CVE-2019-8320
Published: 27 March 2019
A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.
Notes
Author | Note |
---|---|
tyhicks | ruby{1.9.1,2.0,2.3} and jruby ship an embedded rubygems. |
Priority
Status
Package | Release | Status |
---|---|---|
ruby2.5 Launchpad, Ubuntu, Debian |
groovy |
Does not exist
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
lunar |
Does not exist
|
|
bionic |
Released
(2.5.1-1ubuntu1.2)
|
|
cosmic |
Released
(2.5.1-5ubuntu4.3)
|
|
disco |
Released
(2.5.5-1)
|
|
eoan |
Released
(2.5.5-1)
|
|
focal |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
jruby Launchpad, Ubuntu, Debian |
groovy |
Not vulnerable
(9.1.17.0-3)
|
trusty |
Needs triage
|
|
lunar |
Not vulnerable
(9.1.17.0-3)
|
|
bionic |
Needed
|
|
cosmic |
Ignored
(end of life)
|
|
disco |
Ignored
(end of life)
|
|
eoan |
Not vulnerable
(9.1.17.0-3)
|
|
focal |
Not vulnerable
(9.1.17.0-3)
|
|
hirsute |
Not vulnerable
(9.1.17.0-3)
|
|
impish |
Not vulnerable
(9.1.17.0-3)
|
|
upstream |
Needs triage
|
|
xenial |
Not vulnerable
(code not present)
|
|
ruby2.1 Launchpad, Ubuntu, Debian |
groovy |
Does not exist
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
lunar |
Does not exist
|
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
ruby1.9.1 Launchpad, Ubuntu, Debian |
jammy |
Does not exist
|
kinetic |
Does not exist
|
|
trusty |
Released
(1.9.3.484-2ubuntu1.14)
|
|
lunar |
Does not exist
|
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
ruby2.0 Launchpad, Ubuntu, Debian |
jammy |
Does not exist
|
kinetic |
Does not exist
|
|
trusty |
Released
(2.0.0.484-1ubuntu2.13)
|
|
lunar |
Does not exist
|
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
ruby2.3 Launchpad, Ubuntu, Debian |
jammy |
Does not exist
|
kinetic |
Does not exist
|
|
lunar |
Does not exist
|
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Released
(2.3.1-2~16.04.12)
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.4 |
Attack vector | Network |
Attack complexity | High |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8320
- https://bugs.ruby-lang.org/attachments/7669 (for 2.4.5)
- https://bugs.ruby-lang.org/attachments/7670 (for 2.5.3)
- https://www.ruby-lang.org/en/news/2019/03/05/multiple-vulnerabilities-in-rubygems/
- https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
- https://ubuntu.com/security/notices/USN-3945-1
- NVD
- Launchpad
- Debian