Hub Package Arbitrary File Overwrite
Published: February 15, 2022
SECURITY IDENTIFIERS
- CVE: CVE-2014-0177 (NVD)
- GHSA: GHSA-x5m6-jh4r-34mv
- Vendor Advisory: https://github.com/mislav/hub/releases/tag/v1.12.1
GEM
SEVERITY
PATCHED VERSIONS
>= 1.12.1
DESCRIPTION
The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file.