Fluid Attacks Database

Description

Directory traversal vulnerability in RubyZip The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses ../ pathname substrings to write arbitrary files to the filesystem.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	ruby-zip	>=0 <1.2.0-1.1	1.2.0-1.1
debian 12	ruby-zip	>=0 <1.2.0-1.1	1.2.0-1.1
debian 13	ruby-zip	>=0 <1.2.0-1.1	1.2.0-1.1
debian 11	ruby-zip	>=0 <1.2.0-1.1	1.2.0-1.1
rubygems	rubyzip	>=0 <1.2.1	1.2.1

Aliases

1. CVE-2017-59462. NVD-2017-59463. OSV-DEBIAN-2017-59464. OSV-2017-59465. GCVE-2017-59466. SECURITY-TRACKER-CVE-2017-5946

References

1. https://github.com/rubyzip/rubyzip/issues/3152. https://github.com/rubyzip/rubyzip/commit/ce4208fdecc2ad079b05d3c49d70fe6ed1d070163. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubyzip/CVE-2017-5946.yml4. https://github.com/rubyzip/rubyzip/releases5. https://web.archive.org/web/20200227185727/http://www.securityfocus.com/bid/964456. http://www.debian.org/security/2017/dsa-3801

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.