Uncontrolled Search Path Element Affecting rubygem-bigdecimal package, versions <0:1.4.1-107.module+el8.4.0+20235+1e5b8be3


Severity

Recommended
medium

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.06% (29th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE8-RUBYGEMBIGDECIMAL-2586628
  • published10 Apr 2022
  • disclosed4 Sept 2020

Introduced: 4 Sep 2020

CVE-2019-3881  (opens in a new tab)
CWE-427  (opens in a new tab)

How to fix?

Upgrade Oracle:8 rubygem-bigdecimal to version 0:1.4.1-107.module+el8.4.0+20235+1e5b8be3 or higher.
This issue was patched in ELSA-2021-2588.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rubygem-bigdecimal package and not the rubygem-bigdecimal package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.

CVSS Scores

version 3.1