GHSA-x2h8-qmj4-g62f

ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-28862

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	rotp	>= 6.2.1, < 6.3.0	6.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation.

References

External links from the advisory. They lead to third-party sites.

https://github.com/mdp/rotp/security/advisories/GHSA-x2h8-qmj4-g62f web
https://nvd.nist.gov/vuln/detail/CVE-2024-28862 advisory
https://github.com/mdp/rotp package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rotp/CVE-2024-28862.yml web