CVE-2008-1145
NoneCVSS
—
EPSS
27.1%
Published
Mar 4, 2008
CISA due date
—
The record
Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash (\) path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1) "..%5c" (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | kube-fluentd-operator | 0 | 0 |
| Chainguard | kube-fluentd-operator-compat | 0 | 0 |
| Chainguard | kube-fluentd-operator-default-config | 0 | 0 |
| Chainguard | kube-fluentd-operator-oci-entrypoint | 0 | 0 |
| Chainguard | ruby3.2-webrick | 0 | 0 |
| Chainguard | ruby3.3-webrick | 0 | 1.9.1-r0 |
| Chainguard | ruby3.4-webrick | 0 | 1.9.1-r3 |
| Chainguard | ruby4.0-webrick | 0 | 1.9.2-r0 |
| Red Hat:enterprise_linux:4::as | irb | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::as | ruby | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::as | ruby-debuginfo | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::as | ruby-devel | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::as | ruby-docs | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::as | ruby-libs | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::as | ruby-mode | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::as | ruby-tcltk | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::desktop | irb | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::desktop | ruby | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::desktop | ruby-debuginfo | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::desktop | ruby-devel | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::desktop | ruby-docs | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::desktop | ruby-libs | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::desktop | ruby-mode | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::desktop | ruby-tcltk | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::es | irb | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::es | ruby | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::es | ruby-debuginfo | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::es | ruby-devel | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::es | ruby-docs | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::es | ruby-libs | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::es | ruby-mode | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::es | ruby-tcltk | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::ws | irb | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::ws | ruby | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::ws | ruby-debuginfo | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::ws | ruby-devel | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::ws | ruby-docs | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::ws | ruby-libs | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::ws | ruby-mode | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:4::ws | ruby-tcltk | 0 | 0:1.8.1-7.el4_7.1 |
| Red Hat:enterprise_linux:5::client | ruby | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client | ruby-debuginfo | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client | ruby-devel | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client | ruby-docs | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client | ruby-irb | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client | ruby-libs | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client | ruby-mode | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client | ruby-rdoc | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client | ruby-ri | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client | ruby-tcltk | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client_workstation | ruby | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client_workstation | ruby-debuginfo | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client_workstation | ruby-devel | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client_workstation | ruby-docs | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client_workstation | ruby-irb | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client_workstation | ruby-libs | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client_workstation | ruby-mode | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client_workstation | ruby-rdoc | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client_workstation | ruby-ri | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::client_workstation | ruby-tcltk | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::server | ruby | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::server | ruby-debuginfo | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::server | ruby-devel | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::server | ruby-docs | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::server | ruby-irb | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::server | ruby-libs | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::server | ruby-mode | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::server | ruby-rdoc | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::server | ruby-ri | 0 | 0:1.8.5-5.el5_2.5 |
| Red Hat:enterprise_linux:5::server | ruby-tcltk | 0 | 0:1.8.5-5.el5_2.5 |
| Wolfi | kube-fluentd-operator | 0 | 0 |
| Wolfi | kube-fluentd-operator-compat | 0 | 0 |
| Wolfi | kube-fluentd-operator-default-config | 0 | 0 |
| Wolfi | kube-fluentd-operator-oci-entrypoint | 0 | 0 |
| Wolfi | ruby3.2-webrick | 0 | 0 |
| Wolfi | ruby3.3-webrick | 0 | 1.9.1-r0 |
| Wolfi | ruby3.4-webrick | 0 | 1.9.1-r3 |
| Wolfi | ruby4.0-webrick | 0 | 1.9.2-r0 |
Related vulnerabilities
- CVE-2026-33170 Active Support is a toolkit of support libraries and Ruby core extensions extracted from… Also affects kube-fluentd-operator
- CVE-2026-33169 Active Support is a toolkit of support libraries and Ruby core extensions extracted from… Also affects kube-fluentd-operator
- CVE-2026-25500 Rack is a modular Ruby web server interface. Also affects kube-fluentd-operator
- CVE-2026-25765 Faraday is an HTTP client library abstraction layer that provides a common interface over… Also affects kube-fluentd-operator
- CVE-2025-14762 Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write… Also affects kube-fluentd-operator
- CVE-2025-65637 Logrus is vulnerable to DoS when using Entry.Writer() Also affects kube-fluentd-operator
- CVE-2025-61919 Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing Also affects kube-fluentd-operator
- CVE-2025-61780 Rack has a Possible Information Disclosure Vulnerability Also affects kube-fluentd-operator