[Secure-testing-team] Bug#856269: ruby-zip: CVE-2017-5946

[Salvatore Bonaccorso]

Source: ruby-zip
Version: 1.1.6-1
Severity: grave
Tags: upstream patch security
Forwarded: https://github.com/rubyzip/rubyzip/issues/315

Hi,

the following vulnerability was published for ruby-zip.

CVE-2017-5946[0]:
| The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a
| directory traversal vulnerability. If a site allows uploading of .zip
| files, an attacker can upload a malicious file that uses "../" pathname
| substrings to write arbitrary files to the filesystem.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-5946
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5946
[1] https://github.com/rubyzip/rubyzip/issues/315

Regards,
Salvatore