PT-2019-15119 · Ruby · Netaddr

Publicado 2019-10-09 · Atualizado 2022-07-19 · CVE-2019-17383

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions netaddr gem versions prior to 2.0.4 netaddr gem versions prior to 1.5.3

Description The issue is related to misconfigured file permissions in the netaddr gem for Ruby. When a gem is installed, it may result in 0777 permissions in the target filesystem.

Recommendations For versions prior to 1.5.3, update to version 1.5.3 or later. For versions prior to 2.0.4, update to version 2.0.4 or later.

Exploit

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2019-17383

GHSA-49PJ-69VF-C689

Produtos afetados

Netaddr

Referências · 14

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/netaddr/CVE-2019-17383.yml · Exploit
• https://github.com/dspinhirne/netaddr-rb/commit/c7a7de39b7e1126aef11821f98970db18582948b · Nota
• https://github.com/dspinhirne/netaddr-rb · Nota
• https://github.com/dspinhirne/netaddr-rb/pull/20 · Nota
• https://github.com/dspinhirne/netaddr-rb/issues/29 · Nota
• https://github.com/dspinhirne/netaddr-rb/commit/3aac46c00a36e71905eaa619cb94d45bff6e3b51 · Correção
• https://t.me/cvenotify/33421 · Publicação no Telegram
• https://rubygems.org/gems/netaddr/versions · Nota
• https://cve.org/CVERecord?id=CVE-2019-17383 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17383 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-49pj-69vf-c689 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-17383 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-17383 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-17383 · Aviso do Fabricante