GHSA-3q5q-f79q-7hr2
High severity vulnerability that affects rubyzip
- Severity
- High
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
1.2.1- Upgrade rubyzip to this version or later
Description
Withdrawn, accidental duplicate publish.
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| rubyzip | < 1.2.1 |
1.2.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
rubyzip RubyGems → 1.2.1
- bundler
bundle update rubyzip # Gemfile: gem "rubyzip", ">= 1.2.1"
References
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-47m2-wp7j-p9vc rubyzip path traversal vulnerability | High | Also affects rubyzip |
| GHSA-5m2v-hc64-56h6 Rubyzip denial of service | Medium | Also affects rubyzip |
| GHSA-vqcq-mrmw-mcmg Rubyzip gem contains a Directory Traversal vulnerability in zip file component | Critical | Also affects rubyzip |
| GHSA-gcqq-w6gr-h9j9 Directory traversal vulnerability in RubyZip | Critical | Also affects rubyzip |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor