CVE-2017-8418 RuboCop gem Insecure use of /tmp
LowCVSS 3.3
EPSS 0.41%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other users.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems rubocop(RubyGems) | < 0.49.0 | 0.49.0 |
| rubygems rubocop(RubyGems) | = 0.0.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.1.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.10.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.11.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.11.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.12.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.13.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.13.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.14.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.14.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.15.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.16.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.17.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.18.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.18.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.19.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.19.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.2.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.2.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.20.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.20.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.21.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.22.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.23.0 | No fix listed |
Show 67 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems rubocop(RubyGems) | = 0.24.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.24.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.25.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.26.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.26.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.27.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.27.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.28.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.29.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.29.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.3.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.3.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.3.2 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.30.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.30.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.31.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.32.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.32.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.33.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.34.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.34.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.34.2 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.35.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.35.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.36.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.37.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.37.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.37.2 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.38.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.39.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.4.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.4.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.4.2 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.4.3 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.4.4 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.4.5 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.4.6 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.40.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.41.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.41.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.41.2 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.42.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.43.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.44.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.44.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.45.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.46.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.47.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.47.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.48.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.48.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.5.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.6.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.6.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.7.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.7.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.7.2 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.8.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.8.1 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.8.2 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.8.3 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.9.0 | No fix listed |
| rubygems rubocop(RubyGems) | = 0.9.1 | No fix listed |
| debian/rubocop(Debian:12) | < 0.49.1+dfsg-1 | 0.49.1+dfsg-1 |
| debian/rubocop(Debian:13) | < 0.49.1+dfsg-1 | 0.49.1+dfsg-1 |
| debian/rubocop(Debian:14) | < 0.49.1+dfsg-1 | 0.49.1+dfsg-1 |
| rubocop project rubocop | <= 0.48.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit third-party-advisory
- www.openwall.com exploit mailing-list third-party-advisory
- github.com patch
- github.com exploit
- github.com
- github.com product
- Debian Security Tracker CVE-2017-8418 vendor-advisory
- bugs.debian.org issue-tracking