{"id":"GHSA-26qj-cr27-r5c4","summary":"Octopoller gem published with world-writable files","details":"### Impact\n\nVersion [0.2.0](https://rubygems.org/gems/octopoller/versions/0.2.0) of the octopoller gem was published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). \n\nThis means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. \n\nMalicious code already present and running on your machine, separate from this package, could modify the gem’s files and change its behavior during runtime.\n\n### Patches\n* octopoller 0.3.0\n\n### Workarounds\nUsers can use the previous version of the gem [v0.1.0](https://rubygems.org/gems/octopoller/versions/0.1.0). Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.\n\n","aliases":["CVE-2022-31071"],"modified":"2023-11-01T04:58:56.477988Z","published":"2022-06-15T21:24:14Z","database_specific":{"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2022-06-15T21:24:14Z","nvd_published_at":"2022-06-15T23:15:00Z","cwe_ids":["CWE-276"]},"references":[{"type":"WEB","url":"https://github.com/octokit/octopoller.rb/security/advisories/GHSA-26qj-cr27-r5c4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31071"},{"type":"WEB","url":"https://github.com/octokit/octopoller.rb/commit/abed2b8d05abe2cc3eb6bdfb34e53d465e7c7874"},{"type":"PACKAGE","url":"https://github.com/octokit/octopoller"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/octopoller/CVE-2022-31071.yml"}],"affected":[{"package":{"name":"octopoller","ecosystem":"RubyGems","purl":"pkg:gem/octopoller"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.0"},{"fixed":"0.3.0"}]}],"versions":["0.2.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-26qj-cr27-r5c4/GHSA-26qj-cr27-r5c4.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}]}