Bug 1838281 (CVE-2020-8161)
| Summary: | CVE-2020-8161 rubygem-rack: directory traversal in Rack::Directory | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | akarol, bbuckingham, bcourt, bkearney, bmidwood, btotty, dbecker, dmetzger, gmccullo, gp, gtanzill, hhudgeon, hvyas, jaruga, jfrey, jhardy, jjoyce, jschluet, lhh, lpeer, lzap, mburns, mmccune, mo, nmoumoul, obarenbo, puebele, rchan, rhos-maint, rjerrido, roliveri, ruby-packagers-sig, sclewis, simaishi, slinaber, smallamp, sokeeffe, steve.traylen, strzibny, vondruch, xlecauch |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | rack 2.1.3, rack 2.2.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A directory traversal vulnerability was found in the Rack::Directory app that is bundled with Rack. If certain directories exist in a director managed by the Rack::Directory, this flaw allows an attacker to read the contents of files on the server outside of the root specified in the Rack::Directory initializer. The highest threat from this vulnerability is to confidentiality.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-10-27 14:21:40 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1838282, 1838283, 1839028, 1839042, 1839043, 1839932, 1843958, 1849674 | ||
| Bug Blocks: | 1838284 | ||
|
Description
Guilherme de Almeida Suckevicz
2020-05-20 19:44:24 UTC
Created rubygem-rack tracking bugs for this issue: Affects: epel-all [bug 1838283] Affects: fedora-all [bug 1838282] Upstream patches: https://github.com/rack/rack/commit/dddb7ad18ed79ca6ab06ccc417a169fde451246e https://github.com/rack/rack/commit/775c836bdd25b63340399fea739532d746860a94 https://github.com/rack/rack/issues/1655 https://github.com/rack/rack/commit/e7ba1b0557d3ad97af1ef113bbeb5f27417983fa I ask upstream to provide a new version that includes the security patches. External References: https://groups.google.com/forum/#!msg/rubyonrails-security/IOO1vNZTzPA/Ylzi1UYLAAAJ Statement: Because the following products package the flawed code, but do not use its functionality (Rack::Directory), their impact has been reduced to 'Low': * Red Hat CloudForms * Red Hat OpenStack Platform 13.0 Operational Tools * Red Hat Gluster Storage 3 Red Hat Satellite 6 ships the affected version of RubyGem Rack and is vulnerable to the flaw. However, because attackers require shell access to exploit the vulnerability, Red Hat Product Security has rated this issue as having the security impact of Low for Satellite. A future update might address this issue. This issue has been addressed in the following products: Red Hat Satellite 6.7 for RHEL 8 Via RHSA-2020:4366 https://access.redhat.com/errata/RHSA-2020:4366 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-8161 |