Description
Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-minitar | 0.5.4-3.1 | — |
| Debian 13 | ruby-minitar | 0.5.4-3.1 | — |
| Debian 12 | ruby-minitar | 0.5.4-3.1 | — |
| Debian 8 | ruby-archive-tar-minitar | 0.5.2-2+deb8u1 | DSA-3778-1 |
| Debian 7 | ruby-archive-tar-minitar | 0.5.2-2+deb7u1 | DLA-808-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | ruby-minitar | 0.5.4-3.1build0.16.04.1 | — |
| Ubuntu 14.04 LTS | ruby-archive-tar-minitar | 0.5.2-2+deb8u1build0.14.04.1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | rubygem-archive-tar-minitar | 0.5.2-7.3.65 | SUSE-SU-2021:0115-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ruby3.2-rubygem-minitar | 0.9-1.13 | openSUSE-SU-2024:13163-1 |
| openSUSE Tumbleweed | rubygem-minitar | 0.9-1.17 | openSUSE-SU-2026:10354-1, openSUSE-SU-2025:15121-1, openSUSE-SU-2024:14172-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | archive-tar-minitar | < 0.5.2 | 0.5.2 | GHSA-h5g2-38x9-4gv3 |
| RubyGems | minitar | < 0.6 | 0.6 | GHSA-h5g2-38x9-4gv3 |
Advisories 7
- openSUSE-SU-2026:10354-1 ruby4.0-rubygem-minitar-0.9-1.21 on GA media SUSE / openSUSE Security Updates · Mar 14, 2026
- DLA-808-1 ruby-archive-tar-minitar - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3778-1 ruby-archive-tar-minitar - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2025:15121-1 ruby3.4-rubygem-minitar-0.9-1.19 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13163-1 ruby3.2-rubygem-minitar-0.9-1.13 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14172-1 ruby3.3-rubygem-minitar-0.9-1.17 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0115-1 Security update for rubygem-archive-tar-minitar SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20170124 CVE request: rubygem minitar: directory traversal vulnerability mailing-list
- GLSA-201702-32 vendor-advisory
- 95874 vdb-entry
- https://github.com/halostatue/minitar/issues/16
- [oss-security] 20170129 Re: CVE request: rubygem minitar: directory traversal vulnerability mailing-list
- DSA-3778 vendor-advisory
- https://puppet.com/security/cve/cve-2016-10173
- https://github.com/halostatue/minitar/commit/e25205ecbb6277ae8a3df1e6a306d7ed4458b6e4