gsd-2019-8320
Vulnerability from gsd
Modified
2019-03-05 00:00
Details
A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user’s machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.
Aliases
Aliases
CVE-2019-8320


To clipboard 

{
  "GSD": {
    "alias": "CVE-2019-8320",
    "description": "A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user\u0027s machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.",
    "id": "GSD-2019-8320",
    "references": [
      "https://www.suse.com/security/cve/CVE-2019-8320.html",
      "https://www.debian.org/security/2019/dsa-4433",
      "https://access.redhat.com/errata/RHBA-2019:3384",
      "https://access.redhat.com/errata/RHSA-2019:1429",
      "https://access.redhat.com/errata/RHSA-2019:1150",
      "https://access.redhat.com/errata/RHSA-2019:1148",
      "https://ubuntu.com/security/CVE-2019-8320",
      "https://advisories.mageia.org/CVE-2019-8320.html",
      "https://alas.aws.amazon.com/cve/html/CVE-2019-8320.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "rubygems-update",
            "purl": "pkg:gem/rubygems-update"
          }
        }
      ],
      "aliases": [
        "CVE-2019-8320",
        "GHSA-5x32-c9mf-49cc"
      ],
      "details": "A Directory Traversal issue was discovered in RubyGems 2.7.6 and later\nthrough 3.0.2. Before making new directories or touching files (which now\ninclude path-checking code for symlinks), it would delete the target\ndestination. If that destination was hidden behind a symlink, a malicious gem\ncould delete arbitrary files on the user\u2019s machine, presuming the attacker\ncould guess at paths. Given how frequently gem is run as sudo, and how\npredictable paths are on modern systems (/tmp, /usr, etc.), this could\nlikely lead to data loss or an unusable system.\n",
      "id": "GSD-2019-8320",
      "modified": "2019-03-05T00:00:00.000Z",
      "published": "2019-03-05T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 7.4,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Delete directory using symlink when decompressing tar"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2019-8320",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user\u0027s machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://hackerone.com/reports/317321",
            "refsource": "MISC",
            "url": "https://hackerone.com/reports/317321"
          },
          {
            "name": "https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html",
            "refsource": "CONFIRM",
            "url": "https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html"
          },
          {
            "name": "RHSA-2019:1429",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2019:1429"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "[debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2019-8320",
      "cvss_v3": 7.4,
      "date": "2019-03-05",
      "description": "A Directory Traversal issue was discovered in RubyGems 2.7.6 and later\nthrough 3.0.2. Before making new directories or touching files (which now\ninclude path-checking code for symlinks), it would delete the target\ndestination. If that destination was hidden behind a symlink, a malicious gem\ncould delete arbitrary files on the user\u2019s machine, presuming the attacker\ncould guess at paths. Given how frequently gem is run as sudo, and how\npredictable paths are on modern systems (/tmp, /usr, etc.), this could\nlikely lead to data loss or an unusable system.\n",
      "gem": "rubygems-update",
      "ghsa": "5x32-c9mf-49cc",
      "library": "rubygems",
      "patched_versions": [
        "\u003e= 3.0.3",
        "~\u003e 2.7.9"
      ],
      "title": "Delete directory using symlink when decompressing tar",
      "unaffected_versions": [
        "\u003c 2.7.6"
      ],
      "url": "https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=2.7.6 \u003c=3.0.2",
          "affected_versions": "All versions starting from 2.7.6 up to 3.0.2",
          "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:C/A:C",
          "cvss_v3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-22",
            "CWE-937"
          ],
          "date": "2019-06-11",
          "description": "A Directory Traversal issue was discovered in RubyGems. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user\u0027s machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (`/tmp`, `/usr`, etc.), this could likely lead to data loss or an unusable system.",
          "fixed_versions": [
            "3.0.3"
          ],
          "identifier": "CVE-2019-8320",
          "identifiers": [
            "CVE-2019-8320"
          ],
          "not_impacted": "All versions before 2.7.6, all versions after 3.0.2",
          "package_slug": "gem/rubygems-update",
          "pubdate": "2019-06-06",
          "solution": "Upgrade to version 3.0.3 or above.",
          "title": "Path Traversal",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2019-8320",
            "https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html"
          ],
          "uuid": "b4534d6c-dfa8-4717-a06e-17b40253e328"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.0.2",
                "versionStartIncluding": "2.7.6",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-8320"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user\u0027s machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-22"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/317321",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://hackerone.com/reports/317321"
            },
            {
              "name": "https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html"
            },
            {
              "name": "RHSA-2019:1429",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2019:1429"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "[debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 8.8,
            "confidentialityImpact": "NONE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 9.2,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 5.2
        }
      },
      "lastModifiedDate": "2020-08-16T15:15Z",
      "publishedDate": "2019-06-06T15:29Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.