High, CVSS 7.5RubyGemsPublished
TZInfo relative path traversal vulnerability allows loading of arbitrary files
CVE-2022-31163 · GHSA-5cm2-9h8c-rvfx
- Affected
- RubyGems tzinfo < 0.3.61; >= 1.0.0, < 1.2.10
- Fixed in
- 1.2.100.3.61· Vendor fix available
- Issue
- Impact Affected versions - 0.3.60 and earlier. - 1.0.0 to 1.2.9 when used with the Ruby data source (tzinfo-data). Vulnerability With the Ruby data source (the tzinfo-data gem for tzinfo version 1.0.0 and later and built-in to earlier versions), time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with require on demand. In the affected versions, TZInfo::Timezone.get fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, TZInfo::Timezone.get can be made to load unintended files with require, executing them within the Ruby process. For example, with version 1.2.9, you can run the following to load a file with path /tmp/payload.rb: The exact number of parent directory traversals needed will vary depending on the location of the tzinfo-data gem. TZInfo versions 1.2.6 to 1.2.9 can be made to load files from outside of the Ruby load path. Versions up to and…
Recommended action: Upgrade to 1.2.10 or 0.3.61 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.