Bugzilla – Bug 1021740
VUL-1: CVE-2016-10173: rubygem-minitar,rubygem-archive-tar-minitar: directory traversal vulnerability
Last modified: 2021-01-13 20:20:33 UTC
Ref: http://seclists.org/oss-sec/2017/q1/178 ===================================================== Rubygem minitar allows attackers to overwrite arbitrary files during archive extraction via a .. (dot dot) in an extracted filename. Issue: https://github.com/halostatue/minitar/issues/16 Upstream patch: https://github.com/halostatue/minitar/commit/e25205ecbb6277ae8a3df1e6a306d7ed4458b6e4 The same issue exists in rubygem archive-tar-minitar I believe they're based on the same codebase, and minitar is the officially supported fork, so I'm not sure if this warrants two CVEs or just one. Thanks, -- Max Veytsman Co-founder appcanary.com @mveytsman <https://twitter.com/mveytsman> ===================================================== https://software.opensuse.org/package/rubygem-minitar https://software.opensuse.org/package/ruby2.1-rubygem-minitar https://software.opensuse.org/package/rubygem-archive-tar-minitar https://software.opensuse.org/package/ruby2.1-rubygem-archive-tar-minitar
bugbot adjusting priority
openSUSE:Leap:42.1:Update/rubygem-archive-tar-minitar openSUSE:Leap:42.2:Update/rubygem-archive-tar-minitar openSUSE Leap 42.2 rubygem-minitar
Created attachment 711945 [details] proposed patch Minimal patch for version 0.5.2 (rubygem-archive-tar-minitar) and for version 0.5.4 (rubygem-minitar)
assigning to security team. All requests have been submitted.
This is an autogenerated message for OBS integration: This bug (1021740) was mentioned in https://build.opensuse.org/request/show/453014 42.1+42.2 / rubygem-archive-tar-minitar
CVE Assignment Team: "Use CVE-2016-10173 for both minitar and archive-tar-minitar".
This is an autogenerated message for OBS integration: This bug (1021740) was mentioned in https://build.opensuse.org/request/show/453406 42.2 / rubygem-minitar https://build.opensuse.org/request/show/453408 42.1+42.2 / rubygem-archive-tar-minitar
openSUSE-SU-2017:0429-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1021740 CVE References: CVE-2016-10173 Sources used: openSUSE Leap 42.2 (src): rubygem-minitar-0.5.4-3.1
Closing the bug as the SRs have been accepted.
Not yet fixed in openSUSE:Leap:42.3.
The openSUSE Leap 42.3 submission is handled inside SUSE:Maintenance:4085 / SUSE:SLE-12:Update that is currently on hold.
released, leap 42.3 is eol
SUSE-SU-2021:0115-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1021740 CVE References: CVE-2016-10173 JIRA References: Sources used: SUSE Linux Enterprise Module for Containers 12 (src): rubygem-archive-tar-minitar-0.5.2-7.3.65 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.