PT-2007-1934 · Ruby · Rubygems

Published 2007-01-24 · Updated 2026-05-04 · CVE-2007-0469

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RubyGems versions prior to 0.9.1

Description The issue concerns the extract files function in installer.rb, which does not check whether files exist before overwriting them. This allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.

Recommendations For RubyGems versions prior to 0.9.1, update to version 0.9.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the extract files function in installer.rb to minimize the risk of exploitation. Avoid using crafted GEM packages until the issue is resolved.

Fix

Related Identifiers

CVE-2007-0469

GHSA-95VX-Q4C2-64GR

Affected Products

Rubygems

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2007-0469 · Security Note
• http://rubyforge.org/frs/shownotes.php?release_id=9074 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-95vx-q4c2-64gr · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_4_sr.html · Vendor Advisory
• https://github.com/rubygems/rubygems · Note
• http://marc.info/?l=full-disclosure&m=116939816621060&w=2 · Note
• http://vupen.com/english/advisories/2007/0295 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31688 · Note
• https://twitter.com/SecureChap/status/2051332432570315001 · Twitter Post
• https://web.archive.org/web/20070210090150/http://rubyforge.org/frs/shownotes.php?group_id=126&release_id=9074 · Note
• https://web.archive.org/web/20201207172116/http://securityfocus.com/archive/1/458128/100/0/threaded · Note
• http://securityfocus.com/archive/1/458128/100/0/threaded · Note