open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution

2022-05-1301:13:48

Google

osv.dev

0.0004 Low

EPSS

Percentile

5.1%

JSON

The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing “openuri-” followed by a crafted UID, and putting Ruby code in said directory once a metafile is created.

CPENameOperatorVersion
open-uri-cachedeq0.0.4
open-uri-cachedeq0.0.3
open-uri-cachedeq1.0.0
open-uri-cachedeq0.0.1
open-uri-cachedeq0.0.5

Name	Operator	Version
open-uri-cached	eq	0.0.4
open-uri-cached	eq	0.0.3
open-uri-cached	eq	1.0.0
open-uri-cached	eq	0.0.1
open-uri-cached	eq	0.0.5

References

seclists.org/oss-sec/2015/q2/373

www.benjaminfleischer.com/2013/03/20/yaml-and-security-in-ruby

www.openwall.com/lists/oss-security/2015/05/06/2

github.com/rubysec/ruby-advisory-db/blob/master/gems/open-uri-cached/CVE-2015-3649.yml

github.com/tigris/open-uri-cached

github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb

github.com/tigris/open-uri-cached/issues/8

nvd.nist.gov/vuln/detail/CVE-2015-3649

web.archive.org/web/20210119122105/www.securityfocus.com/bid/74469

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for OSV:GHSA-7M2W-9GW7-C3XP