PT-2018-1153 · Ruby+4 · Rubygems+4

David Fifield + 1 · Published 2018-02-15 · Updated 2022-05-14 · CVE-2018-1000076

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RubyGems versions 2.2.9 and earlier RubyGems versions 2.3.6 and earlier RubyGems versions 2.4.3 and earlier RubyGems versions 2.5.0 and earlier RubyGems prior to trunk revision 62422

Description The issue is related to an Improper Verification of Cryptographic Signature vulnerability in package.rb, which can result in a mis-signed gem being installed. This occurs because the tarball would contain multiple gem signatures. The vulnerability can be exploited by a remote attacker to execute arbitrary code.

Recommendations For RubyGems versions 2.2.9 and earlier, update to a version newer than 2.7.6. For RubyGems versions 2.3.6 and earlier, update to a version newer than 2.7.6. For RubyGems versions 2.4.3 and earlier, update to a version newer than 2.7.6. For RubyGems versions 2.5.0 and earlier, update to a version newer than 2.7.6. For RubyGems prior to trunk revision 62422, update to a version newer than 2.7.6.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

CWE-374

Related Identifiers

BDU:2018-00591

CESA-2019_2028

CVE-2018-1000076

DLA-1336-1

DLA-1337-1

DLA-1358-1

DLA-1421-1

DLA-1796-1

DSA-4219-1

DSA-4259-1

GHSA-MC6J-H948-V2P6

MGASA-2019-0062

MGASA-2020-0243

OPENSUSE-SU-2019:1771-1

OPENSUSE-SU-2019_1771-1

RHSA-2018:3729

RHSA-2018:3730

RHSA-2018:3731

RHSA-2019:2028

RHSA-2019_2028

RHSA-2020:0542

RHSA-2020:0591

RHSA-2020:0663

SUSE-SU-2019:1804-1

SUSE-SU-2020:1570-1

SUSE-SU-2020_1570-1

USN-3621-1

Affected Products

Centos

Red Hat

Rubygems

Suse

Ubuntu

References · 143

• 🔥 https://github.com/rails-lts/json_cve_2020_10663 · Exploit
• https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693 · Patch
• https://advisories.mageia.org/MGASA-2019-0062.html · Security Note
• https://access.redhat.com/errata/RHSA-2020:0542 · Vendor Advisory
• https://debian.org/security/2018/dsa-4219 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2019-2028.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3621-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4219-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0243 · Vendor Advisory
• https://usn.ubuntu.com/3621-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3730 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mc6j-h948-v2p6 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3621-1 · Vendor Advisory