Medium · 5.5 CVE-2014-5003 EUVD-2018-0272GHSA-g982-9r8g-6qxw

Ciborg gem for Ruby allows local users to write files and gain privileges via Symlink

Published Jan 10, 2018 · Updated Aug 6, 2024 · Assigned by mitre

Description

chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary files and gain privileges via a symlink attack on /tmp/perlbrew-installer.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
RubyGems	ciborg	3.0.0	—	GHSA-g982-9r8g-6qxw

References

[oss-security] 20140717 Re: Vulnerability Report for Ruby Gem codders-dataset-1.3.2.1 (etc.) mailing-list
http://www.vapid.dhs.org/advisories/ciborg-3.0.0.html
[oss-security] 20140707 Vulnerability Report for Ruby Gem ciborg-3.0.0 mailing-list