Deze pagina is nog niet vertaald naar uw taal. We werken eraan — de inhoud wordt voorlopig in het Engels weergegeven.
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2011-0995: Privilege Escalation in sqlite3-ruby
Platform
ruby
Component
sqlite3-ruby
Opgelost in
1.2.4
CVE-2011-0995 describes a privilege escalation vulnerability found in the sqlite3-ruby gem. This flaw allows a local attacker to potentially gain elevated privileges due to the use of weak permissions on unspecified files. The vulnerability affects versions of sqlite3-ruby up to and including 1.2.3. A fix is available in version 1.2.4.
Detecteer deze CVE in je project
Upload je Gemfile.lock-bestand en we vertellen je direct of je getroffen bent.
Impact en Aanvalsscenarioswordt vertaald…
The primary impact of CVE-2011-0995 is the potential for local privilege escalation. An attacker with local access to the system can exploit this vulnerability to gain unauthorized access to sensitive data or execute commands with elevated privileges. While the CVSS score is LOW, successful exploitation could compromise the integrity of the system and potentially lead to data breaches or further malicious activity. The specific files affected and the precise vectors for exploitation remain unspecified in the available documentation, making a comprehensive risk assessment challenging.
Uitbuitingscontextwordt vertaald…
CVE-2011-0995 was published in 2017, indicating it has been known for a considerable time. There is no indication of active exploitation campaigns targeting this specific vulnerability. It is not listed on KEV (Known Exploited Vulnerabilities) or EPSS (Emergency Patching Support System). The LOW CVSS score suggests a relatively low probability of exploitation, but the potential for privilege escalation warrants attention.
Dreigingsinformatie
Exploit Status
EPSS
0.04% (11% percentiel)
Getroffen Software
Tijdlijn
- Gepubliceerd
- Gewijzigd
- EPSS bijgewerkt
Mitigatie en Workaroundswordt vertaald…
The recommended mitigation for CVE-2011-0995 is to upgrade the sqlite3-ruby gem to version 1.2.4 or later. If an immediate upgrade is not feasible due to compatibility issues or system downtime constraints, consider implementing stricter file permissions on the affected files (though the specific files are not identified in the CVE). Review system logs for any suspicious activity related to the sqlite3-ruby gem. While no specific WAF or proxy rules are applicable, ensuring robust access controls and limiting local user privileges can reduce the potential impact of this vulnerability.
Hoe te verhelpenwordt vertaald…
Geen officiële patch beschikbaar. Zoek naar tijdelijke oplossingen of monitor updates.
Veelgestelde vragenwordt vertaald…
What is CVE-2011-0995 — Privilege Escalation in sqlite3-ruby?
CVE-2011-0995 is a vulnerability in the sqlite3-ruby gem that allows local users to gain privileges due to weak file permissions. It affects versions up to 1.2.3 and is rated as LOW severity.
Am I affected by CVE-2011-0995 in sqlite3-ruby?
You are affected if you are running SUSE Linux Enterprise (SLE) 11 SP1 and have sqlite3-ruby installed in a version equal to or less than 1.2.3. Check your version using gem list sqlite3-ruby.
How do I fix CVE-2011-0995 in sqlite3-ruby?
Upgrade the sqlite3-ruby gem to version 1.2.4 or later using your system's package manager or gem installation tool. Consult SUSE documentation for specific upgrade instructions.
Is CVE-2011-0995 being actively exploited?
There is no public evidence of active exploitation campaigns targeting CVE-2011-0995. However, the potential for privilege escalation warrants remediation.
Where can I find the official SUSE advisory for CVE-2011-0995?
Refer to the SUSE Security Advisory SUSE-SA-11383 for detailed information and official guidance regarding CVE-2011-0995.
Is jouw project getroffen?
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Detecteer deze CVE in je project
Upload je Gemfile.lock-bestand en we vertellen je direct of je getroffen bent.
Scan nu uw Ruby project — geen account
Upload your Gemfile.lock and get the vulnerability report instantly. No account. Uploading the file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Sleep uw afhankelijkheidsbestand hierheen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...