GHSA-g982-9r8g-6qxwMediumCVSS 5.5

Ciborg gem for Ruby allows local users to write files and gain privileges via Symlink

Published
July 23, 2018
Last Modified
November 8, 2023

🔗 CVE IDs covered (1)

📋 Description

There is a /tmp file race condition in chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 when creating /tmp/perlbrew-installer. If a malicious local user creates the file first they can overwrite the contents with their own code executing it as the ciborg process owner.

🎯 Affected products1

  • rubygems/ciborg:= 3.0.0

🔗 References (6)