Vulnerability Name:

CVE-2017-17042 (CCN-135697)

Assigned:2017-11-28
Published:2017-11-28
Updated:2017-12-20
Summary:lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-22
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2017-17042

Source: XF
Type: UNKNOWN
yard-cve201717042-dir-traversal(135697)

Source: CCN
Type: yard GIT Repository
Fixes a potential arbitrary file read vulnerability in yard server

Source: CONFIRM
Type: Patch
https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2017-17042

Vulnerable Configuration:Configuration 1:
  • cpe:/a:yardoc:yard:*:*:*:*:*:*:*:* (Version < 0.9.11)

    • Configuration CCN 1:
  • cpe:/a:yardoc:yard:0.8.7.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:201717042
    V
    		CVE-2017-17042
    2023-06-22
    oval:org.opensuse.security:def:7838
    P
    		yast2-buildtools-4.5.5-150500.1.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:594
    P
    		Security update for python-M2Crypto (Important)
    2022-07-22
    oval:org.opensuse.security:def:3232
    P
    		libplist3-1.12-20.3.2 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94862
    P
    		yast2-buildtools-4.4.2-150400.1.4 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:341
    P
    		yast2-buildtools-4.2.7-1.31 on GA media (Moderate)
    2022-06-13
    oval:org.opensuse.security:def:922
    P
    		Security update for log4j12 (Important)
    2022-01-28
    oval:org.opensuse.security:def:113614
    P
    		yast2-buildtools-4.4.1-1.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:70014
    P
    		Security update for java-1_8_0-ibm (Important) (in QA)
    2022-01-04
    oval:org.opensuse.security:def:10186
    P
    		Security update for the Linux Kernel (Important)
    2021-12-07
    oval:org.opensuse.security:def:100691
    P
    		 (Moderate)
    2021-12-06
    oval:org.opensuse.security:def:10704
    P
    		Security update for the Linux Kernel (Important)
    2021-12-06
    oval:org.opensuse.security:def:93978
    P
    		 (Important)
    2021-10-20
    oval:org.opensuse.security:def:10164
    P
    		Security update for strongswan (Moderate)
    2021-10-19
    oval:org.opensuse.security:def:1270
    P
    		Security update for the Linux Kernel (Live Patch 4 for SLE 15 SP3) (Important)
    2021-10-12
    oval:org.opensuse.security:def:11137
    P
    		Security update for chromium (Important)
    2021-10-11
    oval:org.opensuse.security:def:106996
    P
    		yast2-buildtools-4.4.1-1.2 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:10156
    P
    		Security update for libqt5-qtbase (Important)
    2021-09-30
    oval:org.opensuse.security:def:103493
    P
    		yast2-buildtools-4.1.2-5.18 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:89838
    P
    		yast2-buildtools-4.1.2-5.18 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61683
    P
    		yast2-buildtools-4.1.2-5.18 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:71194
    P
    		glibc-32bit-2.26-8.21 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:71424
    P
    		yast2-buildtools-4.1.2-5.18 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:96803
    P
    		yast2-buildtools-4.1.2-5.18 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:11115
    P
    		Security update for prosody (Moderate)
    2021-08-21
    oval:org.opensuse.security:def:69909
    P
    		Security update for fetchmail (Moderate)
    2021-08-20
    oval:org.opensuse.security:def:47115
    P
    		p7zip-9.20.1-6.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47816
    P
    		libxslt-tools-1.1.28-16.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48030
    P
    		grub2-2.02-12.15.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:10313
    P
    		Security update for cpio (Important)
    2021-08-16
    oval:org.opensuse.security:def:47116
    P
    		pam-1.1.8-14.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48114
    P
    		libgcab-1_0-0-0.6-1.2 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47130
    P
    		powerpc-utils-1.3.2-17.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47251
    P
    		evince-3.20.1-5.66 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48176
    P
    		libpoppler-glib8-0.43.0-16.15.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47444
    P
    		memcached-1.4.33-3.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48241
    P
    		minicom-2.7-3.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47576
    P
    		coolkey-1.1.0-148.3.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48272
    P
    		pigz-2.3-5.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47668
    P
    		libQt5WebKit5-5.6.2-1.31 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48343
    P
    		xf86-video-intel-2.99.917+git781.c8990575-1.27 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:62359
    P
    		yast2-buildtools-4.2.7-1.31 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:72100
    P
    		yast2-buildtools-4.2.7-1.31 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:101117
    P
    		yast2-buildtools-4.2.7-1.31 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:10294
    P
    		Security update for ovmf (Important)
    2021-06-25
    oval:org.opensuse.security:def:10279
    P
    		Security update for containerd, docker, runc (Important)
    2021-06-11
    oval:org.opensuse.security:def:11431
    P
    		pam_krb5-2.4.4-4.5 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:71081
    P
    		python2-libxml2-python-2.9.7-1.30 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:11453
    P
    		rhythmbox-3.0.2-1.92 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:16651
    P
    		ruby2.1-rubygem-yard-0.8.7.3-7.3.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:124657
    P
    		ruby2.1-rubygem-yard-0.8.7.3-7.3.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:64494
    P
    		Security update for shim (Important)
    2021-05-11
    oval:org.opensuse.security:def:10232
    P
    		Security update for MozillaFirefox (Important)
    2021-04-01
    oval:org.opensuse.security:def:10413
    P
    		Security update for openssl-1_1 (Moderate)
    2021-03-09
    oval:org.opensuse.security:def:10388
    P
    		Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork (Important)
    2021-02-11
    oval:org.opensuse.security:def:49035
    P
    		libserf-1-1-1.3.7-3.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:16967
    P
    		ruby2.1-rubygem-yard-0.8.7.3-7.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:17381
    P
    		python-devel-2.7.13-28.31.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:17373
    P
    		libwmf-0_2-7-0.2.8.4-242.3 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:107357
    P
    		yast2-buildtools-4.2.5-1.45 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:116915
    P
    		yast2-buildtools-4.2.5-1.45 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62011
    P
    		yast2-buildtools-4.2.5-1.45 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:48981
    P
    		doxygen-1.8.6-3.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:71752
    P
    		yast2-buildtools-4.2.5-1.45 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:10502
    P
    		libguestfs-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10464
    P
    		libQt5WebKit-private-headers-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17766
    P
    		Security update for krb5 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:67741
    P
    		libtiff-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10548
    P
    		libssh2-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10477
    P
    		libXtst-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10771
    P
    		libpcp-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:67841
    P
    		yast2-buildtools on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10472
    P
    		libXp-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49309
    P
    		python3-PyYAML on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10595
    P
    		ruby-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17415
    P
    		Security update for the Linux Kernel (Live Patch 27 for SLE 12 SP3) (Important)
    2020-12-01
    oval:org.opensuse.security:def:10780
    P
    		libpulse-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49363
    P
    		yast2-buildtools on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10610
    P
    		xfig on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18495
    P
    		Security update for dpdk-thunderxdpdk (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17500
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:10793
    P
    		libspice-server-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17823
    P
    		Security update for ghostscript-library (Important)
    2020-12-01
    oval:org.opensuse.security:def:10629
    P
    		augeas-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64407
    P
    		libxml2-2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17557
    P
    		Security update for subversion (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73231
    P
    		libtidy5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17835
    P
    		Security update for openslp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17588
    P
    		Security update for postgresql93 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17857
    P
    		Security update for php5 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10729
    P
    		libevent-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18521
    P
    		Security update for rubygem-yard (Important)
    2020-12-01
    oval:org.opensuse.security:def:17624
    P
    		Security update for tidy (Low)
    2020-12-01
    oval:org.opensuse.security:def:66566
    P
    		libzypp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10480
    P
    		libXxf86dga-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10455
    P
    		id3lib on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:66658
    P
    		yast2-buildtools on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17734
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:73349
    P
    		yast2-buildtools on GA media (Moderate)
    2020-12-01
    oval:com.ubuntu.bionic:def:2017170420000000
    V
    		CVE-2017-17042 on Ubuntu 18.04 LTS (bionic) - medium.
    2017-11-28
    oval:com.ubuntu.artful:def:201717042000
    V
    		CVE-2017-17042 on Ubuntu 17.10 (artful) - untriaged.
    2017-11-28
    oval:com.ubuntu.xenial:def:201717042000
    V
    		CVE-2017-17042 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-11-28
    oval:com.ubuntu.xenial:def:2017170420000000
    V
    		CVE-2017-17042 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-11-28
    oval:com.ubuntu.bionic:def:201717042000
    V
    		CVE-2017-17042 on Ubuntu 18.04 LTS (bionic) - medium.
    2017-11-28
    oval:com.ubuntu.disco:def:2017170420000000
    V
    		CVE-2017-17042 on Ubuntu 19.04 (disco) - medium.
    2017-11-28
    oval:com.ubuntu.cosmic:def:201717042000
    V
    		CVE-2017-17042 on Ubuntu 18.10 (cosmic) - medium.
    2017-11-28
    oval:com.ubuntu.cosmic:def:2017170420000000
    V
    		CVE-2017-17042 on Ubuntu 18.10 (cosmic) - medium.
    2017-11-28
    oval:com.ubuntu.trusty:def:201717042000
    V
    		CVE-2017-17042 on Ubuntu 14.04 LTS (trusty) - medium.
    2017-11-28
    BACK
    yardoc yard *
    yardoc yard 0.8.7.3