lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an
    initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary
    files. (CVE-2017-17042)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6731-1 advisory.

    It was discovered that YARD before 0.9.11 does not block relative paths with an initial ../ sequence,     which allows attackers to conduct directory traversal attacks and read arbitrary files. This issue only     affected Ubuntu 16.04 LTS. (CVE-2017-17042)

    It was discovered that yard before 0.9.20 is affected by a path traversal vulnerability, allowing HTTP     requests to access arbitrary files under certain conditions. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2019-1020001)

    Aviv Keller discovered that the frames.html file within the Yard Doc's generated documentation is     vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the     JavaScript segment of the frames.erb template file. (CVE-2024-27285)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for rubygem-yard fixes the following issues :

  - CVE-2017-17042: The server in YARD did not block     relative paths with an initial ../ sequence, which     allowed attackers to conduct directory traversal attacks     and read arbitrary files (bsc#1070263).

This update was imported from the SUSE:SLE-12-SP1:Update update project.

Fix to directory traversal attacks (CVE-2017-17042).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
423174	SCA: security update for yard (GHSA-gj4p-3wh3-2rmf)	Tenable Cloud Security	SCA Checks	high
423174	SCA: security update for yard (GHSA-gj4p-3wh3-2rmf)	Tenable Self-Hosted Container Security	SCA Checks	high
193337	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : YARD vulnerabilities (USN-6731-1)	Nessus	Ubuntu Local Security Checks	high
110963	openSUSE Security Update : rubygem-yard (openSUSE-2018-707)	Nessus	SuSE Local Security Checks	high
105857	Fedora 27 : rubygem-yard (2017-386e856a4f)	Nessus	Fedora Local Security Checks	high
105207	Fedora 25 : rubygem-yard (2017-ca05b30e86)	Nessus	Fedora Local Security Checks	high
105206	Fedora 26 : rubygem-yard (2017-c6c6e9beae)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-17042

high

Tenable Plugins

high

high

high

high

high

high

high