Description
The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/github/hub | < 1.12.1 | 1.12.1 | GHSA-x5m6-jh4r-34mv |
| RubyGems | hub | < 1.12.1 | 1.12.1 | GHSA-x5m6-jh4r-34mv |
References
- 58273 third-party-advisory
- https://github.com/github/hub/commit/016ec99d25b1cb83cb4367e541177aa431beb600