PT-2018-1981 · Ruby+4 · Rubygems+4

David Fifield + 1 · Published 2018-03-13 · Updated 2022-05-14 · CVE-2018-1000078

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RubyGems versions prior to 2.7.6

Description The issue is related to a Cross Site Scripting (XSS) vulnerability in the gem server display of the homepage attribute. This vulnerability can be exploited when a victim browses to a malicious gem on a vulnerable gem server, potentially allowing a remote attacker to cause a denial of service. The vulnerability is related to the homepage attribute.

Recommendations For versions prior to 2.7.6, update to version 2.7.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the gem server to minimize the risk of exploitation. Avoid browsing to untrusted gems on vulnerable gem servers until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2018-01597

CESA-2019_2028

CVE-2018-1000078

DLA-1336-1

DLA-1337-1

DLA-1358-1

DLA-1421-1

DLA-1796-1

DSA-4219-1

DSA-4259-1

GHSA-87QX-G5WG-MWMJ

MGASA-2019-0062

MGASA-2020-0243

OPENSUSE-SU-2019:1771-1

OPENSUSE-SU-2019_1771-1

RHSA-2018:3729

RHSA-2018:3730

RHSA-2018:3731

RHSA-2019:2028

RHSA-2019_2028

RHSA-2020:0542

RHSA-2020:0591

RHSA-2020:0663

SUSE-SU-2019:1804-1

SUSE-SU-2020:1570-1

SUSE-SU-2020_1570-1

USN-3621-1

Affected Products

Centos

Red Hat

Rubygems

Suse

Ubuntu

References · 143

• 🔥 https://github.com/rails-lts/json_cve_2020_10663 · Exploit
• https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb · Patch
• https://access.redhat.com/errata/RHSA-2020:0542 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-1000078 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4219-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000078 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3621-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2019-2028.html · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1421-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3730 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0591 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0663 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0062.html · Security Note
• https://advisories.mageia.org/MGASA-2020-0243.html · Security Note
• https://cve.org/CVERecord?id=CVE-2018-1000078 · Security Note