NetSight
IP …
critical9.1

CVE-2018-8780

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty?

Impact

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.

Affected products

VendorProductAffected versions
Ruby-LangRuby
before 2.2.10
from 2.3.0 before 2.3.7
from 2.4.0 before 2.4.4
from 2.5.0 before 2.5.1
Version 2.6.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 17.10
DebianDebian Linux
Versions 7.0, 8.0, 9.0

Weakness classification

CWE-22

References