CVE-2018-1000544: debian debian_linux Link Following
Vulnerability summary
CVE-2018-1000544 is a critical (CVSS 9.8) Link Following vulnerability in debian debian_linux. EPSS estimates a 4.41% chance of exploitation in the next 30 days, higher than 91.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 26-06-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem..
CVSS metrics
6 scores · 5 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · RubygemsEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.41%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
-0.18 pp
From 4.58% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundRubyzip
Maturity: poc
Weaknesses
CWE · root cause- CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Affected systems
Redhat16 products
- cloudforms4.6
- ansible-tower< 0:3.2.7-1.el7at
- ansible-tower-server< 0:3.2.7-1.el7at
- ansible-tower-setup< 0:3.2.7-1.el7at
- ansible-tower-ui< 0:3.2.7-1.el7at
Debian2 products
- ruby-zip< 1.2.2-1 | < 1.1.6-1+deb8u2 | < 1.2.0-1.1+deb9u1
- debian_linuxEOL8.0 | 9.0
RubyGems1 product
- rubyzip< 1.2.2
Rubyzip_project1 product
- rubyzip≤ 1.2.1
Ubuntu1 product
- ruby-zipAll versions (No fix recorded) | < 1.2.1-1.1~build0.18.04.1
5 vendors · 21 products
References
80 links- access.redhat.com/errata/RHSA-2018:3466Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
lists.debian.org/debian-lts-announce/2018/08/msg00013.htmlMailing ListX Refsource MLISTThird Party AdvisoryWEB- lists.debian.org/debian-lts-announce/2020/08/msg00002.htmlMailing ListX Refsource MLISTThird Party AdvisoryWEB
Show all 80 references
- github.com/rubyzip/rubyzipPACKAGE