CVE-2018-1000544 Rubyzip gem contains a Directory Traversal vulnerability in zip file component
Attackers can write arbitrary files to the filesystem via malicious zip uploads, impacting applications using the rubyzip gem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000544?
CVE-2018-1000544 is a critical path traversal vulnerability in Debian Debian Linux, published on 26 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem..
Which versions are affected by CVE-2018-1000544?
2 open source packages ship an affected version, including rubyzip. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
rubyzip RubyGems | All versions | 1.2.2 |
rubyzip RubyGems | All versions | 1.2.2 |
Linux distribution packages (15)
ansible-tower Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:3.2.7-1.el7at |
ansible-tower-server Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:3.2.7-1.el7at |
ansible-tower-setup Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:3.2.7-1.el7at |
ansible-tower-ui Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:3.2.7-1.el7at |
ansible-tower-venv-ansible Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:3.2.7-1.el7at |
ansible-tower-venv-tower Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:3.2.7-1.el7at |
cfme Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.5.3-1.el7cf |
cfme-amazon-smartstate Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.5.3-1.el7cf |
cfme-appliance Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.5.3-1.el7cf |
cfme-appliance-common Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.5.3-1.el7cf |
cfme-appliance-debuginfo Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.5.3-1.el7cf |
cfme-appliance-tools Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.5.3-1.el7cf |
cfme-debuginfo Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.5.3-1.el7cf |
cfme-gemset Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.5.3-1.el7cf |
cfme-gemset-debuginfo Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.5.3-1.el7cf |
Products include Debian Debian Linux, Redhat Cloudforms, Rubyzip Project Rubyzip.
How do I fix CVE-2018-1000544?
Upgrade rubyzip to 1.2.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-1000544 being exploited?
There is no known exploitation of CVE-2018-1000544 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-1000544, DLA-1467-1, DLA-2307-1, GHSA-vqcq-mrmw-mcmg, RHSA-2018:3466, UBUNTU-CVE-2018-1000544.