archive-tar-minitar and minitar vulnerable to Path Traversal (GHSA-h5g2-38x9-4gv3)
Published: 2017-10-24T18:33:35Z
Aliases: CVE-2016-10173
Severity: HIGH · CWE: CWE-22

Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a `..` (dot dot) in a TAR archive entry.

Affected packages:
package: ecosystem: RubyGems
name: archive-tar-minitar
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.5.2
package: ecosystem: RubyGems
name: minitar
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.6