SCA: security update for rubygems-update (GHSA-5x32-c9mf-49cc)

high Tenable Self-Hosted Container Security Plugin ID 422153

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new
directories or touching files (which now include path-checking code for symlinks), it would delete the
target destination. If that destination was hidden behind a symlink, a malicious gem could delete
arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently
gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely
lead to data loss or an unusable system. (CVE-2019-8320)

Plugin Details

Severity: High

ID: 422153

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 3/28/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.04

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 8.8

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:C/A:C

CVSS Score Source: CVE-2019-8320

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/20/2019

Vulnerability Publication Date: 4/11/2019

Reference Information

CVE: CVE-2019-8320

BID: 108682

cwe: CWE-22

Detections

Analytics