CVE-2018-6914: Path Traversal
First published: Thu Mar 29 2018(Updated: )
Dir.mktmpdir method introduced by tmpdir library accepts the prefix and the suffix of the directory which is created as the first parameter. The prefix can contain relative directory specifiers "../", so this method can be used to target any directory. So, if a script accepts an external input as the prefix, and the targeted directory has inappropriate permissions or the ruby process has inappropriate privileges, the attacker can create a directory or a file at any directory. Affected versions: Ruby 2.2 series: 2.2.9 and earlier Ruby 2.3 series: 2.3.6 and earlier Ruby 2.4 series: 2.4.3 and earlier Ruby 2.5 series: 2.5.0 and earlier External References: <a href="https://www.ruby-lang.org/en/news/2018/03/28/unintentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914/">https://www.ruby-lang.org/en/news/2018/03/28/unintentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914/</a>
Credit: CVE-2017-0898 CVE-2017-10784 CVE-2017-14033 CVE-2017-14064 CVE-2017-17405 CVE-2017-17742 CVE-2018-6914 CVE-2018-8777 CVE-2018-8778 CVE-2018-8779 CVE-2018-8780 cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ruby-lang Ruby | >=2.2.0<2.2.10 | |
| Ruby-lang Ruby | >=2.3.0<2.3.7 | |
| Ruby-lang Ruby | >=2.4.0<2.4.4 | |
| Ruby-lang Ruby | >=2.5.0<2.5.1 | |
| Ruby-lang Ruby | =2.6.0-preview1 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =17.10 | |
| Debian Debian Linux | =7.0 | |
| Debian Debian Linux | =8.0 | |
| Debian Debian Linux | =9.0 | |
| Redhat Enterprise Linux | =6.0 | |
| Redhat Enterprise Linux | =7.0 | |
| Redhat Enterprise Linux | =7.4 | |
| Redhat Enterprise Linux | =7.5 | |
| Redhat Enterprise Linux | =7.6 | |
| Apple macOS Mojave | <10.14.1 | 10.14.1 |
| Apple High Sierra | ||
| Apple Sierra | ||
| Apple macOS High Sierra | <10.13.6 | 10.13.6 |
| Apple El Capitan | ||
| redhat/ruby | <2.2.10 | 2.2.10 |
| redhat/ruby | <2.3.7 | 2.3.7 |
| redhat/ruby | <2.4.4 | 2.4.4 |
| redhat/ruby | <2.5.1 | 2.5.1 |
| debian/ruby1.8 | ||
| debian/ruby1.9.1 | ||
| debian/ruby2.1 | ||
| debian/ruby2.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
- http://www.securityfocus.com/bid/103686
- http://www.securitytracker.com/id/1042004
- https://access.redhat.com/errata/RHSA-2018:3729
- https://access.redhat.com/errata/RHSA-2018:3730
- https://access.redhat.com/errata/RHSA-2018:3731
- https://access.redhat.com/errata/RHSA-2019:2028
- https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
- https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://usn.ubuntu.com/3626-1/
- https://www.debian.org/security/2018/dsa-4259
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/
- https://www.ruby-lang.org/en/news/2018/03/28/unintentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914/
- https://launchpad.net/bugs/cve/CVE-2018-6914
- https://support.apple.com/en-us/HT209193 (Advisory)
- https://support.apple.com/en-us/HT208937 (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1561957
- https://access.redhat.com/security/updates/classification/
- https://github.com/ruby/ruby/commit/10b96900b90914b0cc1dba36f9736c038db2859d
- https://github.com/ruby/ruby/commit/e9ddf2ba41a0bffe1047e33576affd48808c5d0b
- https://bugzilla.redhat.com/show_bug.cgi?id=1561947
- https://hackerone.com/reports/302298
- https://security-tracker.debian.org/tracker/CVE-2018-6914
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6914
- https://nvd.nist.gov/vuln/detail/CVE-2018-6914
- https://ubuntu.com/security/CVE-2018-6914
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2018-4295
- CVE-2018-4410
- CVE-2018-4417
- CVE-2017-12613
- CVE-2017-12618
- CVE-2018-4411
- CVE-2018-4308
- CVE-2018-4468
- CVE-2018-4126
- CVE-2018-4415
- CVE-2018-4398
- CVE-2018-4412
- CVE-2018-4153
- CVE-2018-4406
- CVE-2018-4346
- CVE-2018-4403
- CVE-2018-4423
- CVE-2018-3639
- CVE-2018-4342
- CVE-2018-4304
- CVE-2018-4426
- CVE-2018-4331
- CVE-2018-3646
- CVE-2018-4242
- CVE-2018-4394
- CVE-2018-4334
- CVE-2018-4396
- CVE-2018-4418
- CVE-2018-4350
- CVE-2018-4421
- CVE-2018-4422
- CVE-2018-4408
- CVE-2018-4402
- CVE-2018-4341
- CVE-2018-4354
- CVE-2018-4401
- CVE-2018-4371
- CVE-2018-4420
- CVE-2018-4399
- CVE-2018-4340
- CVE-2018-4419
- CVE-2018-4425
- CVE-2018-4259
- CVE-2018-4286
- CVE-2018-4287
- CVE-2018-4288
- CVE-2018-4291
- CVE-2018-4413
- CVE-2018-4407
- CVE-2018-4424
- CVE-2018-4187
- CVE-2018-4348
- CVE-2018-4389
- CVE-2018-4326
- CVE-2018-4310
- CVE-2018-3640
- CVE-2018-4369
- CVE-2018-6797
- CVE-2017-0898
- CVE-2017-10784
- CVE-2017-14033
- CVE-2017-14064
- CVE-2017-17405
- CVE-2017-17742
- CVE-2018-6914
- CVE-2018-8777
- CVE-2018-8778
- CVE-2018-8779
- CVE-2018-8780
- CVE-2018-4400
- CVE-2018-4395
- CVE-2018-4393
- CVE-2018-4203
- CVE-2018-4368
- CVE-2018-4470
- CVE-2018-4289
- CVE-2018-4268
- CVE-2018-4285
- CVE-2018-5383
- CVE-2018-4293
- CVE-2018-4269
- CVE-2018-4276
- CVE-2018-4178
- CVE-2018-4456
- CVE-2018-4283
- CVE-2018-3665
- CVE-2018-4280
- CVE-2018-4248
- CVE-2018-4277
- CVE-2018-6913
- CVE-2018-4274
Frequently Asked Questions
What is the vulnerability ID of this Ruby vulnerability?
The vulnerability ID is CVE-2018-6914.
What is the severity of CVE-2018-6914?
The severity of CVE-2018-6914 is high with a severity value of 7.5.
What is the description of CVE-2018-6914?
CVE-2018-6914 is a directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 that might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.
How can I fix CVE-2018-6914?
To fix CVE-2018-6914, upgrade Ruby to version 2.2.10, 2.3.7, 2.4.4, 2.5.1, or 2.6.0-preview1.
Where can I find more information about CVE-2018-6914?
You can find more information about CVE-2018-6914 at the following references: [link1], [link2], [link3].
- collector/nvd-index
- agent/first-publish-date
- agent/remedy
- collector/launchpad-cve
- source/Launchpad
- agent/type
- collector/apple-support
- alias/CVE-2017-10784
- alias/CVE-2017-14033
- alias/CVE-2017-14064
- alias/CVE-2017-17405
- alias/CVE-2017-17742
- alias/CVE-2018-6914
- alias/CVE-2018-8777
- alias/CVE-2018-8778
- alias/CVE-2018-8779
- alias/CVE-2018-8780
- agent/software-canonical-lookup-request
- agent/author
- agent/weakness
- agent/severity
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- source/Red Hat
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/references
- collector/security-tracker-debian
- source/Debian
- agent/tags
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- vendor/ruby-lang
- canonical/ruby-lang ruby
- version/ruby-lang ruby/2.2.0
- version/ruby-lang ruby/2.3.0
- version/ruby-lang ruby/2.4.0
- version/ruby-lang ruby/2.5.0
- version/ruby-lang ruby/2.6.0-preview1
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/17.10
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/7.0
- version/debian debian linux/8.0
- version/debian debian linux/9.0
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/6.0
- version/redhat enterprise linux/7.0
- version/redhat enterprise linux/7.4
- version/redhat enterprise linux/7.5
- version/redhat enterprise linux/7.6
- vendor/apple
- canonical/apple macos mojave
- canonical/apple high sierra
- canonical/apple sierra
- canonical/apple macos high sierra
- canonical/apple el capitan
- package-manager/redhat
- package-manager/debian