Description

RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

Remediation

References

CVE-2017-0901

Related Vulnerabilities

Microsoft SQL Server Other Vulnerability (CVE-1999-1556)

Jenkins Observable Discrepancy Vulnerability (CVE-2022-34174)

WordPress Plugin verwei.se-WordPress-Twitter Cross-Site Scripting (1.0.2)

WordPress Plugin Portfolio Gallery-Photo Gallery Multiple Unspecified Vulnerabilities (2.0.72)

Joomla Inadequate Encryption Strength Vulnerability (CVE-2011-3629)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities CWE-20 CVE-2017-0901