rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames ../ to write arbitrary files to the filesystem..
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rubyzip | Rubyzip_project | * | 1.2.1 (including) |
| Ruby-zip | Ubuntu | artful | * |
| Ruby-zip | Ubuntu | bionic | * |
| Ruby-zip | Ubuntu | esm-apps/xenial | * |
| Ruby-zip | Ubuntu | upstream | * |
| Ruby-zip | Ubuntu | xenial | * |
| CloudForms Management Engine 5.9 | RedHat | ansible-tower-0:3.2.7-1.el7at | * |
| CloudForms Management Engine 5.9 | RedHat | cfme-0:5.9.5.3-1.el7cf | * |
| CloudForms Management Engine 5.9 | RedHat | cfme-amazon-smartstate-0:5.9.5.3-1.el7cf | * |
| CloudForms Management Engine 5.9 | RedHat | cfme-appliance-0:5.9.5.3-1.el7cf | * |
| CloudForms Management Engine 5.9 | RedHat | cfme-gemset-0:5.9.5.3-1.el7cf | * |