CVE-2008-1145

Fixed in a distro release EPSS 27%

Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash (\) path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1) "..%5c" (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option.

Published 2008-03-04 · CVE record · OSV

Products: ruby-lang webrick, fedoraproject fedora

Distro releases

Release	Package	Fixed in
Chainguard	kube-fluentd-operator	0
Chainguard	ruby3.2-webrick	0
Chainguard	ruby3.3-webrick	1.9.1-r0
Chainguard	ruby3.4-webrick	1.9.1-r3
Chainguard	ruby4.0-webrick	1.9.2-r0
Red Hat Enterprise Linux 4	irb	0:1.8.1-7.el4_7.1
Red Hat Enterprise Linux 4	ruby	0:1.8.1-7.el4_7.1
Red Hat Enterprise Linux 4	ruby-debuginfo	0:1.8.1-7.el4_7.1
Red Hat Enterprise Linux 4	ruby-devel	0:1.8.1-7.el4_7.1
Red Hat Enterprise Linux 4	ruby-docs	0:1.8.1-7.el4_7.1
Red Hat Enterprise Linux 4	ruby-libs	0:1.8.1-7.el4_7.1
Red Hat Enterprise Linux 4	ruby-mode	0:1.8.1-7.el4_7.1
Red Hat Enterprise Linux 4	ruby-tcltk	0:1.8.1-7.el4_7.1
Red Hat Enterprise Linux 5	ruby	0:1.8.5-5.el5_2.5
Red Hat Enterprise Linux 5	ruby-debuginfo	0:1.8.5-5.el5_2.5
Red Hat Enterprise Linux 5	ruby-devel	0:1.8.5-5.el5_2.5
Red Hat Enterprise Linux 5	ruby-docs	0:1.8.5-5.el5_2.5
Red Hat Enterprise Linux 5	ruby-irb	0:1.8.5-5.el5_2.5
Red Hat Enterprise Linux 5	ruby-libs	0:1.8.5-5.el5_2.5
Red Hat Enterprise Linux 5	ruby-mode	0:1.8.5-5.el5_2.5
Red Hat Enterprise Linux 5	ruby-rdoc	0:1.8.5-5.el5_2.5
Red Hat Enterprise Linux 5	ruby-ri	0:1.8.5-5.el5_2.5
Red Hat Enterprise Linux 5	ruby-tcltk	0:1.8.5-5.el5_2.5
Wolfi	kube-fluentd-operator	0
Wolfi	ruby3.2-webrick	0
Wolfi	ruby3.3-webrick	1.9.1-r0
Wolfi	ruby3.4-webrick	1.9.1-r3
Wolfi	ruby4.0-webrick	1.9.2-r0