Insecure Use of /tmp directory Affecting rubocop package, versions <0.49
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
EPSS
0.04% (6th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-RUBOCOP-20447
- published 17 Nov 2017
- disclosed 2 May 2017
- credit Unknown
Introduced: 2 May 2017
CVE-2017-8418 Open this link in a new tabHow to fix?
Upgrade RuboCop to version 0.49 or higher.
Overview
RuboCop is a ruby static code analyzer, based on the community Ruby style guide.
Affected version of the package store cache files in /tmp/$UID/rubocop_cache/. Since there are no ownership checks, a malicious local users could exploit this to tamper with cache files belonging to other users.