u5e93\u7684\u6807\u51c6\u683c\u5f0f\u201cgem\u201d\uff0c\u65e8\u5728\u65b9\u4fbf\u5730\u7ba1\u7406gem\u5b89\u88c5\u7684\u5de5\u5177\uff0c\u4ee5\u53ca\u7528\u4e8e\u5206\u53d1gem\u7684\u670d\u52a1\u5668\u3002\r\n\r\nRubyGems\u7684gem\u5b89\u88c5\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5b89\u88c5\u6076\u610fgem\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u5b89\u88c5\u8fc7\u7a0b\u4e2d\u5199\u5165\u4efb\u610f\u6587\u4ef6\u7cfb\u7edf\u4f4d\u7f6e\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "RubyGems\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "RubyGems Ruby 2.2 series \u003c=2.2.9",
      "RubyGems Ruby 2.3 series \u003c=2.3.6",
      "RubyGems Ruby 2.4 series \u003c=2.4.3",
      "RubyGems Ruby 2.5 series \u003c=2.5.0"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000079",
  "serverity": "\u4e2d",
  "submitTime": "2018-03-14",
  "title": "RubyGems\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.