CVE-2016-10173 archive-tar-minitar and minitar vulnerable to Path Traversal
HighCVSS 7.5
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems archive-tar-minitar(RubyGems) | < 0.5.2 | 0.5.2 |
| rubygems minitar(RubyGems) | < 0.6 | 0.6 |
| rubygems archive-tar-minitar(RubyGems) | = 0.5.1 | No fix listed |
| rubygems minitar(RubyGems) | = 0.5.3 | No fix listed |
| rubygems minitar(RubyGems) | = 0.5.4 | No fix listed |
| debian/ruby-minitar(Debian:12) | < 0.5.4-3.1 | 0.5.4-3.1 |
| debian/ruby-minitar(Debian:13) | < 0.5.4-3.1 | 0.5.4-3.1 |
| debian/ruby-minitar(Debian:14) | < 0.5.4-3.1 | 0.5.4-3.1 |
| minitar archive-tar-minitar | <= 0.5.2 | No fix listed |
| minitar | <= 0.5.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit third-party-advisory
- github.com patch third-party-advisory
- GLSA-201702-32 vendor-advisory
- DSA-3778 vendor-advisory
- [oss-security] 20170124 CVE request: rubygem minitar: directory traversal vulnerability mailing-list patch third-party-advisory
- [oss-security] 20170129 Re: CVE request: rubygem minitar: directory traversal vulnerability mailing-list patch third-party-advisory
- web.archive.org
- web.archive.org
- github.com
- github.com product
- Debian Security Tracker CVE-2016-10173 vendor-advisory
- 95874 third-party-advisory vdb-entry
- puppet.com
- bugs.debian.org issue-tracking