PT-2008-2739 · Ruby+1 · Ruby+1

Published

2008-03-04

·

Updated

2023-08-01

·

CVE-2008-1145

CVSS v2.0

5.0

Medium

VectorAV:N/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions Ruby versions 1.8 before 1.8.5-p115 Ruby versions 1.8.6 before 1.8.6-p114 Ruby versions 1.9 through 1.9.0-1
Description A directory traversal issue exists when running on systems that support backslash () path separators or case-insensitive file names, allowing remote attackers to access arbitrary files via (1) "..%5c" (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option.
Recommendations For Ruby version 1.8 before 1.8.5-p115, update to version 1.8.5-p115 or later. For Ruby version 1.8.6 before 1.8.6-p114, update to version 1.8.6-p114 or later. For Ruby versions 1.9 through 1.9.0-1, update to a version later than 1.9.0-1.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-1145
RHSA-2008:0897
RHSA-2008_0897

Affected Products

Red Hat
Ruby