CVE-2018-1000544
Fixed in a distro release EPSS 4%
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem..
Products: rubyzip_project rubyzip, debian_linux, redhat cloudforms
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | rubyzip | 1.2.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ruby-zip | 1.2.2-1 |
| Debian 13 | ruby-zip | 1.2.2-1 |
| Debian 14 | ruby-zip | 1.2.2-1 |
| Debian 8 | ruby-zip | 1.1.6-1+deb8u2 |
| Debian 9 | ruby-zip | 1.2.0-1.1+deb9u1 |
| Red Hat cloudforms managementengine 5.9 | ansible-tower | 0:3.2.7-1.el7at |
| Red Hat cloudforms managementengine 5.9 | ansible-tower-server | 0:3.2.7-1.el7at |
| Red Hat cloudforms managementengine 5.9 | ansible-tower-setup | 0:3.2.7-1.el7at |
| Red Hat cloudforms managementengine 5.9 | ansible-tower-ui | 0:3.2.7-1.el7at |
| Red Hat cloudforms managementengine 5.9 | ansible-tower-venv-ansible | 0:3.2.7-1.el7at |
| Red Hat cloudforms managementengine 5.9 | ansible-tower-venv-tower | 0:3.2.7-1.el7at |
| Red Hat cloudforms managementengine 5.9 | cfme | 0:5.9.5.3-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-amazon-smartstate | 0:5.9.5.3-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-appliance | 0:5.9.5.3-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-appliance-common | 0:5.9.5.3-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-appliance-debuginfo | 0:5.9.5.3-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-appliance-tools | 0:5.9.5.3-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-debuginfo | 0:5.9.5.3-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-gemset | 0:5.9.5.3-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-gemset-debuginfo | 0:5.9.5.3-1.el7cf |
| Ubuntu 16.04 LTS | ruby-zip | no fix |
| Ubuntu 18.04 LTS | ruby-zip | 1.2.1-1.1~build0.18.04.1 |
| openSUSE Tumbleweed | ruby3.2-rubygem-rubyzip | 2.3.2-1.11 |
| openSUSE Tumbleweed | rubygem-rubyzip | 2.3.2-1.19 |
| openSUSE Tumbleweed | rubygem-rubyzip | 2.3.2-1.17 |
| openSUSE Tumbleweed | rubygem-rubyzip | 2.3.2-1.15 |