CVE-2022-31072 Octokit gem published with world-writable files
Local attackers can modify world-writable files in the Octokit gem, potentially altering library behavior or injecting malicious code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31072?
CVE-2022-31072 is a low-severity vulnerability in octokit.rb, published on 15 Jun 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octokit 4.25.0. Two workarounds are available. Users can use the previous version of the gem, v4.22.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.
Weakness: CWE-276
Which versions are affected by CVE-2022-31072?
2 open source packages ship an affected version, including octokit. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
octokit RubyGems | From 4.23.0 | 4.25.0 |
octokit RubyGems | From 4.23.0 | 4.25.0 |
Products include Octokit Project Octokit.
How do I fix CVE-2022-31072?
Upgrade octokit to 4.25.0 or later.
Is CVE-2022-31072 being exploited?
There is no known exploitation of CVE-2022-31072 in the wild and no public exploit code.
Sources
Also known as GHSA-g28x-pgr3-qqx6, UBUNTU-CVE-2022-31072.