[RUBYSEC:TMPDIR-2021-28966] Path traversal in Tempfile on Windows

Severity High

Affected Packages 1

Fixed Packages 1

CVEs 2

There is an unintentional directory creation vulnerability in tmpdir library
bundled with Ruby on Windows. And there is also an unintentional file
creation vulnerability in tempfile library bundled with Ruby on Windows,
because it uses tmpdir internally.

Package	Affected Version
pkg:gem/tmpdir	< 0.1.2

Package	Fixed Version
pkg:gem/tmpdir	>= 0.1.2

ID

RUBYSEC:TMPDIR-2021-28966

Severity

high

URL

https://www.ruby-lang.org/en/news/2021/04/05/tempfile-path-traversal-on-windows-cve-2021-28966/

Published

2021-04-05T00:00:00
(3 years ago)

Modified

2023-05-03T23:49:55
(16 months ago)

Rights

RubySec Security Team

Other Advisories

Source	# ID	Name	URL
Security Advisory	GHSA-46f2-3v63-3xrp		https://github.com/advisories/GHSA-46f2-3v63-3xrp
			https://www.ruby-lang.org/en/news/2018/03/28/unintentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914/

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Fixed	pkg:gem/tmpdir		tmpdir	>= 0.1.2
Affected	pkg:gem/tmpdir		tmpdir	< 0.1.2

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date