CVE-2019-8320

Description

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.

How to fix CVE-2019-8320

To remediate CVE-2019-8320, upgrade the affected package to a fixed version below.

—upgrade to 2.4.6-r0 or later
—upgrade to 9.1.17.0-3 or later
—upgrade to 2.1.5-2+deb8u7 or later
—upgrade to 2.3.3-1+deb9u6 or later
—upgrade to 3.2.0~rc.1-1 or later
—upgrade to 2.7.9 or later

Is CVE-2019-8320 being exploited?

Low — EPSS is 4.2%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

from 0, < 2.4.6-r0
from 0, < 9.1.17.0-3
from 0, < 2.1.5-2+deb8u7
from 0, < 2.3.3-1+deb9u6
from 0, < 3.2.0~rc.1-1
>= 2.7.6, < 2.7.9

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.4	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H