Description
The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a meta file is created.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | open-uri-cached | <= 1.0.0 | — | GHSA-7m2w-9gw7-c3xp |
References
- https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb#L39
- https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb#L115
- https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb#L25
- [oss-security] 20150506 Re: Local privileges escalation in rubygem open-uri-cached mailing-list
- 74469 vdb-entry
- http://www.benjaminfleischer.com/2013/03/20/yaml-and-security-in-ruby/