Read the docs
TI-2013-00097 Aliases CVE-2013-0162GHSA-8mvw-22r7-w6fq

The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and…

Priority LOW 11CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Partial · None
Fix status
Partial Red Hat: 6 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-264.

Summary

The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.

Why it matters now

EPSS 0.00371 31st percentileScored 2026-11-07
Fix Partial ruby_parser (RubyGems): 3.1.2Red Hat: 3 advisoriesRed Hat: 6 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—ruby_parser (RubyGems)2.0.2 to before 3.1.23.1.2Patch availableGHSA-8mvw-22r7-w6fq
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • ruby_parser (RubyGems) Vendor— Affected 2.0.2 to before 3.1.2 Fixed in 3.1.2 Patch available GHSA-8mvw-22r7-w6fq

CPE configurations NVD · 29

CPEVersionsRoleVendor
cpe:2.3:a:ryan_davis:ruby_parser:*:*:*:*:*:*:*:*up to 3.1.1VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:2.0.2:*:*:*:*:*:*:*2.0.2VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:2.0.3:*:*:*:*:*:*:*2.0.3VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:2.0.4:*:*:*:*:*:*:*2.0.4VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:2.0.5:*:*:*:*:*:*:*2.0.5VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:2.0.6:*:*:*:*:*:*:*2.0.6VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableRyan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:*:*:*:*:*:*:*:* Versions up to 3.1.1 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:2.0.6:*:*:*:*:*:*:* Versions 2.0.6 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Ryan Davis
Show 19 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ryan_davis:ruby_parser:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:2.3.1:*:*:*:*:*:*:*2.3.1VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a1:*:*:*:*:*:*:*3.0.0.a1VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a2:*:*:*:*:*:*:*3.0.0.a2VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a3:*:*:*:*:*:*:*3.0.0.a3VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a4:*:*:*:*:*:*:*3.0.0.a4VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a5:*:*:*:*:*:*:*3.0.0.a5VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a6:*:*:*:*:*:*:*3.0.0.a6VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a7:*:*:*:*:*:*:*3.0.0.a7VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a8:*:*:*:*:*:*:*3.0.0.a8VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a9:*:*:*:*:*:*:*3.0.0.a9VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a10:*:*:*:*:*:*:*3.0.0.a10VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableRyan Davis
cpe:2.3:a:ryan_davis:ruby_parser:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableRyan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a1:*:*:*:*:*:*:* Versions 3.0.0.a1 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a2:*:*:*:*:*:*:* Versions 3.0.0.a2 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a3:*:*:*:*:*:*:* Versions 3.0.0.a3 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a4:*:*:*:*:*:*:* Versions 3.0.0.a4 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a5:*:*:*:*:*:*:* Versions 3.0.0.a5 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a6:*:*:*:*:*:*:* Versions 3.0.0.a6 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a7:*:*:*:*:*:*:* Versions 3.0.0.a7 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a8:*:*:*:*:*:*:* Versions 3.0.0.a8 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a9:*:*:*:*:*:*:* Versions 3.0.0.a9 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.0.0.a10:*:*:*:*:*:*:* Versions 3.0.0.a10 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·Ryan Davis
  • cpe:2.3:a:ryan_davis:ruby_parser:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Ryan Davis

Remediation

  • Fix · GHSA-8mvw-22r7-w6fq ruby_parser (RubyGems) Fixed in 3.1.2 Advisory →

Red Hat 3 advisories

  • RHSA-2013:0582 Released 2013-02-28 · Red Hat rating Moderate
    Red Hat OpenShift Enterprise 1.1.1 update
    • Red Hat OpenShift Enterprise Infrastructure graphviz-2.26.0-10.el6, graphviz-devel-2.26.0-10.el6, graphviz-doc-2.26.0-10.el6 +42
    • Red Hat OpenShift Enterprise JBoss EAP add-on openshift-origin-cartridge-jbosseap-6.0-1.0.4-1.el6op
    • Red Hat OpenShift Enterprise Node openshift-origin-cartridge-cron-1.4-1.0.3-1.el6op, openshift-origin-cartridge-diy-0.1-1.0.3-1.el6op, openshift-origin-cartridge-haproxy-1.4-1.0.4-1.el6op +46
  • RHSA-2013:0544 Released 2013-02-21 · Red Hat rating Important
    Subscription Asset Manager 1.2 update
    • Red Hat Subscription Asset Manager for RHEL 6 Server apache-commons-codec-1.7-2.el6_3, apache-mime4j-0.6-4_redhat_1.ep6.el6.1, apache-mime4j-javadoc-0.6-4_redhat_1.ep6.el6.1 +33
  • RHSA-2013:0548 Released 2013-02-21 · Red Hat rating Moderate
    CloudForms Common 1.1.2 update
    • CloudForms Cloud Engine for RHEL 6 Server ruby-nokogiri-1.5.0-0.9.beta4.el6cf, rubygem-activesupport-1:3.0.10-10.el6cf, rubygem-delayed_job-2.1.4-3.el6cf +14
    • CloudForms System Engine for RHEL 6 Server ruby-nokogiri-1.5.0-0.9.beta4.el6cf, rubygem-activesupport-1:3.0.10-10.el6cf, rubygem-delayed_job-2.1.4-3.el6cf +10

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 6AffectedNo fix yet
CloudForms Cloud Engine for RHEL 6 ServerFixed RHSA-2013:0548
CloudForms System Engine for RHEL 6 ServerFixed RHSA-2013:0548
Red Hat OpenShift Enterprise InfrastructureFixed RHSA-2013:0582
Red Hat OpenShift Enterprise JBoss EAP add-onFixed RHSA-2013:0582
Red Hat OpenShift Enterprise NodeFixed RHSA-2013:0582
Red Hat Subscription Asset Manager for RHEL 6 ServerFixed RHSA-2013:0544

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-0162
  2. 2026-10-03 Alias added: GHSA-8mvw-22r7-w6fq

References

Patch 1

Advisory 3

Other 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences