RuboCop gem Insecure use of /tmp · CVE-2017-8418 · GitHub Advisory Database · GitHub

RuboCop gem Insecure use of /tmp

Low severity GitHub Reviewed Published Nov 15, 2017 to the GitHub Advisory Database • Updated Aug 28, 2023

Package

rubocop (RubyGems)

Affected versions

< 0.49.0

Patched versions

0.49.0

Description

RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other users.

References

Published to the GitHub Advisory Database Nov 15, 2017

Reviewed Jun 16, 2020

Last updated Aug 28, 2023

Severity

Low

3.3

/ 10

CVSS base metrics

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N