Directory Traversal Vulnerability in libzip-ruby
Summary
DLA-846-1: libzip-ruby - security update. Affects libzip-ruby versions < 0.9.4-1+deb7u1. Fixed in 0.9.4-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libzip-ruby is a Ruby module that provides functionality for reading and writing zip files. It is commonly used in Ruby applications to handle zip archives. However, a vulnerability has been discovered in libzip-ruby that allows an attacker to perform directory traversal attacks. By exploiting this flaw, an attacker can overwrite arbitrary files during the extraction of a zip archive by including a '..' (dot dot) in the extracted filename.
Vulnerability Detail
The directory traversal vulnerability in libzip-ruby arises from a failure to properly sanitize user-supplied input. When extracting files from a zip archive, the module does not adequately validate the filenames, allowing an attacker to include relative path traversal sequences. This can lead to the overwriting of arbitrary files on the system, potentially resulting in unauthorized access, data loss, or other malicious activities.
How To Fix
Minimum fixed version
0.9.4-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libzip-rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading to the patched version of libzip-ruby.
Conclusion
In conclusion, the libzip-ruby package is vulnerable to a directory traversal attack that allows an attacker to overwrite arbitrary files during archive extraction. To mitigate this vulnerability, it is crucial to upgrade to version 0.9.4-1+deb7u1 or later. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libzip-ruby →
FAQ
libzip-ruby is a Ruby module that enables reading and writing of zip files in Ruby applications.
A directory traversal vulnerability allows an attacker to access files and directories outside of the intended scope by manipulating file paths.
By exploiting this vulnerability, an attacker can overwrite arbitrary files on the system, potentially leading to unauthorized access, data loss, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will alert you in real-time if any open-source vulnerabilities, including this one, are detected.
You can find further information about Debian LTS security advisories, including how to apply updates and frequently asked questions, on the Debian LTS wiki: https://wiki.debian.org/LTS
