kritik
CVE-2018-8780
ruby: Unintentional directory traversal by poisoned NULL byte in Dir
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat6.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (orta), Amazon (orta), Oracle (orta), Ubuntu (orta).
Açıklama
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.10 | ruby | 2.5.1-r0 |
| alpine 3.11 | ruby | 2.5.1-r0 |
| alpine 3.12 | ruby | 2.5.1-r0 |
| alpine 3.13 | ruby | 2.5.1-r0 |
| alpine 3.14 | ruby | 2.5.1-r0 |
| alpine 3.15 | ruby | 2.5.1-r0 |
| alpine 3.16 | ruby | 2.5.1-r0 |
| alpine 3.17 | ruby | 2.5.1-r0 |
| alpine 3.18 | ruby | 2.5.1-r0 |
| alpine 3.19 | ruby | 2.5.1-r0 |
| alpine 3.20 | ruby | 2.5.1-r0 |
| alpine 3.21 | ruby | 2.5.1-r0 |
35 kaynaktaki 122 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.10 | ruby | 2.5.1-r0 |
| alpine 3.11 | ruby | 2.5.1-r0 |
| alpine 3.12 | ruby | 2.5.1-r0 |
| alpine 3.13 | ruby | 2.5.1-r0 |
| alpine 3.14 | ruby | 2.5.1-r0 |
| alpine 3.15 | ruby | 2.5.1-r0 |
| alpine 3.16 | ruby | 2.5.1-r0 |
| alpine 3.17 | ruby | 2.5.1-r0 |
| alpine 3.18 | ruby | 2.5.1-r0 |
| alpine 3.19 | ruby | 2.5.1-r0 |
| alpine 3.20 | ruby | 2.5.1-r0 |
| alpine 3.21 | ruby | 2.5.1-r0 |
| alpine 3.22 | ruby | 2.5.1-r0 |
| alpine 3.23 | ruby | 2.5.1-r0 |
| alpine 3.24 | ruby | 2.5.1-r0 |
| alpine 3.4 | ruby | 2.3.7-r0 |
| alpine 3.5 | ruby | 2.3.7-r0 |
| alpine 3.6 | ruby | 2.4.4-r0 |
| alpine 3.7 | ruby | 2.4.4-r0 |
| alpine 3.8 | ruby | 2.5.1-r0 |
| alpine 3.9 | ruby | 2.5.1-r0 |
| alpine edge | ruby | 2.5.1-r0 |
| amazon linux 1 | ruby20 | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-debuginfo | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-devel | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-doc | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-irb | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-libs | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby22 | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-debuginfo | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-devel | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-doc | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-irb | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-libs | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby23 | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-debuginfo | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-devel | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-doc | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-irb | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-libs | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby24 | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-debuginfo | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-devel | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-doc | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-irb | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-libs | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | rubygem20-bigdecimal | 1.2.0-1.31.amzn1 |
| amazon linux 1 | rubygem20-io-console | 0.4.2-1.31.amzn1 |
| amazon linux 1 | rubygem20-psych | 2.0.0-1.31.amzn1 |
| amazon linux 1 | rubygem22-bigdecimal | 1.2.6-1.11.amzn1 |
| amazon linux 1 | rubygem22-io-console | 0.4.3-1.11.amzn1 |
| amazon linux 1 | rubygem22-psych | 2.0.8.1-1.11.amzn1 |
| amazon linux 1 | rubygem23-bigdecimal | 1.2.8-1.19.amzn1 |
| amazon linux 1 | rubygem23-did_you_mean | 1.0.0-1.19.amzn1 |
| amazon linux 1 | rubygem23-io-console | 0.4.5-1.19.amzn1 |
| amazon linux 1 | rubygem23-json | 1.8.3.1-1.19.amzn1 |
| amazon linux 1 | rubygem23-psych | 2.1.0.1-1.19.amzn1 |
| amazon linux 1 | rubygem24-bigdecimal | 1.3.2-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-did_you_mean | 1.1.0-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-io-console | 0.4.6-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-json | 2.0.4-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-psych | 2.2.2-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-xmlrpc | 0.2.1-1.30.6.amzn1 |
| amazon linux 1 | rubygems20 | 2.0.14.1-1.31.amzn1 |
| amazon linux 1 | rubygems20-devel | 2.0.14.1-1.31.amzn1 |
| amazon linux 1 | rubygems22 | 2.4.5.2-1.11.amzn1 |
| amazon linux 1 | rubygems22-devel | 2.4.5.2-1.11.amzn1 |
| amazon linux 1 | rubygems23 | 2.5.2.3-1.19.amzn1 |
| amazon linux 1 | rubygems23-devel | 2.5.2.3-1.19.amzn1 |
| amazon linux 1 | rubygems24 | 2.6.14.1-1.30.6.amzn1 |
| amazon linux 1 | rubygems24-devel | 2.6.14.1-1.30.6.amzn1 |
| amazon linux 2 | ruby | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-debuginfo | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-devel | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-doc | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-irb | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-libs | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-tcltk | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | rubygem-bigdecimal | 1.2.0-36.amzn2.0.1 |
| amazon linux 2 | rubygem-io-console | 0.4.2-36.amzn2.0.1 |
| amazon linux 2 | rubygem-json | 1.7.7-36.amzn2.0.1 |
| amazon linux 2 | rubygem-minitest | 4.3.2-36.amzn2.0.1 |
| amazon linux 2 | rubygem-psych | 2.0.0-36.amzn2.0.1 |
| amazon linux 2 | rubygem-rake | 0.9.6-36.amzn2.0.1 |
| amazon linux 2 | rubygem-rdoc | 4.0.0-36.amzn2.0.1 |
| amazon linux 2 | rubygems | 2.0.14.1-36.amzn2.0.1 |
| amazon linux 2 | rubygems-devel | 2.0.14.1-36.amzn2.0.1 |
| debian 7 | ruby1.8 | 1.8.7.358-7.1+deb7u6 |
| debian 7 | ruby1.9.1 | 1.9.3.194-8.1+deb7u8 |
| debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| debian 9 | ruby2.3 | 2.3.3-1+deb9u3 |
| Oracle Linux 7 | ruby | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-devel | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-doc | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-irb | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-libs | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-tcltk | 2.0.0.648-36.el7 |
| Oracle Linux 7 | rubygem-bigdecimal | 1.2.0-36.el7 |
| Oracle Linux 7 | rubygem-io-console | 0.4.2-36.el7 |
| Oracle Linux 7 | rubygem-json | 1.7.7-36.el7 |
| Oracle Linux 7 | rubygem-minitest | 4.3.2-36.el7 |
| Oracle Linux 7 | rubygem-psych | 2.0.0-36.el7 |
| Oracle Linux 7 | rubygem-rake | 0.9.6-36.el7 |
| Oracle Linux 7 | rubygem-rdoc | 4.0.0-36.el7 |
| Oracle Linux 7 | rubygems | 2.0.14.1-36.el7 |
| Oracle Linux 7 | rubygems-devel | 2.0.14.1-36.el7 |
| Red Hat | ruby | düzeltme belirtilmemiş |
| Red Hat | ruby-devel | düzeltme belirtilmemiş |
| Red Hat | ruby-docs | düzeltme belirtilmemiş |
| Red Hat | ruby-irb | düzeltme belirtilmemiş |
| Red Hat | ruby-libs | düzeltme belirtilmemiş |
| Red Hat | ruby-rdoc | düzeltme belirtilmemiş |
| Red Hat | ruby-ri | düzeltme belirtilmemiş |
| Red Hat | ruby-static | düzeltme belirtilmemiş |
| Red Hat | ruby-tcltk | düzeltme belirtilmemiş |
| ubuntu 14.04 | ruby1.9.1 | 1.9.3.484-2ubuntu1.11 |
| ubuntu 14.04 | ruby2.0 | 2.0.0.484-1ubuntu2.9 |
| ubuntu 16.04 | ruby2.3 | 2.3.1-2~16.04.9 |
| ubuntu 16.04-ESM | ruby2.3 | 2.3.1-2~16.04.9 |
| ubuntu 17.10 | ruby2.3 | 2.3.3-1ubuntu1.5 |
| ubuntu 18.04 | ruby2.5 | 2.5.1-1 |
| ubuntu 18.04-ESM | ruby2.5 | 2.5.1-1 |
Referanslar
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
- http://www.securityfocus.com/bid/103739
- http://www.securitytracker.com/id/1042004
- https://access.redhat.com/errata/RHSA-2018:3729
- https://access.redhat.com/errata/RHSA-2018:3730
- https://access.redhat.com/errata/RHSA-2018:3731
- https://access.redhat.com/errata/RHSA-2019:2028
- https://access.redhat.com/errata/RHSA-2020:0542
28 referansın hepsi
- https://access.redhat.com/errata/RHSA-2020:0591
- https://access.redhat.com/errata/RHSA-2020:0663
- https://access.redhat.com/security/cve/CVE-2018-8780
- https://github.com/ruby/ruby/commit/143eb22f1877815dd802f7928959c5f93d4c7bb3
- https://github.com/ruby/ruby/commit/bd5661a3cbb38a8c3a3ea10cd76c88bbef7871b8
- https://linux.oracle.com/cve/CVE-2018-8780.html
- https://linux.oracle.com/errata/ELSA-2019-2028.html
- https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
- https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-8780
- https://ubuntu.com/security/notices/USN-3626-1
- https://usn.ubuntu.com/3626-1/
- https://www.cve.org/CVERecord?id=CVE-2018-8780
- https://www.debian.org/security/2018/dsa-4259
- https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/