CVE-2021-28966
1 advisory.
RubyGems/tmpdir CVE-2021-28966: high 7.5
Tempfile on Windows path traversal vulnerability
Action: Upgrade tmpdir to 0.1.2 or later.
bundle update tmpdirAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.1.2 | - |
Fixed versions
| 0.1.2 |
Sources
- osv: GHSA-46f2-3v63-3xrp
- https://nvd.nist.gov/vuln/detail/CVE-2021-28966
- https://github.com/ruby/tmpdir/pull/8
- https://github.com/ruby/tmpdir/commit/93798c01cb7c10476e50a4d80130a329ba47f348
- https://hackerone.com/reports/1131465
- https://github.com/ruby/tmpdir
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/tmpdir/CVE-2021-28966.yml
- https://rubygems.org/gems/tmpdir
- https://security.netapp.com/advisory/ntap-20210902-0004
- https://www.ruby-lang.org/en/news/2021/04/05/tempfile-path-traversal-on-windows-cve-2021-28966
CVE-2021-28966 · published · modified · JSON