First published: Thu Mar 29 2018(Updated: )
Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the target directory as their parameter. If the parameter contains NUL (\0) bytes, these methods recognize that the path is completed before the NUL bytes. So, if a script accepts an external input as the argument of these methods, the attacker can make the unintentional directory traversal. Affected versions: Ruby 2.2 series: 2.2.9 and earlier Ruby 2.3 series: 2.3.6 and earlier Ruby 2.4 series: 2.4.3 and earlier Ruby 2.5 series: 2.5.0 and earlier External References: <a href="https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/">https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/</a>
Credit: cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Ruby-lang Ruby | <2.2.10 | |
Ruby-lang Ruby | >=2.3.0<2.3.7 | |
Ruby-lang Ruby | >=2.4.0<2.4.4 | |
Ruby-lang Ruby | >=2.5.0<2.5.1 | |
Ruby-lang Ruby | =2.6.0-preview1 | |
Canonical Ubuntu Linux | =14.04 | |
Canonical Ubuntu Linux | =16.04 | |
Canonical Ubuntu Linux | =17.10 | |
Debian Debian Linux | =7.0 | |
Debian Debian Linux | =8.0 | |
Debian Debian Linux | =9.0 | |
Apple macOS Mojave | <10.14.1 | 10.14.1 |
Apple High Sierra | ||
Apple Sierra | ||
Apple macOS High Sierra | <10.13.6 | 10.13.6 |
Apple El Capitan | ||
redhat/ruby | <2.2.10 | 2.2.10 |
redhat/ruby | <2.3.7 | 2.3.7 |
redhat/ruby | <2.4.4 | 2.4.4 |
redhat/ruby | <2.5.1 | 2.5.1 |
debian/ruby1.8 | ||
debian/ruby1.9.1 | ||
debian/ruby2.1 | ||
debian/ruby2.5 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Found alongside the following vulnerabilities)
CVE-2018-8780 is a vulnerability in Ruby that allows for unintended directory traversal.
The severity of CVE-2018-8780 is critical with a CVSS score of 9.1.
Versions before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 are affected by CVE-2018-8780.
To fix CVE-2018-8780, update Ruby to version 2.2.10, 2.3.7, 2.4.4, 2.5.1, or 2.6.0-preview1.
You can find more information about CVE-2018-8780 at the following references: [Link 1](https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/), [Link 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1561957), [Link 3](https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=62989).