Bug 1172037 - (CVE-2020-8161) VUL-0: CVE-2020-8161: rubygem-rack: directory traversal in Rack:Directory
(CVE-2020-8161)
VUL-0: CVE-2020-8161: rubygem-rack: directory traversal in Rack:Directory
Status: NEW
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/259675/
CVSSv3.1:SUSE:CVE-2020-8161:5.9:(AV:N...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-05-25 06:49 UTC by Robert Frohl
Modified: 2022-09-23 13:24 UTC (History)
6 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2020-05-25 06:49:07 UTC
rh#1838281

There was a possible directory traversal vulnerability in the Rack::Directory app that is bundled with Rack. If certain directories exist in a director that is managed by `Rack::Directory`, an attacker could, using this vulnerability, read the contents of files on the server that were outside of the root specified in the Rack::Directory initializer.

Reference:
https://groups.google.com/forum/#!msg/rubyonrails-security/IOO1vNZTzPA/Ylzi1UYLAAAJ

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1838281
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8161
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-8161.html
Comment 5 Swamp Workflow Management 2020-09-18 13:15:52 UTC
SUSE-SU-2020:2678-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1159548,1172037,1173351
CVE References: CVE-2019-16782,CVE-2020-8161,CVE-2020-8184
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    rubygem-rack-1.6.13-3.8.1
SUSE OpenStack Cloud Crowbar 8 (src):    rubygem-rack-1.6.13-3.8.1
SUSE OpenStack Cloud 7 (src):    rubygem-rack-1.6.13-3.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Petr Gajdos 2022-09-15 15:22:49 UTC
15/rubygem-rack submitted.
Comment 11 Swamp Workflow Management 2022-09-23 13:24:13 UTC
SUSE-SU-2022:3347-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1172037,1173351
CVE References: CVE-2020-8161,CVE-2020-8184
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    rubygem-rack-2.0.8-150000.3.9.1
openSUSE Leap 15.3 (src):    rubygem-rack-2.0.8-150000.3.9.1
SUSE Linux Enterprise High Availability 15-SP4 (src):    rubygem-rack-2.0.8-150000.3.9.1
SUSE Linux Enterprise High Availability 15-SP3 (src):    rubygem-rack-2.0.8-150000.3.9.1
SUSE Linux Enterprise High Availability 15-SP2 (src):    rubygem-rack-2.0.8-150000.3.9.1
SUSE Linux Enterprise High Availability 15-SP1 (src):    rubygem-rack-2.0.8-150000.3.9.1
SUSE Linux Enterprise High Availability 15 (src):    rubygem-rack-2.0.8-150000.3.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.