Arbitrary File Deletion Affecting bundler package, versions >=0.9.2, <1.6.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-BUNDLER-20284
- published 13 Feb 2017
- disclosed 31 Mar 2014
- credit Unknown
Overview
bundler is a dependencies manager.
Affected versions of this gem use the FileUtils.rm_rf function to delete the Bundler tmp folder. This method is vulnerable when:
- One of parent directories or removing directory tree are world writable (including /tmp, whose permission is 1777),
- The current process has root privileges.
- The system has symbolic link.
The fix is to use
FileUtils.remove_entry_secure. See the Ruby Docs for more information.
References
CVSS Scores
version 3.1