CVE-2024-28862.yml

---
gem: rotp
cve: 2024-28862
ghsa: x2h8-qmj4-g62f
url: https://github.com/mdp/rotp/security/advisories/GHSA-x2h8-qmj4-g62f
title: ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.
date: 2024-03-18
description: |
  The Ruby One Time Password library (ROTP) is an open source library
  for generating and validating one time passwords. Affected versions
  had overly permissive default permissions. Users should patch to
  version 6.3.0. Users unable to patch may correct file permissions
  after installation.
cvss_v3: 5.3
unaffected_versions:
  - "< 6.2.1"
patched_versions:
  - ">= 6.3.0"
related:
  url:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-28862
    - https://github.com/mdp/rotp/security/advisories/GHSA-x2h8-qmj4-g62f
    - https://github.com/advisories/GHSA-x2h8-qmj4-g62f