CVE-2014-0177.yml

---
gem: hub
cve: 2014-0177
ghsa: x5m6-jh4r-34mv
url: https://github.com/mislav/hub/releases/tag/v1.12.1
title: Hub Package Arbitrary File Overwrite
date: 2022-02-15
description: |
  The am function in lib/hub/commands.rb in hub before 1.12.1 allows
  local users to overwrite arbitrary files via a symlink attack
  on a temporary patch file.
cvss_v2: 3.6
cvss_v3: 4.4
patched_versions:
  - ">= 1.12.1"
related:
  url:
    - https://nvd.nist.gov/vuln/detail/CVE-2014-0177
    - https://github.com/mislav/hub/releases/tag/v1.12.1
    - https://www.suse.com/zh-cn/security/cve/CVE-2014-0177.html
    - https://github.com/github/hub/commit/016ec99d25b1cb83cb4367e541177aa431beb600
    - https://github.com/advisories/GHSA-x5m6-jh4r-34mv