GHSA-8474-RC7C-WRHP高危已审查已撤回

High severity vulnerability that affects safemode

OSV 1.4.0 · github-reviewed · 修改于 2020-06-17 23:14

发布时间

2018-08-09 06:29

GitHub 审查时间

2020-06-17 23:14

NVD 发布时间

—

源文件

advisories/github-reviewed/2018/08/GHSA-8474-rc7c-wrhp/GHSA-8474-rc7c-wrhp.json

该公告已于 2020-06-17 23:14 撤回

内容仅用于保留外部引用，请不要将其当作仍然有效的安全结论。

公告说明

Withdrawn, accidental duplicate publish.

The safemode rubygem, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.

受影响的软件包

RubyGems

safemode

ECOSYSTEM

引入0修复1.3.3

标识信息

别名 / CVE

无

CWE

无

软件生态

RubyGems

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-8474-rc7c-wrhp",
  "aliases": [],
  "details": "Withdrawn, accidental duplicate publish.\n\nThe safemode rubygem, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.",
  "summary": "High severity vulnerability that affects safemode",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.3"
            }
          ]
        }
      ],
      "package": {
        "name": "safemode",
        "ecosystem": "RubyGems"
      }
    }
  ],
  "modified": "2020-06-17T15:14:40Z",
  "severity": [],
  "published": "2018-08-08T22:29:10Z",
  "withdrawn": "2020-06-17T15:14:40Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7540",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/advisories/GHSA-8474-rc7c-wrhp",
      "type": "ADVISORY"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2020-06-17T15:14:40Z"
  }
}