CVE-2019-8320: Path Traversal
A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.
Other sources
A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user’s machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.
Upstream patch:
https://bugs.ruby-lang.org/attachments/7669
References:
https://www.ruby-lang.org/en/news/2019/03/05/multiple-vulnerabilities-in-rubygems/ https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-8320?
CVE-2019-8320 is a Directory Traversal vulnerability discovered in RubyGems 2.7.6 through 3.0.2.
How severe is CVE-2019-8320?
CVE-2019-8320 has a severity of 7.4 (High).
How does CVE-2019-8320 affect RubyGems?
CVE-2019-8320 affects RubyGems versions 2.7.6 through 3.0.2.
What is the remedy for CVE-2019-8320 in RubyGems?
The remedy for CVE-2019-8320 in RubyGems is to upgrade to version 3.0.3.
Where can I find more information about CVE-2019-8320?
You can find more information about CVE-2019-8320 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-8320), [RubyGems Blog](https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html), [HackerOne Report](https://hackerone.com/reports/317321).