CVE-2017-5946: Path Traversal
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses ../ pathname substrings to write arbitrary files to the filesystem.
Other sources
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/rubyzipto a version that resolves this vulnerability.Fixed in 1.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5946?
CVE-2017-5946 is considered a high-severity vulnerability due to its ability to allow arbitrary file writing via directory traversal.
How do I fix CVE-2017-5946?
To fix CVE-2017-5946, upgrade the rubyzip gem to version 1.2.1 or later.
What is the impact of CVE-2017-5946 on my application?
The impact of CVE-2017-5946 can allow an attacker to overwrite arbitrary files on the filesystem, potentially leading to data loss or compromise.
Which versions of Ruby are affected by CVE-2017-5946?
CVE-2017-5946 affects versions of the rubyzip gem before 1.2.1 irrespective of the Ruby version in use.
Is my operating system affected by CVE-2017-5946?
Yes, users of Debian Linux 8.0 and 9.0 with the vulnerable rubyzip gem installed are affected by CVE-2017-5946.