PT-2014-3519 · Github · Hub

Published 2014-05-27 · Updated 2023-06-06 · CVE-2014-0177

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions hub versions prior to 1.12.1

Description The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file. This is due to a problem in the am function in lib/hub/commands.rb.

Recommendations For versions prior to 1.12.1, update to version 1.12.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the am function in lib/hub/commands.rb to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-377

CWE-310

Related Identifiers

CVE-2014-0177

GHSA-X5M6-JH4R-34MV

Affected Products

Hub

References · 12

• 🔥 https://github.com/github/hub/commit/016ec99d25b1cb83cb4367e541177aa431beb600 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/hub/CVE-2014-0177.yml · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0177 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0177 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-0177 · Security Note
• https://ubuntu.com/security/CVE-2014-0177 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x5m6-jh4r-34mv · Vendor Advisory
• https://github.com/mislav/hub/releases/tag/v1.12.1 · Note
• https://github.com/mislav/hub · Note
• https://github.com/mislav/hub/commit/016ec99d25b1cb83cb4367e541177aa431beb600 · Note
• http://openwall.com/lists/oss-security/2014/05/16 · Note
• http://secunia.com/advisories/58273 · Note