ISOMAN

CVE

CVE-2018-8780

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.

Severity
CRITICAL
CVSS
9.1
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource
Ubuntu14.04.6 amd64 desktopunknownsource
Ubuntu14.04.6 i386 desktopunknownsource
Ubuntu14.04.6 amd64 serverunknownsource
Ubuntu14.04.6 i386 serverunknownsource

References

  1. http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
  2. http://www.securityfocus.com/bid/103739
  3. http://www.securitytracker.com/id/1042004
  4. https://access.redhat.com/errata/RHSA-2018:3729
  5. https://access.redhat.com/errata/RHSA-2018:3730
  6. https://access.redhat.com/errata/RHSA-2018:3731
  7. https://access.redhat.com/errata/RHSA-2019:2028
  8. https://access.redhat.com/errata/RHSA-2020:0542
  9. https://access.redhat.com/errata/RHSA-2020:0591
  10. https://access.redhat.com/errata/RHSA-2020:0663
  11. https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
  12. https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html
  13. https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
  14. https://usn.ubuntu.com/3626-1/
  15. https://www.debian.org/security/2018/dsa-4259
  16. https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/
  17. https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/
  18. https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/
  19. https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/
  20. https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/