gsd - gsd-2022-31163

GSD-2022-31163

Vulnerability from gsd - Updated: 2022-07-21 00:00

Details

# Impact ## Affected versions - 0.3.60 and earlier. - 1.0.0 to 1.2.9 when used with the Ruby data source (tzinfo-data). ## Vulnerability With the Ruby data source (the tzinfo-data gem for tzinfo version 1.0.0 and later and built-in to earlier versions), time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process. For example, with version 1.2.9, you can run the following to load a file with path `/tmp/payload.rb`: ```ruby TZInfo::Timezone.get(\"foo\ /../../../../../../../../../../../../../../../../tmp/payload\") ``` The exact number of parent directory traversals needed will vary depending on the location of the tzinfo-data gem. TZInfo versions 1.2.6 to 1.2.9 can be made to load files from outside of the Ruby load path. Versions up to and including 1.2.5 can only be made to load files from directories within the load path. This could be exploited in, for example, a Ruby on Rails application using tzinfo version 1.2.9, that allows file uploads and has a time zone selector that accepts arbitrary time zone identifiers. The CVSS score and severity have been set on this basis. Versions 2.0.0 and later are not vulnerable. # Patches Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Note that version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. For example if `/tmp/upload` was in the load path, then `TZInfo::Timezone.get('foo')` could load a file with path `/tmp/upload/tzinfo/definition/foo.rb`. Applications should ensure that untrusted files are not placed in a directory on the load path. # Workarounds As a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\\A[A-Za-z0-9+\\-_]+(?:\\/[A-Za-z0-9+\\-_]+)*\\z`.

Aliases

CVE-2022-31163

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-31163",
    "description": "TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source, time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process. Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Versions 2.0.0 and later are not vulnerable. Version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. Applications should ensure that untrusted files are not placed in a directory on the load path. As a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\\A[A-Za-z0-9+\\-_]+(?:\\/[A-Za-z0-9+\\-_]+)*\\z`.",
    "id": "GSD-2022-31163",
    "references": [
      "https://www.suse.com/security/cve/CVE-2022-31163.html",
      "https://access.redhat.com/errata/RHSA-2022:7242"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "tzinfo",
            "purl": "pkg:gem/tzinfo"
          }
        }
      ],
      "aliases": [
        "CVE-2022-31163",
        "GHSA-5cm2-9h8c-rvfx"
      ],
      "details": "# Impact\n\n## Affected versions\n\n- 0.3.60 and earlier.\n- 1.0.0 to 1.2.9 when used with the Ruby data source (tzinfo-data).\n\n## Vulnerability\n\nWith the Ruby data source (the tzinfo-data gem for tzinfo version 1.0.0 and\nlater and built-in to earlier versions), time zones are defined in Ruby files.\nThere is one file per time zone. Time zone files are loaded with `require` on\ndemand. In the affected versions, `TZInfo::Timezone.get` fails to validate\ntime zone identifiers correctly, allowing a new line character within the\nidentifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be\nmade to load unintended files with `require`, executing them within the Ruby\nprocess.\n\nFor example, with version 1.2.9, you can run the following to load a file with\npath `/tmp/payload.rb`:\n\n```ruby\nTZInfo::Timezone.get(\\\"foo\\\n/../../../../../../../../../../../../../../../../tmp/payload\\\")\n```\n\nThe exact number of parent directory traversals needed will vary depending on\nthe location of the tzinfo-data gem.\n\nTZInfo versions 1.2.6 to 1.2.9 can be made to load files from outside of the\nRuby load path. Versions up to and including 1.2.5 can only be made to load\nfiles from directories within the load path.\n\nThis could be exploited in, for example, a Ruby on Rails application using\ntzinfo version 1.2.9, that allows file uploads and has a time zone selector\nthat accepts arbitrary time zone identifiers.\nThe CVSS score and severity have been set on this basis.\n\nVersions 2.0.0 and later are not vulnerable.\n\n# Patches\n\nVersions 0.3.61 and 1.2.10 include fixes to correctly validate time zone\nidentifiers.\n\nNote that version 0.3.61 can still load arbitrary files from the Ruby load\npath if their name follows the rules for a valid time zone identifier and the\nfile has a prefix of `tzinfo/definition` within a directory in the load path.\nFor example if `/tmp/upload` was in the load path, then\n`TZInfo::Timezone.get(\u0027foo\u0027)` could load a file with path\n`/tmp/upload/tzinfo/definition/foo.rb`. Applications should ensure that\nuntrusted files are not placed in a directory on the load path.\n\n# Workarounds\n\nAs a workaround, the time zone identifier can be validated before passing to\n`TZInfo::Timezone.get` by ensuring it matches the regular expression\n`\\\\A[A-Za-z0-9+\\\\-_]+(?:\\\\/[A-Za-z0-9+\\\\-_]+)*\\\\z`.\n",
      "id": "GSD-2022-31163",
      "modified": "2022-07-21T00:00:00.000Z",
      "published": "2022-07-21T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx"
        },
        {
          "type": "WEB",
          "url": "https://github.com/tzinfo/tzinfo/commit/ca29f349856d62cb2b2edb3257d9ddd2f97b3c27"
        },
        {
          "type": "WEB",
          "url": "https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61"
        },
        {
          "type": "WEB",
          "url": "https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 7.5,
          "type": "CVSS_V3"
        }
      ],
      "summary": "TZInfo relative path traversal vulnerability allows loading of arbitrary files"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-31163",
        "STATE": "PUBLIC",
        "TITLE": "TZInfo relative path traversal vulnerability allows loading of arbitrary files"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "tzinfo",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 0.3.61"
                        },
                        {
                          "version_value": "\u003e= 1.0.0, \u003c 1.2.10"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "tzinfo"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source, time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process. Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Versions 2.0.0 and later are not vulnerable. Version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. Applications should ensure that untrusted files are not placed in a directory on the load path. As a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\\A[A-Za-z0-9+\\-_]+(?:\\/[A-Za-z0-9+\\-_]+)*\\z`."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
              }
            ]
          },
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-23: Relative Path Traversal"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx",
            "refsource": "CONFIRM",
            "url": "https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx"
          },
          {
            "name": "https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61",
            "refsource": "MISC",
            "url": "https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61"
          },
          {
            "name": "https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10",
            "refsource": "MISC",
            "url": "https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10"
          },
          {
            "name": "https://github.com/tzinfo/tzinfo/commit/9eddbb5c0e682736f61d0dd803b6031a5db9eadf",
            "refsource": "MISC",
            "url": "https://github.com/tzinfo/tzinfo/commit/9eddbb5c0e682736f61d0dd803b6031a5db9eadf"
          },
          {
            "name": "https://github.com/tzinfo/tzinfo/commit/9905ca93abf7bf3e387bd592406e403cd18334c7",
            "refsource": "MISC",
            "url": "https://github.com/tzinfo/tzinfo/commit/9905ca93abf7bf3e387bd592406e403cd18334c7"
          },
          {
            "name": "[debian-lts-announce] 20220818 [SECURITY] [DLA 3077-1] ruby-tzinfo security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00009.html"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-5cm2-9h8c-rvfx",
        "discovery": "UNKNOWN"
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2022-31163",
      "cvss_v3": 7.5,
      "date": "2022-07-21",
      "description": "# Impact\n\n## Affected versions\n\n- 0.3.60 and earlier.\n- 1.0.0 to 1.2.9 when used with the Ruby data source (tzinfo-data).\n\n## Vulnerability\n\nWith the Ruby data source (the tzinfo-data gem for tzinfo version 1.0.0 and\nlater and built-in to earlier versions), time zones are defined in Ruby files.\nThere is one file per time zone. Time zone files are loaded with `require` on\ndemand. In the affected versions, `TZInfo::Timezone.get` fails to validate\ntime zone identifiers correctly, allowing a new line character within the\nidentifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be\nmade to load unintended files with `require`, executing them within the Ruby\nprocess.\n\nFor example, with version 1.2.9, you can run the following to load a file with\npath `/tmp/payload.rb`:\n\n```ruby\nTZInfo::Timezone.get(\\\"foo\\\n/../../../../../../../../../../../../../../../../tmp/payload\\\")\n```\n\nThe exact number of parent directory traversals needed will vary depending on\nthe location of the tzinfo-data gem.\n\nTZInfo versions 1.2.6 to 1.2.9 can be made to load files from outside of the\nRuby load path. Versions up to and including 1.2.5 can only be made to load\nfiles from directories within the load path.\n\nThis could be exploited in, for example, a Ruby on Rails application using\ntzinfo version 1.2.9, that allows file uploads and has a time zone selector\nthat accepts arbitrary time zone identifiers.\nThe CVSS score and severity have been set on this basis.\n\nVersions 2.0.0 and later are not vulnerable.\n\n# Patches\n\nVersions 0.3.61 and 1.2.10 include fixes to correctly validate time zone\nidentifiers.\n\nNote that version 0.3.61 can still load arbitrary files from the Ruby load\npath if their name follows the rules for a valid time zone identifier and the\nfile has a prefix of `tzinfo/definition` within a directory in the load path.\nFor example if `/tmp/upload` was in the load path, then\n`TZInfo::Timezone.get(\u0027foo\u0027)` could load a file with path\n`/tmp/upload/tzinfo/definition/foo.rb`. Applications should ensure that\nuntrusted files are not placed in a directory on the load path.\n\n# Workarounds\n\nAs a workaround, the time zone identifier can be validated before passing to\n`TZInfo::Timezone.get` by ensuring it matches the regular expression\n`\\\\A[A-Za-z0-9+\\\\-_]+(?:\\\\/[A-Za-z0-9+\\\\-_]+)*\\\\z`.\n",
      "gem": "tzinfo",
      "ghsa": "5cm2-9h8c-rvfx",
      "patched_versions": [
        "~\u003e 0.3.61",
        "\u003e= 1.2.10"
      ],
      "related": {
        "url": [
          "https://github.com/tzinfo/tzinfo/commit/ca29f349856d62cb2b2edb3257d9ddd2f97b3c27",
          "https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61",
          "https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10"
        ]
      },
      "title": "TZInfo relative path traversal vulnerability allows loading of arbitrary files",
      "unaffected_versions": [
        "\u003e= 2.0.0"
      ],
      "url": "https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c0.3.61||\u003e=1.0.0 \u003c1.2.10",
          "affected_versions": "All versions before 0.3.61, all versions starting from 1.0.0 before 1.2.10",
          "cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-22",
            "CWE-937"
          ],
          "date": "2022-10-26",
          "description": "TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, is vulnerable to relative path traversal. With the Ruby data source, time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process. Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Versions 2.0.0 and later are not vulnerable. Version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. Applications should ensure that untrusted files are not placed in a directory on the load path. As a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\\A[A-Za-z0-9+\\-_]+(?:\\/[A-Za-z0-9+\\-_]+)*\\z`.",
          "fixed_versions": [
            "0.3.61",
            "1.2.10"
          ],
          "identifier": "CVE-2022-31163",
          "identifiers": [
            "CVE-2022-31163",
            "GHSA-5cm2-9h8c-rvfx"
          ],
          "not_impacted": "All versions starting from 0.3.61 before 1.0.0, all versions starting from 1.2.10",
          "package_slug": "gem/tzinfo",
          "pubdate": "2022-07-22",
          "solution": "Upgrade to versions 0.3.61, 1.2.10 or above.",
          "title": "Relative Path Traversal",
          "urls": [
            "https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-31163",
            "https://github.com/tzinfo/tzinfo/commit/ca29f349856d62cb2b2edb3257d9ddd2f97b3c27",
            "https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61",
            "https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10",
            "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/tzinfo/CVE-2022-31163.yml",
            "https://github.com/advisories/GHSA-5cm2-9h8c-rvfx"
          ],
          "uuid": "73f249ef-3b39-4432-be0a-e93073495c3d"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:tzinfo_project:tzinfo:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.2.10",
                "versionStartIncluding": "1.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tzinfo_project:tzinfo:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.3.61",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-31163"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source, time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process. Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Versions 2.0.0 and later are not vulnerable. Version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. Applications should ensure that untrusted files are not placed in a directory on the load path. As a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\\A[A-Za-z0-9+\\-_]+(?:\\/[A-Za-z0-9+\\-_]+)*\\z`."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-22"
                },
                {
                  "lang": "en",
                  "value": "CWE-23"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61",
              "refsource": "MISC",
              "tags": [
                "Release Notes",
                "Third Party Advisory"
              ],
              "url": "https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61"
            },
            {
              "name": "https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx",
              "refsource": "CONFIRM",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx"
            },
            {
              "name": "https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10",
              "refsource": "MISC",
              "tags": [
                "Release Notes",
                "Third Party Advisory"
              ],
              "url": "https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10"
            },
            {
              "name": "https://github.com/tzinfo/tzinfo/commit/9eddbb5c0e682736f61d0dd803b6031a5db9eadf",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/tzinfo/tzinfo/commit/9eddbb5c0e682736f61d0dd803b6031a5db9eadf"
            },
            {
              "name": "https://github.com/tzinfo/tzinfo/commit/9905ca93abf7bf3e387bd592406e403cd18334c7",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/tzinfo/tzinfo/commit/9905ca93abf7bf3e387bd592406e403cd18334c7"
            },
            {
              "name": "[debian-lts-announce] 20220818 [SECURITY] [DLA 3077-1] ruby-tzinfo security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00009.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-10-26T19:00Z",
      "publishedDate": "2022-07-22T04:15Z"
    }
  }
}

CVE-2022-31163 (GCVE-0-2022-31163)

Vulnerability from cvelistv5 – Published: 2022-07-21 13:30 – Updated: 2024-09-05 14:09

Summary

TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source, time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process. Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Versions 2.0.0 and later are not vulnerable. Version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. Applications should ensure that untrusted files are not placed in a directory on the load path. As a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z`.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23 - Relative Path Traversal

Assigner

GitHub_M

References

URL

Tags

	https://github.com/tzinfo/tzinfo/security/advisor…	x_refsource_CONFIRM
	https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61	x_refsource_MISC
	https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10	x_refsource_MISC
	https://github.com/tzinfo/tzinfo/commit/9eddbb5c0…	x_refsource_MISC
	https://github.com/tzinfo/tzinfo/commit/9905ca93a…	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2022…	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	tzinfo	tzinfo	Affected: < 0.3.61 Affected: >= 1.0.0, < 1.2.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-09-03T10:02:42.400Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/tzinfo/tzinfo/commit/9eddbb5c0e682736f61d0dd803b6031a5db9eadf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/tzinfo/tzinfo/commit/9905ca93abf7bf3e387bd592406e403cd18334c7"
          },
          {
            "name": "[debian-lts-announce] 20220818 [SECURITY] [DLA 3077-1] ruby-tzinfo security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00009.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-31163",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-05T14:09:24.627557Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-05T14:09:42.030Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tzinfo",
          "vendor": "tzinfo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.3.61"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.2.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source, time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process. Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Versions 2.0.0 and later are not vulnerable. Version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. Applications should ensure that untrusted files are not placed in a directory on the load path. As a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\\A[A-Za-z0-9+\\-_]+(?:\\/[A-Za-z0-9+\\-_]+)*\\z`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-18T19:06:19",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tzinfo/tzinfo/commit/9eddbb5c0e682736f61d0dd803b6031a5db9eadf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tzinfo/tzinfo/commit/9905ca93abf7bf3e387bd592406e403cd18334c7"
        },
        {
          "name": "[debian-lts-announce] 20220818 [SECURITY] [DLA 3077-1] ruby-tzinfo security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00009.html"
        }
      ],
      "source": {
        "advisory": "GHSA-5cm2-9h8c-rvfx",
        "discovery": "UNKNOWN"
      },
      "title": "TZInfo relative path traversal vulnerability allows loading of arbitrary files",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-31163",
          "STATE": "PUBLIC",
          "TITLE": "TZInfo relative path traversal vulnerability allows loading of arbitrary files"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "tzinfo",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 0.3.61"
                          },
                          {
                            "version_value": "\u003e= 1.0.0, \u003c 1.2.10"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "tzinfo"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source, time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process. Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Versions 2.0.0 and later are not vulnerable. Version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. Applications should ensure that untrusted files are not placed in a directory on the load path. As a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\\A[A-Za-z0-9+\\-_]+(?:\\/[A-Za-z0-9+\\-_]+)*\\z`."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-23: Relative Path Traversal"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx",
              "refsource": "CONFIRM",
              "url": "https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx"
            },
            {
              "name": "https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61",
              "refsource": "MISC",
              "url": "https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61"
            },
            {
              "name": "https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10",
              "refsource": "MISC",
              "url": "https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10"
            },
            {
              "name": "https://github.com/tzinfo/tzinfo/commit/9eddbb5c0e682736f61d0dd803b6031a5db9eadf",
              "refsource": "MISC",
              "url": "https://github.com/tzinfo/tzinfo/commit/9eddbb5c0e682736f61d0dd803b6031a5db9eadf"
            },
            {
              "name": "https://github.com/tzinfo/tzinfo/commit/9905ca93abf7bf3e387bd592406e403cd18334c7",
              "refsource": "MISC",
              "url": "https://github.com/tzinfo/tzinfo/commit/9905ca93abf7bf3e387bd592406e403cd18334c7"
            },
            {
              "name": "[debian-lts-announce] 20220818 [SECURITY] [DLA 3077-1] ruby-tzinfo security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00009.html"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-5cm2-9h8c-rvfx",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-31163",
    "datePublished": "2022-07-21T13:30:16",
    "dateReserved": "2022-05-18T00:00:00",
    "dateUpdated": "2024-09-05T14:09:42.030Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-5CM2-9H8C-RVFX

Vulnerability from github – Published: 2022-07-21 21:39 – Updated: 2022-08-10 23:48

Summary

TZInfo relative path traversal vulnerability allows loading of arbitrary files

Details

Impact

Affected versions

0.3.60 and earlier.
1.0.0 to 1.2.9 when used with the Ruby data source (tzinfo-data).

Vulnerability

With the Ruby data source (the tzinfo-data gem for tzinfo version 1.0.0 and later and built-in to earlier versions), time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with require on demand. In the affected versions, TZInfo::Timezone.get fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, TZInfo::Timezone.get can be made to load unintended files with require, executing them within the Ruby process.

For example, with version 1.2.9, you can run the following to load a file with path /tmp/payload.rb:

TZInfo::Timezone.get("foo\n/../../../../../../../../../../../../../../../../tmp/payload")

The exact number of parent directory traversals needed will vary depending on the location of the tzinfo-data gem.

TZInfo versions 1.2.6 to 1.2.9 can be made to load files from outside of the Ruby load path. Versions up to and including 1.2.5 can only be made to load files from directories within the load path.

This could be exploited in, for example, a Ruby on Rails application using tzinfo version 1.2.9, that allows file uploads and has a time zone selector that accepts arbitrary time zone identifiers. The CVSS score and severity have been set on this basis.

Versions 2.0.0 and later are not vulnerable.

Patches

Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers (commit 9eddbb5c0e682736f61d0dd803b6031a5db9eadf for 0.3.x and commit 9905ca93abf7bf3e387bd592406e403cd18334c7 for 1.2.x).

Note that version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of tzinfo/definition within a directory in the load path. For example if /tmp/upload was in the load path, then TZInfo::Timezone.get('foo') could load a file with path /tmp/upload/tzinfo/definition/foo.rb. Applications should ensure that untrusted files are not placed in a directory on the load path.

Workarounds

As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.

For more information

If you have any questions or comments about this advisory: - Open an issue in the tzinfo repository.

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "tzinfo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.61"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "tzinfo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.2.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-31163"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-23"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-21T21:39:29Z",
    "nvd_published_at": "2022-07-22T04:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\n#### Affected versions\n\n  - 0.3.60 and earlier.\n  - 1.0.0 to 1.2.9 when used with the Ruby data source (tzinfo-data).\n\n#### Vulnerability \n\nWith the Ruby data source (the tzinfo-data gem for tzinfo version 1.0.0 and later and built-in to earlier versions), time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process.\n\nFor example, with version 1.2.9, you can run the following to load a file with path `/tmp/payload.rb`:\n\n```ruby\nTZInfo::Timezone.get(\"foo\\n/../../../../../../../../../../../../../../../../tmp/payload\")\n```\n\nThe exact number of parent directory traversals needed will vary depending on the location of the tzinfo-data gem.\n\nTZInfo versions 1.2.6 to 1.2.9 can be made to load files from outside of the Ruby load path. Versions up to and including 1.2.5 can only be made to load files from directories within the load path. \n\nThis could be exploited in, for example, a Ruby on Rails application using tzinfo version 1.2.9, that allows file uploads and has a time zone selector that accepts arbitrary time zone identifiers. The CVSS score and severity have been set on this basis.\n\nVersions 2.0.0 and later are not vulnerable.\n\n### Patches\n\nVersions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers (commit 9eddbb5c0e682736f61d0dd803b6031a5db9eadf for 0.3.x and commit 9905ca93abf7bf3e387bd592406e403cd18334c7 for 1.2.x).\n\nNote that version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. For example if `/tmp/upload` was in the load path, then `TZInfo::Timezone.get(\u0027foo\u0027)` could load a file with path `/tmp/upload/tzinfo/definition/foo.rb`. Applications should ensure that untrusted files are not placed in a directory on the load path.\n\n### Workarounds\n\nAs a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\\A[A-Za-z0-9+\\-_]+(?:\\/[A-Za-z0-9+\\-_]+)*\\z`.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n  - Open an issue in [the tzinfo repository](https://github.com/tzinfo/tzinfo).",
  "id": "GHSA-5cm2-9h8c-rvfx",
  "modified": "2022-08-10T23:48:58Z",
  "published": "2022-07-21T21:39:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31163"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tzinfo/tzinfo/commit/9905ca93abf7bf3e387bd592406e403cd18334c7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tzinfo/tzinfo/commit/9eddbb5c0e682736f61d0dd803b6031a5db9eadf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/tzinfo/CVE-2022-31163.yml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tzinfo/tzinfo"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00009.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "TZInfo relative path traversal vulnerability allows loading of arbitrary files"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GSD-2022-31163

CVE-2022-31163 (GCVE-0-2022-31163)

GHSA-5CM2-9H8C-RVFX

Impact

Affected versions

Vulnerability

Patches

Workarounds

For more information

Tags

Sightings

Nomenclature