Input Validation

🗓️ 16 May 2019 02:16:34Reported by Veracode Vulnerability DatabaseType

RubyGems input validation vulnerability allows remote attackers to overwrite file

Reporter	Title	Published	Views	Family All 118
0day.today	RubyGems < 2.6.13 - Arbitrary File Overwrite Exploit	4 Sep 201700:00	–	zdt
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Ruby affect PowerKVM	18 Jun 201801:42	–	ibm
Amazon	Medium: ruby22, ruby23	2 Oct 201700:00	–	amazon
Amazon	Medium: ruby24	26 Oct 201700:00	–	amazon
Tenable Nessus	Amazon Linux AMI : ruby22 / ruby23 (ALAS-2017-906)	3 Oct 201700:00	–	nessus
Tenable Nessus	Amazon Linux AMI : ruby24 (ALAS-2017-915)	27 Oct 201700:00	–	nessus
Tenable Nessus	CentOS 7 : ruby (CESA-2018:0378)	12 Mar 201800:00	–	nessus
Tenable Nessus	Debian DLA-1112-1 : rubygems security update	27 Sep 201700:00	–	nessus
Tenable Nessus	Debian DLA-1114-1 : ruby1.9.1 security update	27 Sep 201700:00	–	nessus
Tenable Nessus	Debian DLA-1421-1 : ruby2.1 security update	16 Jul 201800:00	–	nessus

Vulners

Node

ruby rubyMatch2.2.4-r0os

AND

trusty trustyMatch2.0.0.484-1ubuntu2debian

AND

9 trustyMatch1.9.3.484-2ubuntu1debian

AND

xenial xenialMatch2.3.1-2~ubuntu16.04.14debian

AND

xenial xenialMatch2.3.0-5ubuntu1debian

AND

Source	Link
securityfocus	www.securityfocus.com/bid/100580
securitytracker	www.securitytracker.com/id/1039249
exploit-db	www.exploit-db.com/exploits/42611/
lists	www.lists.debian.org/debian-lts-announce/2018/07/msg00012.html
access	www.access.redhat.com/security/updates/classification/
access	www.access.redhat.com/errata/RHSA-2017:3485
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
debian	www.debian.org/security/2017/dsa-3966
security	www.security.gentoo.org/glsa/201710-01
blog	www.blog.rubygems.org/2017/08/27/2.6.13-released.html

28 Sep 2020 06:48Current

8.5High risk

Vulners AI Score8.5

CVSS 26.4

CVSS 37.5

EPSS0.20215