MEDIUM
GHSA-m2q3-53fq-7h66
Gollum Exposure of Sensitive Information
Quick fix
GHSA-m2q3-53fq-7h66 — gollum: upgrade to the fixed version with the command below.
bundle update gollumDetails
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-7314[ADVISORY]
- https://github.com/gollum/gollum/issues/1070[WEB]
- https://github.com/gollum/gollum/commit/ce68a88293ce3b18c261312392ad33a88bb69ea1[WEB]
- https://github.com/gollum/gollum[PACKAGE]
- http://jvn.jp/en/jp/JVN27548431/index.html[WEB]
- http://jvndb.jvn.jp/jvndb/JVNDB-2015-000149[WEB]
- http://www.openwall.com/lists/oss-security/2015/09/22/12[WEB]