mark-rushakoff/click

Releases7

Frequency15 hours 4 minutes

Last Releaseover 12 years ago

Tool to help track down object leaks in Ruby

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2015-8768NVD↗	all versions	Feb 13, 2017Monday, 13 February 2017, 18:59	—	7.5 HIGH
click/install.py in click does not require files in package filesystem tarballs to start with ./ (dot slash), which allows remote attackers to install an alternate security policy and gain privileges via a crafted package, as demonstrated by the test.mmrow app for Ubuntu phone.