Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhod2MtOGc0OS1qOGp4

Ruby_parser-legacy Incorrect Permission Assignment for Critical Resource

The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used, a local user can insert malicious code into the ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.

Permalink: https://github.com/advisories/GHSA-hhwc-8g49-j8jx
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhod2MtOGc0OS1qOGp4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 4 years ago
Updated: 8 months ago

CVSS Score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-hhwc-8g49-j8jx, CVE-2019-18409
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-18409
• https://github.com/zenspider/ruby_parser-legacy/issues/1
• https://brakemanscanner.org/blog/2019/10/14/brakeman-4-dot-7-dot-1-released
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/brakeman/CVE-2019-18409.yml
• https://github.com/advisories/GHSA-hhwc-8g49-j8jx

Repository: https://github.com/zenspider/ruby_parser-legacy
Blast Radius: 5.5

Affected Packages