CVE-2018-8780 Path traversal in n/a
Attackers can perform directory traversal via Ruby Dir methods due to missing NULL character checks, potentially accessing or modifying unintended files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-8780?
CVE-2018-8780 is a critical path traversal vulnerability in Canonical Ubuntu Linux, published on 3 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.
Weakness: CWE-22
Which versions are affected by CVE-2018-8780?
It affects 3 products.
Products include Canonical Ubuntu Linux, Debian Debian Linux, Ruby-Lang Ruby.
How do I fix CVE-2018-8780?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-8780 being exploited?
There is no known exploitation of CVE-2018-8780 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2018-8780, CLEANSTART-2026-FP65438, GHSA-fphx-j9v2-w2cx, UBUNTU-CVE-2018-8780.