VDB
GHSA-6mch-f8jc-rpmr
GHSA-6mch-f8jc-rpmr
PUBLISHED
Record from GitHub Advisory Database · Published May 17, 2022
The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attackers to create files in unexpected locations or with unexpected names via a NUL byte in a file path.
Timeline
- May 17, 2022 CVE Published
- Apr 9, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-6mch-f8jc-rpmr
vulnetix vdb fixes GHSA-6mch-f8jc-rpmrOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-6mch-f8jc-rpmr/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- http://rhn.redhat.com/errata/RHSA-2013-0129.html url
- http://www.openwall.com/lists/oss-security/2012/10/13/1 url
- http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability url
- https://nvd.nist.gov/vuln/detail/CVE-2012-4522 advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090235.html url
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37163 url
- http://www.openwall.com/lists/oss-security/2012/10/12/6 url
- http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090515.html url
- http://www.openwall.com/lists/oss-security/2012/10/16/1 url