CVE-2012-2139 Mail Gem Path Traversal vulnerability
MediumCVSS 5.0
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems mail(RubyGems) | < 2.4.4 | 2.4.4 |
| rubygems mail(RubyGems) | = 1.0.0 | No fix listed |
| rubygems mail(RubyGems) | = 1.1.0 | No fix listed |
| rubygems mail(RubyGems) | = 1.2.1 | No fix listed |
| rubygems mail(RubyGems) | = 1.2.5 | No fix listed |
| rubygems mail(RubyGems) | = 1.2.6 | No fix listed |
| rubygems mail(RubyGems) | = 1.2.8 | No fix listed |
| rubygems mail(RubyGems) | = 1.2.9 | No fix listed |
| rubygems mail(RubyGems) | = 1.3.0 | No fix listed |
| rubygems mail(RubyGems) | = 1.3.1 | No fix listed |
| rubygems mail(RubyGems) | = 1.3.2 | No fix listed |
| rubygems mail(RubyGems) | = 1.3.3 | No fix listed |
| rubygems mail(RubyGems) | = 1.3.4 | No fix listed |
| rubygems mail(RubyGems) | = 1.3.5 | No fix listed |
| rubygems mail(RubyGems) | = 1.4.0 | No fix listed |
| rubygems mail(RubyGems) | = 1.4.1 | No fix listed |
| rubygems mail(RubyGems) | = 1.4.2 | No fix listed |
| rubygems mail(RubyGems) | = 1.4.3 | No fix listed |
| rubygems mail(RubyGems) | = 1.5.0 | No fix listed |
| rubygems mail(RubyGems) | = 1.5.1 | No fix listed |
| rubygems mail(RubyGems) | = 1.5.2 | No fix listed |
| rubygems mail(RubyGems) | = 1.5.3 | No fix listed |
| rubygems mail(RubyGems) | = 1.5.4 | No fix listed |
| rubygems mail(RubyGems) | = 1.6.0 | No fix listed |
| rubygems mail(RubyGems) | = 2.0.3 | No fix listed |
Show 46 more
| rubygems mail(RubyGems) | = 2.0.5 | No fix listed |
| rubygems mail(RubyGems) | = 2.1.0 | No fix listed |
| rubygems mail(RubyGems) | = 2.1.1 | No fix listed |
| rubygems mail(RubyGems) | = 2.1.2 | No fix listed |
| rubygems mail(RubyGems) | = 2.1.3 | No fix listed |
| rubygems mail(RubyGems) | = 2.1.5 | No fix listed |
| rubygems mail(RubyGems) | = 2.1.5.1 | No fix listed |
| rubygems mail(RubyGems) | = 2.1.5.2 | No fix listed |
| rubygems mail(RubyGems) | = 2.1.5.3 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.0 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.1 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.10 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.11 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.12 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.13 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.14 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.15 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.16 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.17 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.18 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.19 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.2 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.20 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.3 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.4 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.5 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.5.1 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.5.2 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.6 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.6.1 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.7 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.9 | No fix listed |
| rubygems mail(RubyGems) | = 2.2.9.1 | No fix listed |
| rubygems mail(RubyGems) | = 2.3.0 | No fix listed |
| rubygems mail(RubyGems) | = 2.3.2 | No fix listed |
| rubygems mail(RubyGems) | = 2.3.3 | No fix listed |
| rubygems mail(RubyGems) | = 2.4.0 | No fix listed |
| rubygems mail(RubyGems) | = 2.4.1 | No fix listed |
| rubygems mail(RubyGems) | = 2.4.3 | No fix listed |
| debian/ruby-mail(Debian:12) | < 2.4.4-1 | 2.4.4-1 |
| debian/ruby-mail(Debian:13) | < 2.4.4-1 | 2.4.4-1 |
| debian/ruby-mail(Debian:14) | < 2.4.4-1 | 2.4.4-1 |
| rubygems mail gem | <= 2.4.3 | No fix listed |
| rubygems mail gem | = 2.3.2 | No fix listed |
| rubygems mail gem | = 2.3.3 | No fix listed |
| rubygems mail gem | = 2.4.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit patch
- bugzilla.novell.com
- bugzilla.redhat.com
- FEDORA-2012-7692 vendor-advisory
- FEDORA-2012-7535 vendor-advisory
- FEDORA-2012-7619 vendor-advisory
- [oss-security] 20120425 CVE request: two flaws fixed in rubygem-mail 2.4.4 mailing-list
- [oss-security] 20120425 Re: CVE request: two flaws fixed in rubygem-mail 2.4.4 mailing-list
- github.com
- github.com product
- security-tracker.debian.org vendor-advisory
- 48970 third-party-advisory vendor-advisory