CVE-2019-18409: Incorrect Permission Assignment for Critical Resource

October 24, 2019 (updated October 30, 2019)

The ruby_parser-legacy (aka legacy) gem for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem (which has a legacy dependency) is used, a local user can insert malicious code into the ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.

References

github.com/zenspider/ruby_parser-legacy/issues/1
nvd.nist.gov/vuln/detail/CVE-2019-18409

Code Behaviors & Features

Detect and mitigate CVE-2019-18409 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →