{"id":"GHSA-49pj-69vf-c689","summary":"netaddr before 1.5.3 and 2.0.4 has Incorrect Default Permissions","details":"The netaddr gem before 1.5.3 and 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.","aliases":["CVE-2019-17383"],"modified":"2024-10-23T17:46:12.681757Z","published":"2019-10-14T21:43:19Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2019-10-14T21:39:19Z","nvd_published_at":"2019-10-09T16:15:00Z","cwe_ids":["CWE-276"],"severity":"CRITICAL"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17383"},{"type":"WEB","url":"https://github.com/dspinhirne/netaddr-rb/issues/29"},{"type":"WEB","url":"https://github.com/dspinhirne/netaddr-rb/pull/20"},{"type":"WEB","url":"https://github.com/dspinhirne/netaddr-rb/commit/3aac46c00a36e71905eaa619cb94d45bff6e3b51"},{"type":"WEB","url":"https://github.com/dspinhirne/netaddr-rb/commit/c7a7de39b7e1126aef11821f98970db18582948b"},{"type":"PACKAGE","url":"https://github.com/dspinhirne/netaddr-rb"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/netaddr/CVE-2019-17383.yml"},{"type":"WEB","url":"https://rubygems.org/gems/netaddr/versions"}],"affected":[{"package":{"name":"netaddr","ecosystem":"RubyGems","purl":"pkg:gem/netaddr"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.4"}]}],"versions":["2.0.1","2.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/10/GHSA-49pj-69vf-c689/GHSA-49pj-69vf-c689.json"}},{"package":{"name":"netaddr","ecosystem":"RubyGems","purl":"pkg:gem/netaddr"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3"}]}],"versions":["1.0.0","1.1.0","1.2.0","1.3.0","1.4.0","1.5.0","1.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/10/GHSA-49pj-69vf-c689/GHSA-49pj-69vf-c689.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}