{"action":"Upgrade tzinfo to 0.3.61 or later.","affected":[{"fixed":"0.3.61","introduced":"0"},{"fixed":"1.2.10","introduced":"1.0.0"}],"component":"tzinfo","cve_ids":["CVE-2022-31163"],"ecosystem":"RubyGems","epss":0.02449,"exploited":false,"fixed_versions":["0.3.61","1.2.10"],"ghsa_id":"GHSA-5cm2-9h8c-rvfx","id":"tcs_01M5KEGZMFW7WWC7XFC17QBMK3","modified_at":"2023-11-08T04:09:28.342031Z","published_at":"2022-07-21T21:39:29Z","references":["https://osv.dev/vulnerability/GHSA-5cm2-9h8c-rvfx","https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx","https://nvd.nist.gov/vuln/detail/CVE-2022-31163","https://github.com/tzinfo/tzinfo/commit/9905ca93abf7bf3e387bd592406e403cd18334c7","https://github.com/tzinfo/tzinfo/commit/9eddbb5c0e682736f61d0dd803b6031a5db9eadf","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/tzinfo/CVE-2022-31163.yml","https://github.com/tzinfo/tzinfo","https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61","https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10","https://lists.debian.org/debian-lts-announce/2022/08/msg00009.html"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-5cm2-9h8c-rvfx","url":"https://osv.dev/vulnerability/GHSA-5cm2-9h8c-rvfx"}],"summary":"TZInfo relative path traversal vulnerability allows loading of arbitrary files"}