LOW 3.3 RubyGems
RuboCop gem Insecure use of /tmp
GHSA-wmjf-jpjj-9f3j · CVE-2017-8418
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other users.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2017-8418
- WEB https://github.com/bbatsov/rubocop/issues/4336
- WEB https://github.com/rubocop/rubocop/commit/dcb258fabd5f2624c1ea0e1634763094590c09d7
- PACKAGE https://github.com/bbatsov/rubocop
- WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubocop/CVE-2017-8418.yml
- WEB http://www.openwall.com/lists/oss-security/2017/05/01/14
Ready to move
Start Securing
Free, no credit card | First findings in minutes