kritisch
CVE-2018-8780
ruby: Unintentional directory traversal by poisoned NULL byte in Dir
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat6.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (mittel), Amazon (mittel), Oracle (mittel), Ubuntu (mittel).
Beschreibung
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.10 | ruby | 2.5.1-r0 |
| alpine 3.11 | ruby | 2.5.1-r0 |
| alpine 3.12 | ruby | 2.5.1-r0 |
| alpine 3.13 | ruby | 2.5.1-r0 |
| alpine 3.14 | ruby | 2.5.1-r0 |
| alpine 3.15 | ruby | 2.5.1-r0 |
| alpine 3.16 | ruby | 2.5.1-r0 |
| alpine 3.17 | ruby | 2.5.1-r0 |
| alpine 3.18 | ruby | 2.5.1-r0 |
| alpine 3.19 | ruby | 2.5.1-r0 |
| alpine 3.20 | ruby | 2.5.1-r0 |
| alpine 3.21 | ruby | 2.5.1-r0 |
Alle 122 Einträge aus 35 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.10 | ruby | 2.5.1-r0 |
| alpine 3.11 | ruby | 2.5.1-r0 |
| alpine 3.12 | ruby | 2.5.1-r0 |
| alpine 3.13 | ruby | 2.5.1-r0 |
| alpine 3.14 | ruby | 2.5.1-r0 |
| alpine 3.15 | ruby | 2.5.1-r0 |
| alpine 3.16 | ruby | 2.5.1-r0 |
| alpine 3.17 | ruby | 2.5.1-r0 |
| alpine 3.18 | ruby | 2.5.1-r0 |
| alpine 3.19 | ruby | 2.5.1-r0 |
| alpine 3.20 | ruby | 2.5.1-r0 |
| alpine 3.21 | ruby | 2.5.1-r0 |
| alpine 3.22 | ruby | 2.5.1-r0 |
| alpine 3.23 | ruby | 2.5.1-r0 |
| alpine 3.24 | ruby | 2.5.1-r0 |
| alpine 3.4 | ruby | 2.3.7-r0 |
| alpine 3.5 | ruby | 2.3.7-r0 |
| alpine 3.6 | ruby | 2.4.4-r0 |
| alpine 3.7 | ruby | 2.4.4-r0 |
| alpine 3.8 | ruby | 2.5.1-r0 |
| alpine 3.9 | ruby | 2.5.1-r0 |
| alpine edge | ruby | 2.5.1-r0 |
| amazon linux 1 | ruby20 | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-debuginfo | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-devel | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-doc | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-irb | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-libs | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby22 | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-debuginfo | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-devel | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-doc | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-irb | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-libs | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby23 | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-debuginfo | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-devel | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-doc | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-irb | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-libs | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby24 | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-debuginfo | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-devel | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-doc | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-irb | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-libs | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | rubygem20-bigdecimal | 1.2.0-1.31.amzn1 |
| amazon linux 1 | rubygem20-io-console | 0.4.2-1.31.amzn1 |
| amazon linux 1 | rubygem20-psych | 2.0.0-1.31.amzn1 |
| amazon linux 1 | rubygem22-bigdecimal | 1.2.6-1.11.amzn1 |
| amazon linux 1 | rubygem22-io-console | 0.4.3-1.11.amzn1 |
| amazon linux 1 | rubygem22-psych | 2.0.8.1-1.11.amzn1 |
| amazon linux 1 | rubygem23-bigdecimal | 1.2.8-1.19.amzn1 |
| amazon linux 1 | rubygem23-did_you_mean | 1.0.0-1.19.amzn1 |
| amazon linux 1 | rubygem23-io-console | 0.4.5-1.19.amzn1 |
| amazon linux 1 | rubygem23-json | 1.8.3.1-1.19.amzn1 |
| amazon linux 1 | rubygem23-psych | 2.1.0.1-1.19.amzn1 |
| amazon linux 1 | rubygem24-bigdecimal | 1.3.2-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-did_you_mean | 1.1.0-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-io-console | 0.4.6-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-json | 2.0.4-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-psych | 2.2.2-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-xmlrpc | 0.2.1-1.30.6.amzn1 |
| amazon linux 1 | rubygems20 | 2.0.14.1-1.31.amzn1 |
| amazon linux 1 | rubygems20-devel | 2.0.14.1-1.31.amzn1 |
| amazon linux 1 | rubygems22 | 2.4.5.2-1.11.amzn1 |
| amazon linux 1 | rubygems22-devel | 2.4.5.2-1.11.amzn1 |
| amazon linux 1 | rubygems23 | 2.5.2.3-1.19.amzn1 |
| amazon linux 1 | rubygems23-devel | 2.5.2.3-1.19.amzn1 |
| amazon linux 1 | rubygems24 | 2.6.14.1-1.30.6.amzn1 |
| amazon linux 1 | rubygems24-devel | 2.6.14.1-1.30.6.amzn1 |
| amazon linux 2 | ruby | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-debuginfo | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-devel | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-doc | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-irb | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-libs | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-tcltk | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | rubygem-bigdecimal | 1.2.0-36.amzn2.0.1 |
| amazon linux 2 | rubygem-io-console | 0.4.2-36.amzn2.0.1 |
| amazon linux 2 | rubygem-json | 1.7.7-36.amzn2.0.1 |
| amazon linux 2 | rubygem-minitest | 4.3.2-36.amzn2.0.1 |
| amazon linux 2 | rubygem-psych | 2.0.0-36.amzn2.0.1 |
| amazon linux 2 | rubygem-rake | 0.9.6-36.amzn2.0.1 |
| amazon linux 2 | rubygem-rdoc | 4.0.0-36.amzn2.0.1 |
| amazon linux 2 | rubygems | 2.0.14.1-36.amzn2.0.1 |
| amazon linux 2 | rubygems-devel | 2.0.14.1-36.amzn2.0.1 |
| debian 7 | ruby1.8 | 1.8.7.358-7.1+deb7u6 |
| debian 7 | ruby1.9.1 | 1.9.3.194-8.1+deb7u8 |
| debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| debian 9 | ruby2.3 | 2.3.3-1+deb9u3 |
| Oracle Linux 7 | ruby | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-devel | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-doc | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-irb | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-libs | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-tcltk | 2.0.0.648-36.el7 |
| Oracle Linux 7 | rubygem-bigdecimal | 1.2.0-36.el7 |
| Oracle Linux 7 | rubygem-io-console | 0.4.2-36.el7 |
| Oracle Linux 7 | rubygem-json | 1.7.7-36.el7 |
| Oracle Linux 7 | rubygem-minitest | 4.3.2-36.el7 |
| Oracle Linux 7 | rubygem-psych | 2.0.0-36.el7 |
| Oracle Linux 7 | rubygem-rake | 0.9.6-36.el7 |
| Oracle Linux 7 | rubygem-rdoc | 4.0.0-36.el7 |
| Oracle Linux 7 | rubygems | 2.0.14.1-36.el7 |
| Oracle Linux 7 | rubygems-devel | 2.0.14.1-36.el7 |
| Red Hat | ruby | kein Fix angegeben |
| Red Hat | ruby-devel | kein Fix angegeben |
| Red Hat | ruby-docs | kein Fix angegeben |
| Red Hat | ruby-irb | kein Fix angegeben |
| Red Hat | ruby-libs | kein Fix angegeben |
| Red Hat | ruby-rdoc | kein Fix angegeben |
| Red Hat | ruby-ri | kein Fix angegeben |
| Red Hat | ruby-static | kein Fix angegeben |
| Red Hat | ruby-tcltk | kein Fix angegeben |
| ubuntu 14.04 | ruby1.9.1 | 1.9.3.484-2ubuntu1.11 |
| ubuntu 14.04 | ruby2.0 | 2.0.0.484-1ubuntu2.9 |
| ubuntu 16.04 | ruby2.3 | 2.3.1-2~16.04.9 |
| ubuntu 16.04-ESM | ruby2.3 | 2.3.1-2~16.04.9 |
| ubuntu 17.10 | ruby2.3 | 2.3.3-1ubuntu1.5 |
| ubuntu 18.04 | ruby2.5 | 2.5.1-1 |
| ubuntu 18.04-ESM | ruby2.5 | 2.5.1-1 |
Referenzen
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
- http://www.securityfocus.com/bid/103739
- http://www.securitytracker.com/id/1042004
- https://access.redhat.com/errata/RHSA-2018:3729
- https://access.redhat.com/errata/RHSA-2018:3730
- https://access.redhat.com/errata/RHSA-2018:3731
- https://access.redhat.com/errata/RHSA-2019:2028
- https://access.redhat.com/errata/RHSA-2020:0542
Alle 28 Referenzen
- https://access.redhat.com/errata/RHSA-2020:0591
- https://access.redhat.com/errata/RHSA-2020:0663
- https://access.redhat.com/security/cve/CVE-2018-8780
- https://github.com/ruby/ruby/commit/143eb22f1877815dd802f7928959c5f93d4c7bb3
- https://github.com/ruby/ruby/commit/bd5661a3cbb38a8c3a3ea10cd76c88bbef7871b8
- https://linux.oracle.com/cve/CVE-2018-8780.html
- https://linux.oracle.com/errata/ELSA-2019-2028.html
- https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
- https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-8780
- https://ubuntu.com/security/notices/USN-3626-1
- https://usn.ubuntu.com/3626-1/
- https://www.cve.org/CVERecord?id=CVE-2018-8780
- https://www.debian.org/security/2018/dsa-4259
- https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/