DLA-3866-1 ruby-tzinfo - security update
Published
Unknown
Product
debian/ruby-tzinfo vulnerabilities
3 published CVES affecting debian/ruby-tzinfo, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 3
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unscored
- 2
- CISA KEV
- 0
Latest debian/ruby-tzinfo CVEs
Newest publication first
-
-
DLA-3077-1 ruby-tzinfo - security update
PublishedUnknown -
CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files
PublishedHighCVSS 8.1 EPSS 2.4% PoCTZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.