What is GHSA-wmjf-jpjj-9f3j?

GHSA-wmjf-jpjj-9f3j is a security advisory published by GitHub Security Advisories with Low severity. RuboCop gem Insecure use of /tmp

Which CVE IDs does GHSA-wmjf-jpjj-9f3j cover?

GHSA-wmjf-jpjj-9f3j covers the following CVE IDs: CVE-2017-8418. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wmjf-jpjj-9f3j?

GHSA-wmjf-jpjj-9f3j has a CVSS v3 base score of 3.3, published by GitHub Security Advisories.

Which products are affected by GHSA-wmjf-jpjj-9f3j?

GHSA-wmjf-jpjj-9f3j affects 1 product, including: rubygems/rubocop:\u003c 0.49.0.

GHSA-wmjf-jpjj-9f3jLowCVSS 3.3

RuboCop gem Insecure use of /tmp

Vendor

GitHub Security Advisories

Published

November 15, 2017

Last Modified

August 28, 2023

🔗 CVE IDs covered (1)

CVE-2017-8418 →

📋 Description

RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other users.

🎯 Affected products1

rubygems/rubocop:< 0.49.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2017-8418
https://github.com/bbatsov/rubocop/issues/4336
http://www.openwall.com/lists/oss-security/2017/05/01/14
https://github.com/rubocop/rubocop/commit/dcb258fabd5f2624c1ea0e1634763094590c09d7
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubocop/CVE-2017-8418.yml
https://github.com/advisories/GHSA-wmjf-jpjj-9f3j