{"id":"CVE-2016-10173","aliases":["DEBIAN-CVE-2016-10173","DLA-808-1","DSA-3778-1","EUVD-2017-0246","GHSA-h5g2-38x9-4gv3","MGASA-2017-0060","SUSE-SU-2021:0115-1","UBUNTU-CVE-2016-10173","openSUSE-SU-2024:11332-1","openSUSE-SU-2024:11338-1","openSUSE-SU-2024:13163-1","openSUSE-SU-2024:14172-1","openSUSE-SU-2025:15121-1","openSUSE-SU-2026:10354-1"],"status":"published","title":"archive-tar-minitar and minitar vulnerable to Path Traversal","description":"Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04703,"percentile":0.91871,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2017-01-30T00:00:00Z","modified":"2026-10-20T10:47:00Z","fixes":[{"ecosystem":"RubyGems","package":"archive-tar-minitar","fixed_in":["0.5.2"],"sources":["ghsa","osv"]},{"ecosystem":"RubyGems","package":"minitar","fixed_in":["0.6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-minitar","fixed_in":["0.5.4-3.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-minitar","fixed_in":["0.5.4-3.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-minitar","fixed_in":["0.5.4-3.1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"ruby-archive-tar-minitar","fixed_in":["0.5.2-2+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"ruby-archive-tar-minitar","fixed_in":["0.5.2-2+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"ruby-archive-tar-minitar","fixed_in":["0.5.2-14.2.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"rubygem-archive-tar-minitar","fixed_in":["0.5.2-7.3.65"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ruby-archive-tar-minitar","fixed_in":["0.5.2-2+deb8u1build0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"ruby-minitar","fixed_in":["0.5.4-3.1build0.16.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-minitar","fixed_in":["0.9-1.13"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rubygem-minitar","fixed_in":["0.9-1.17","0.9-1.19","0.9-1.21"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"archive-tar-minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-3.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-3.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-3.1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"ruby-archive-tar-minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-2+deb7u1"}]}],"versions":["0.5.2-2"]},{"source":"osv","ecosystem":"Debian:8","package":"ruby-archive-tar-minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-2+deb8u1"}]}],"versions":["0.5.2-2"]},{"source":"osv","ecosystem":"RubyGems","package":"archive-tar-minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}],"versions":["0.5.1"]},{"source":"osv","ecosystem":"RubyGems","package":"minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6"}]}],"versions":["0.5.3","0.5.4"]},{"source":"osv","ecosystem":"Mageia:5","package":"ruby-archive-tar-minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-14.2.mga5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"rubygem-archive-tar-minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-7.3.65"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ruby-archive-tar-minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-2+deb8u1build0.14.04.1"}]}],"versions":["0.5.2-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-3.1build0.16.04.1"}]}],"versions":["0.5.4-2","0.5.4-3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9-1.13"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9-1.17"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9-1.19"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-minitar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9-1.21"}]}]}],"products":[{"vendor":"minitar","product":"archive-tar-minitar"},{"vendor":"minitar","product":"minitar"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2017/01/24/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.gentoo.org/glsa/201702-32","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/95874","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/halostatue/minitar/issues/16","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/01/29/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix","web"]},{"url":"http://www.debian.org/security/2017/dsa-3778","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://puppet.com/security/cve/cve-2016-10173","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://github.com/halostatue/minitar/commit/e25205ecbb6277ae8a3df1e6a306d7ed4458b6e4","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10173","tags":["advisory"]},{"url":"https://web.archive.org/web/20170214020917/http://www.securityfocus.com/bid/95874","tags":["web"]},{"url":"https://web.archive.org/web/20201207111726/https://www.puppet.com/security/cve/cve-2016-10173","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h5g2-38x9-4gv3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-10173","tags":["advisory"]},{"url":"https://github.com/halostatue/minitar","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2017-0060.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20317","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2017/01/29/1","tags":["web"]},{"url":"https://lwn.net/Alerts/713128/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210115-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1021740","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10173","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-10173","tags":["report"]},{"url":"https://bugzilla.opensuse.org/show_bug.cgi?id=1021740","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10173","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-10173","description":"Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.","status":"published","published":"2017-02-01T15:00:00Z","modified":"2024-08-06T03:14:42.017Z","updated_at":"2026-11-02T14:33:31.764001Z"}],"euvd":[{"id":"EUVD-2017-0246","description":"Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.","status":"published","published":"2017-02-01T15:00:00Z","modified":"2024-08-06T03:14:42Z","updated_at":"2026-11-03T02:22:24.206227Z"}],"ghsa":[{"id":"GHSA-h5g2-38x9-4gv3","title":"archive-tar-minitar and minitar vulnerable to Path Traversal","description":"Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a `..` (dot dot) in a TAR archive entry.","status":"published","published":"2017-10-24T18:33:35Z","modified":"2023-09-05T21:02:42Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2016-10173","description":"Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.","status":"published","published":"2017-02-01T15:59:00.177Z","modified":"2026-06-17T00:39:12.56Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:03:35.029632Z"}],"osv":[{"id":"CVE-2016-10173","description":"Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.","status":"published","published":"2017-02-01T15:59:00.177Z","modified":"2026-10-20T10:47:00.975214078Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"DEBIAN-CVE-2016-10173","description":"Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.","status":"published","published":"2017-02-01T15:59:00.177Z","modified":"2026-09-22T07:01:24.348348077Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"GHSA-h5g2-38x9-4gv3","title":"archive-tar-minitar and minitar vulnerable to Path Traversal","description":"Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a `..` (dot dot) in a TAR archive entry.","status":"published","published":"2017-10-24T18:33:35Z","modified":"2024-02-16T08:04:25.59706Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"UBUNTU-CVE-2016-10173","description":"Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.","status":"published","published":"2017-02-01T15:59:00Z","modified":"2025-07-16T08:11:59.011652Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"DLA-808-1","title":"ruby-archive-tar-minitar - security update","status":"published","published":"2017-01-30T00:00:00Z","modified":"2026-03-09T02:11:35.607177Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3778-1","title":"ruby-archive-tar-minitar - security update","status":"published","published":"2017-01-31T00:00:00Z","modified":"2026-03-09T01:20:05.133734Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0060","title":"Updated ruby-archive-tar-minitar packages fix security vulnerability","description":"Directory traversal vulnerability in the minitar before 0.6 and\narchive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write\nto arbitrary files via a .. (dot dot) in a TAR archive entry.\n(CVE-2016-10173)\n\nMoreover the updated packages replace deprecated require_gem by gem to\nmake minitar work.\n","status":"published","published":"2017-02-20T22:19:20Z","modified":"2026-04-16T06:24:49.640878708Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11332-1","title":"ruby2.7-rubygem-archive-tar-minitar-0.5.2-9.23 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-archive-tar-minitar-0.5.2-9.23 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:19:52.156434Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11338-1","title":"ruby2.7-rubygem-minitar-0.9-1.4 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-minitar-0.9-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:01:44.508546Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:13163-1","title":"ruby3.2-rubygem-minitar-0.9-1.13 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-minitar-0.9-1.13 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:54:17.757011Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:14172-1","title":"ruby3.3-rubygem-minitar-0.9-1.17 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-minitar-0.9-1.17 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T03:40:03.753589Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:15121-1","title":"ruby3.4-rubygem-minitar-0.9-1.19 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-minitar-0.9-1.19 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T04:17:02.552231Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10354-1","title":"ruby4.0-rubygem-minitar-0.9-1.21 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-minitar-0.9-1.21 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:44:10.453925Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"SUSE-SU-2021:0115-1","title":"Security update for rubygem-archive-tar-minitar","description":"\nThis update for rubygem-archive-tar-minitar fixes one security issue:\n\n- CVE-2016-10173: Archives with files containing '..' in the extracted filename could have been used to overwrite arbitrary files (bsc#1021740).\n","status":"published","published":"2021-01-13T15:30:38Z","modified":"2026-02-04T03:26:16.541932Z","updated_at":"2026-11-02T15:53:48.690034Z"}]}}