CVE-2018-1000544

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "dateAssigned": "2018-06-23T00:00:00.000Z", "datePublic": "2018-06-26T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames \"../\" to write arbitrary files to the filesystem.."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-08-01T21:06:08.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/rubyzip/rubyzip/issues/369"}, {"name": "RHSA-2018:3466", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:3466"}, {"name": "[debian-lts-announce] 20180815 [SECURITY] [DLA 1467-1] ruby-zip security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00013.html"}, {"name": "[debian-lts-announce] 20200801 [SECURITY] [DLA 2307-1] ruby-zip security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00002.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "DATE_ASSIGNED": "2018-06-23T11:22:33.063397", "DATE_REQUESTED": "2018-06-15T12:03:17", "ID": "CVE-2018-1000544", "REQUESTER": "tuzovakaoff@gmail.com", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames \"../\" to write arbitrary files to the filesystem.."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/rubyzip/rubyzip/issues/369", "refsource": "MISC", "url": "https://github.com/rubyzip/rubyzip/issues/369"}, {"name": "RHSA-2018:3466", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:3466"}, {"name": "[debian-lts-announce] 20180815 [SECURITY] [DLA 1467-1] ruby-zip security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00013.html"}, {"name": "[debian-lts-announce] 20200801 [SECURITY] [DLA 2307-1] ruby-zip security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00002.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T12:40:47.264Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/rubyzip/rubyzip/issues/369"}, {"name": "RHSA-2018:3466", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:3466"}, {"name": "[debian-lts-announce] 20180815 [SECURITY] [DLA 1467-1] ruby-zip security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00013.html"}, {"name": "[debian-lts-announce] 20200801 [SECURITY] [DLA 2307-1] ruby-zip security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00002.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-1000544", "datePublished": "2018-06-26T16:00:00.000Z", "dateReserved": "2018-06-15T00:00:00.000Z", "dateUpdated": "2024-08-05T12:40:47.264Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rubyzip_project:rubyzip:*:*:*:*:*:*:*:*", "matchCriteriaId": "1F9E6535-FECF-41FF-A6DE-6C88E01C2DC0", "versionEndIncluding": "1.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*", "matchCriteriaId": "67F7263F-113D-4BAE-B8CB-86A61531A2AC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames \"../\" to write arbitrary files to the filesystem.."}, {"lang": "es", "value": "rubyzip gem rubyzip en versiones 1.2.1 y anteriores contiene una vulnerabilidad de salto de directorio en el componente Zip::File que puede resultar en la escritura de archivos arbitrarios en el sistema de archivos. Si un sitio permite la subida de archivos .zip, un atacante puede subir un archivo malicioso que contiene v\u00ednculos simb\u00f3licos o archivos con nombre de ruta absolutos \"../\" para escribir archivos arbitrarios en el sistema de archivos."}], "id": "CVE-2018-1000544", "lastModified": "2026-06-17T01:32:52.857", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-06-26T16:29:02.353", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:3466"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/rubyzip/rubyzip/issues/369"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00013.html"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00002.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:3466"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/rubyzip/rubyzip/issues/369"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00013.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00002.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2018:3466", "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.9::el7", "package": "ansible-tower-0:3.2.7-1.el7at", "product_name": "CloudForms Management Engine 5.9", "release_date": "2018-11-05T00:00:00Z"}, {"advisory": "RHSA-2018:3466", "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.9::el7", "package": "cfme-0:5.9.5.3-1.el7cf", "product_name": "CloudForms Management Engine 5.9", "release_date": "2018-11-05T00:00:00Z"}, {"advisory": "RHSA-2018:3466", "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.9::el7", "package": "cfme-amazon-smartstate-0:5.9.5.3-1.el7cf", "product_name": "CloudForms Management Engine 5.9", "release_date": "2018-11-05T00:00:00Z"}, {"advisory": "RHSA-2018:3466", "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.9::el7", "package": "cfme-appliance-0:5.9.5.3-1.el7cf", "product_name": "CloudForms Management Engine 5.9", "release_date": "2018-11-05T00:00:00Z"}, {"advisory": "RHSA-2018:3466", "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.9::el7", "package": "cfme-gemset-0:5.9.5.3-1.el7cf", "product_name": "CloudForms Management Engine 5.9", "release_date": "2018-11-05T00:00:00Z"}], "bugzilla": {"description": "rubyzip: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file", "id": "1593001", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1593001"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.8", "cvss3_scoring_vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "status": "verified"}, "cwe": "CWE-20->(CWE-22|CWE-59)", "details": ["rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames \"../\" to write arbitrary files to the filesystem..", "A directory and symbolic link traversal flaw was found in the way rubyzip gem extracts zip files. An attacker, with access to a privileged application capable of extracting zip files, could use this flaw to write new files to arbitrary paths, accessible by the aforementioned privileged application."], "name": "CVE-2018-1000544", "package_state": [{"cpe": "cpe:/a:redhat:qci:1.0::el7", "fix_state": "Will not fix", "package_name": "tfm-rubygem-rubyzip", "product_name": "Red Hat Quickstart Cloud Installer 1"}], "public_date": "2018-06-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2018-1000544\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-1000544"], "threat_severity": "Moderate"}

{}