Bug 1417578 (CVE-2016-10173) - CVE-2016-10173 rubygem-archive-tar-minitar: Directory traversal during archive extraction
Summary: CVE-2016-10173 rubygem-archive-tar-minitar: Directory traversal during archiv...
Keywords:
Status: CLOSED NEXTRELEASE
Alias: CVE-2016-10173
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1417579 1417580 1436933 1436934
Blocks: 1417581
TreeView+ depends on / blocked
 
Reported: 2017-01-30 10:49 UTC by Andrej Nemec
Modified: 2021-02-17 02:41 UTC (History)
19 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2017-05-10 15:18:52 UTC
Embargoed:

Attachments (Terms of Use)

Description Andrej Nemec 2017-01-30 10:49:55 UTC 
Rubygem minitar allows attackers to overwrite arbitrary files during
archive extraction via a .. (dot dot) in an extracted filename.

Upstream bug:

https://github.com/halostatue/minitar/issues/16

Upstream patch:

https://github.com/halostatue/minitar/commit/e25205ecbb6277ae8a3df1e6a306d7ed4458b6e4

References:

http://seclists.org/oss-sec/2017/q1/178
Comment 1 Andrej Nemec 2017-01-30 10:51:25 UTC 
Created rubygem-archive-tar-minitar tracking bugs for this issue:

Affects: fedora-all [bug 1417579]
Affects: epel-7 [bug 1417580]
Comment 3 Kurt Seifried 2017-05-10 15:17:39 UTC 
Statement:

This issue affects the versions of rubygem-archive-tar-minitar as shipped with Red Hat Satellite 6. Red Hat Product Security has rated this issue as having Moderate security impact. A future update will not address this issue as the software is planned to be removed in a future version of Satellite 6.
Note You need to log in before you can comment on or make changes to this bug.