Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

RubyGems: Malicious Gems Can Write to Unintended Filesystem Locations

CVE-2018-1000079 · published 8 years ago
Summary

RubyGems versions 2.2.9 and earlier, 2.3.6 and earlier, 2.4.3 and earlier, 2.5.0 and earlier are at risk of allowing malicious gems to install themselves in unintended locations on your system. This could lead to security issues if you install a fake or malicious gem. Update to version 2.7.6 or later to fix this issue.

What to do
  • Update jim weirich rubygems-update to version 2.7.6.
  • Update jruby org.jruby:jruby-stdlib to version 9.1.16.0.
Affected software
Ecosystem VendorProductAffected versions
rubygems jim weirich rubygems-update < 2.7.6
Fix: upgrade to 2.7.6
maven jruby org.jruby:jruby-stdlib < 9.1.16.0
Fix: upgrade to 9.1.16.0
– rubygems rubygems <= 2.2.9
<= 2.3.6
<= 2.4.3
<= 2.5.0
cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*
Original advisory text
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contai...
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.5 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published13 Mar 2018
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-8qxg-mff5-j3wc · GHSA
CVE-2018-1000079 · NVD
Track software like this
Free during beta