PT-2018-1981 · Ruby+4 · Rubygems+4

David Fifield + 1 · Publicado 2018-03-13 · Atualizado 2022-05-14 · CVE-2018-1000078

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RubyGems versions prior to 2.7.6

Description The issue is related to a Cross Site Scripting (XSS) vulnerability in the gem server display of the homepage attribute. This vulnerability can be exploited when a victim browses to a malicious gem on a vulnerable gem server, potentially allowing a remote attacker to cause a denial of service. The vulnerability is related to the homepage attribute.

Recommendations For versions prior to 2.7.6, update to version 2.7.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the gem server to minimize the risk of exploitation. Avoid browsing to untrusted gems on vulnerable gem servers until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2018-01597

CESA-2019_2028

CVE-2018-1000078

DLA-1336-1

DLA-1337-1

DLA-1358-1

DLA-1421-1

DLA-1796-1

DSA-4219-1

DSA-4259-1

GHSA-87QX-G5WG-MWMJ

MGASA-2019-0062

MGASA-2020-0243

OPENSUSE-SU-2019:1771-1

OPENSUSE-SU-2019_1771-1

RHSA-2018:3729

RHSA-2018:3730

RHSA-2018:3731

RHSA-2019:2028

RHSA-2019_2028

RHSA-2020:0542

RHSA-2020:0591

RHSA-2020:0663

SUSE-SU-2019:1804-1

SUSE-SU-2020:1570-1

SUSE-SU-2020_1570-1

USN-3621-1

Produtos afetados

Centos

Red Hat

Rubygems

Suse

Ubuntu

Referências · 143

• 🔥 https://github.com/rails-lts/json_cve_2020_10663 · Exploit
• https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb · Correção
• https://github.com/rubygems/rubygems/commit/5971b486d4dbb2bad5d3445b3801c456eb0ce183 · Nota
• https://github.com/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7 · Nota
• https://access.redhat.com/errata/RHSA-2020:0542 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-1000078 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4219-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000078 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3621-1 · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2019-2028.html · Aviso do Fabricante
• https://bugzilla.suse.com/1056782 · Nota
• https://bugzilla.suse.com/1130028 · Nota
• https://osv.dev/vulnerability/DLA-1421-1 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:3730 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-0901 · Nota