GHSA-46f2-3v63-3xrp

Tempfile on Windows path traversal vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2021-28966

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	tmpdir	< 0.1.2	0.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

There is an unintentional directory creation vulnerability in `tmpdir` library bundled with Ruby on Windows. And there is also an unintentional file creation vulnerability in tempfile library bundled with Ruby on Windows, because it uses tmpdir internally.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-28966 advisory
https://github.com/ruby/tmpdir/pull/8 web
https://github.com/ruby/tmpdir/commit/93798c01cb7c10476e50a4d80130a329ba47f348 web
https://hackerone.com/reports/1131465 web
https://github.com/ruby/tmpdir package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/tmpdir/CVE-2021-28966.yml web
https://rubygems.org/gems/tmpdir web
https://security.netapp.com/advisory/ntap-20210902-0004 web
https://www.ruby-lang.org/en/news/2021/04/05/tempfile-path-traversal-on-windows-cve-2021-28966 web