CVE-2022-31163

highPriorität · verfolgen · 33EPSS 0.024 · 84. PerzentilDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

2.45% (84th) EPSS

CVSS 8.1 · high

Is it mine?

108 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-27

TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source, time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process. Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Versions 2.0.0 and later are not vulnerable. Version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. Applications should ensure that untrusted files are not placed in a directory on the load path. As a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z`.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenrubygem-tzinfo-0:1.2.10-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions how to apply this update, refer to: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html/upgrading_and_updating_red_hat_satellite/index
https://access.redhat.com/errata/RHSA-2022:7242
Behobenrubygem-tzinfo-0:1.2.10-1.el8sat.src as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions how to apply this update, refer to: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html/upgrading_and_updating_red_hat_satellite/index
https://access.redhat.com/errata/RHSA-2022:7242
Behobentfm-rubygem-tzinfo-0:1.2.10-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions how to apply this update, refer to: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html/upgrading_and_updating_red_hat_satellite/index
https://access.redhat.com/errata/RHSA-2022:7242
Behobentfm-rubygem-tzinfo-0:1.2.10-1.el7sat.src as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions how to apply this update, refer to: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html/upgrading_and_updating_red_hat_satellite/index
https://access.redhat.com/errata/RHSA-2022:7242
Workaroundansible-collection-redhat-satellite-0:3.6.0-3.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundansible-collection-redhat-satellite-0:3.6.0-3.el7sat.src as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundansible-collection-redhat-satellite-0:3.6.0-3.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundansible-collection-redhat-satellite-0:3.6.0-3.el8sat.src as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-0:3.1.1.25-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-0:3.1.1.25-1.el7sat.src as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-0:3.1.1.25-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-0:3.1.1.25-1.el8sat.src as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-cli-0:3.1.1.25-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-cli-0:3.1.1.25-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-debug-0:3.1.1.25-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-debug-0:3.1.1.25-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-dynflow-sidekiq-0:3.1.1.25-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-dynflow-sidekiq-0:3.1.1.25-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-ec2-0:3.1.1.25-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-ec2-0:3.1.1.25-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-gce-0:3.1.1.25-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-gce-0:3.1.1.25-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-journald-0:3.1.1.25-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-journald-0:3.1.1.25-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-libvirt-0:3.1.1.25-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-libvirt-0:3.1.1.25-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-openstack-0:3.1.1.25-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-openstack-0:3.1.1.25-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-ovirt-0:3.1.1.25-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-ovirt-0:3.1.1.25-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-postgresql-0:3.1.1.25-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-postgresql-0:3.1.1.25-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-proxy-0:3.1.1.3-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-proxy-0:3.1.1.3-1.el7sat.src as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-proxy-0:3.1.1.3-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-proxy-0:3.1.1.3-1.el8sat.src as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-proxy-journald-0:3.1.1.3-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-proxy-journald-0:3.1.1.3-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-service-0:3.1.1.25-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-service-0:3.1.1.25-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-telemetry-0:3.1.1.25-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-telemetry-0:3.1.1.25-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-vmware-0:3.1.1.25-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundforeman-vmware-0:3.1.1.25-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundrubygem-foreman_maintain-1:1.0.18-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundrubygem-foreman_maintain-1:1.0.18-1.el7sat.src as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundrubygem-foreman_maintain-1:1.0.18-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundrubygem-foreman_maintain-1:1.0.18-1.el8sat.src as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundrubygem-foreman_webhooks-0:2.0.3-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundrubygem-foreman_webhooks-0:2.0.3-1.el8sat.src as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundrubygem-katello-0:4.3.0.50-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundrubygem-katello-0:4.3.0.50-1.el8sat.src as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundrubygem-rack-0:2.2.3.1-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundrubygem-rack-0:2.2.3.1-1.el8sat.src as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundrubygem-smart_proxy_ansible-0:3.3.1-4.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundrubygem-smart_proxy_ansible-0:3.3.1-4.el8sat.src as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundrubygem-tzinfo-0:1.2.10-1.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundrubygem-tzinfo-0:1.2.10-1.el8sat.src as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundsatellite-0:6.11.4-2.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundsatellite-0:6.11.4-2.el7sat.src as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundsatellite-0:6.11.4-2.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundsatellite-0:6.11.4-2.el8sat.src as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundsatellite-capsule-0:6.11.4-2.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundsatellite-capsule-0:6.11.4-2.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundsatellite-cli-0:6.11.4-2.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundsatellite-cli-0:6.11.4-2.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundsatellite-common-0:6.11.4-2.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundsatellite-common-0:6.11.4-2.el8sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 8redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundtfm-rubygem-foreman_webhooks-0:2.0.3-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundtfm-rubygem-foreman_webhooks-0:2.0.3-1.el7sat.src as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundtfm-rubygem-katello-0:4.3.0.50-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundtfm-rubygem-katello-0:4.3.0.50-1.el7sat.src as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundtfm-rubygem-rack-0:2.2.3.1-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundtfm-rubygem-rack-0:2.2.3.1-1.el7sat.src as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundtfm-rubygem-smart_proxy_ansible-0:3.3.1-4.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundtfm-rubygem-smart_proxy_ansible-0:3.3.1-4.el7sat.src as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundtfm-rubygem-tzinfo-0:1.2.10-1.el7sat.noarch as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.
Workaroundtfm-rubygem-tzinfo-0:1.2.10-1.el7sat.src as a component of Red Hat Satellite 6.11 for RHEL 7redhat_csaf
As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.2 · Auswirkung 5.9

v3.17.5highAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · security-advisories@github.comAusnutzbarkeit 1.6 · Auswirkung 5.9

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · OSV

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-22USprimärCWE-22USCWE-22USCWE-22USCWE-23USCWE-23US

betroffene Produkte (108)

Betroffene Produkte und Versionsbereiche.

IBM DB2 on Cloud Pak for Dataalle Versionencert_bundDEcpe:/a:ibm:db2:on_cloud_pak_for_data
IBM QRadar SIEMalle Versionencert_bundDEcpe:/a:ibm:qradar_siem:-
Oracle Linuxalle Versionencert_bundDEcpe:/o:oracle:linux:-
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Atlassian Atlassian Confluence <10.0.2< 10.0.2cert_bundDE
Atlassian Atlassian Confluence <10.1.1< 10.1.1cert_bundDE
Atlassian Atlassian Confluence <8.5.25< 8.5.25cert_bundDE
Atlassian Atlassian Confluence <9.2.7< 9.2.7cert_bundDE
Atlassian Confluence< 10.0.2cert_bundDE
Atlassian Confluence< 10.1.1cert_bundDE
Atlassian Confluence< 8.5.25cert_bundDE
Atlassian Confluence< 9.2.7cert_bundDE
IBM Cognos Analytics< 11.2.4 IF4cert_bundDE
IBM Cognos Analytics< 12.0.4 IF2cert_bundDE
IBM DB2≤ Warehouse <5.1.0cert_bundDE
IBM DB2< 5.1.0cert_bundDE
IBM IBM Cognos Analytics <11.2.4 IF4< 11.2.4 IF4cert_bundDE
IBM IBM Cognos Analytics <12.0.4 IF2< 12.0.4 IF2cert_bundDE
IBM IBM DB2 <5.1.0< 5.1.0cert_bundDE
IBM IBM DB2 Warehouse <5.1.0≤ Warehouse <5.1.0cert_bundDE

20 von 108 angezeigt

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2022:7242Red Hat Security Advisory: Satellite 6.11.4 Async Security Update2022-10-27csaf · redhat_csafUS
Updated Satellite 6.11 packages that fix several bugs are now available for Red Hat Satellite.
WID-SEC-W-2022-1905Red Hat Satellite: Mehrere SchwachstellenDeutsch2022-10-30csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Satellite ausnutzen, um einen Denial of Service Angriff durchzuführen und beliebigen Code auszuführen.
WID-SEC-W-2023-1143Red Hat Satellite: Mehrere SchwachstellenDeutsch2023-05-03csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Satellite ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen oder einen Denial of Service Zustand herbeizuführen.
WID-SEC-W-2025-0001IBM DB2: Mehrere SchwachstellenDeutsch2025-01-01csaf · cert_bundDE
Ein entfernter oder lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 on Cloud Pak for Data ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen.
GHSA-5cm2-9h8c-rvfxTZInfo relative path traversal vulnerability allows loading of arbitrary files2022-07-21ghsa · osvUS
### Impact #### Affected versions - 0.3.60 and earlier. - 1.0.0 to 1.2.9 when used with the Ruby data source (tzinfo-data). #### Vulnerability With the Ruby data source (the tzinfo-data gem for tzinfo version 1.0.0 and later and built-in to earlier versions), time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process. For example, with version 1.2.9, you can run the following to load a file with path `/tmp/payload.rb`: ```ruby TZInfo::Timezone.get("foo\n/../../../../../../../../../../../../../../../../tmp/payload") ``` The exact number of parent directory traversals needed will vary depending on the location of the tzinfo-data gem. TZInfo versions 1.2.6 to 1.2.9 can be made to load files from outside of the Ruby load path. Versions up to and including 1.2.5 can only be made to load files from directories within the load path. This could be exploited in, for example, a Ruby on Rails application using tzinfo version 1.2.9, that allows file uploads and has a time zone selector that accepts arbitrary time zone identifiers. The CVSS score and severity have been set on this basis. Versions 2.0.0 and later are not vulnerable. ### Patches Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers (commit 9eddbb5c0e682736f61d0dd803b6031a5db9eadf for 0.3.x and commit 9905ca93abf7bf3e387bd592406e403cd18334c7 for 1.2.x). Note that version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. For example if `/tmp/upload` was in the load path, then `TZInfo::Timezone.get('foo')` could load a file with path `/tmp/upload/tzinfo/definition/foo.rb`. Applications should ensure that untrusted files are not placed in a directory on the load path. ### Workarounds As a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z`. ### For more information If you have any questions or comments about this advisory: - Open an issue in [the tzinfo repository](https://github.com/tzinfo/tzinfo).

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund redhat_csaf osv NVD CVE.org MITRE

veröffentlicht 2022-07-22geändert 2026-08-04

verwandt (12,525)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-104286US	—OT kritisch	4.57% (92nd)	KEV	2026-10-01
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail…
CVE-2026-93616US	—OT kritisch	91.6% (100th)	KEV	2026-09-22
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
CVE-2026-85706US	—OT kritisch	97.4% (100th)	KEV	2026-09-12
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2…
CVE-2026-66384US	—OT kritisch	0.66% (52nd)	KEV	2026-08-12
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
CVE-2026-59310US	—OT kritisch	2.56% (85th)	KEV	2026-07-30
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

+12520 weitere

Referenzen (29)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan