CVE-2014-0177 Hub Package Arbitrary File Overwrite
LowCVSS 3.6
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/github/hub(Go) | < 1.12.1 | 1.12.1 |
| rubygems hub(RubyGems) | < 1.12.1 | 1.12.1 |
| rubygems hub(RubyGems) | = 1.10.0 | No fix listed |
| rubygems hub(RubyGems) | = 1.10.1 | No fix listed |
| rubygems hub(RubyGems) | = 1.10.2 | No fix listed |
| rubygems hub(RubyGems) | = 1.10.3 | No fix listed |
| rubygems hub(RubyGems) | = 1.10.4 | No fix listed |
| rubygems hub(RubyGems) | = 1.10.5 | No fix listed |
| rubygems hub(RubyGems) | = 1.10.6 | No fix listed |
| rubygems hub(RubyGems) | = 1.11.0 | No fix listed |
| rubygems hub(RubyGems) | = 1.11.1 | No fix listed |
| rubygems hub(RubyGems) | = 1.11.2 | No fix listed |
| rubygems hub(RubyGems) | = 1.12.0 | No fix listed |
| rubygems hub(RubyGems) | = 1.6.0 | No fix listed |
| rubygems hub(RubyGems) | = 1.6.1 | No fix listed |
| rubygems hub(RubyGems) | = 1.7.0 | No fix listed |
| rubygems hub(RubyGems) | = 1.8.0 | No fix listed |
| rubygems hub(RubyGems) | = 1.8.1 | No fix listed |
| rubygems hub(RubyGems) | = 1.8.2 | No fix listed |
| rubygems hub(RubyGems) | = 1.8.3 | No fix listed |
| rubygems hub(RubyGems) | = 1.8.4 | No fix listed |
| rubygems hub(RubyGems) | = 1.9.0 | No fix listed |
| github.com/github/hub | <= 1.12.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit patch
- github.com patch
- github.com
- github.com exploit
- github.com
- github.com product
- 58273 third-party-advisory url-repurposed