Vulnerability-Lookup

RHSA-2018_3731

Vulnerability from csaf_redhat - Published: 2018-11-29 10:23 - Updated: 2024-11-15 03:07

Summary

Red Hat Security Advisory: rh-ruby25-ruby security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for rh-ruby25-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: rh-ruby25-ruby (2.5.3), rh-ruby25-rubygems (2.7.6), rh-ruby25-rubygem-openssl (2.1.2). (BZ#1650588) Security Fix(es): * ruby: OpenSSL::X509::Name equality check does not work correctly (CVE-2018-16395) * ruby: HTTP response splitting in WEBrick (CVE-2017-17742) * ruby: DoS by large request in WEBrick (CVE-2018-8777) * ruby: Buffer under-read in String#unpack (CVE-2018-8778) * ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) * ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives (CVE-2018-16396) * rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) * rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) * rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) * rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) * rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) * rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) * ruby: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (CVE-2018-6914) * ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket (CVE-2018-8779) * rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2017-17742

It was found that WEBrick did not sanitize headers sent back to clients, resulting in a response-splitting vulnerability. An attacker, able to control the server's headers, could force WEBrick into injecting additional headers to a client.

4.7 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Affected products

Fixed 267 products

Product	Version	Remediation
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-0:2.5.3-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-0:2.5.3-6.el7.src	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-devel-0:2.5.3-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-devel-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-devel-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-devel-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-doc-0:2.5.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-irb-0:2.5.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-libs-0:2.5.3-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-libs-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-libs-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-ruby-libs-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-did_you_mean-0:1.2.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-json-0:2.1.0-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-json-0:2.1.0-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-json-0:2.1.0-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-json-0:2.1.0-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-minitest-0:5.10.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-net-telnet-0:0.1.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-power_assert-0:1.1.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-rake-0:12.3.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-rdoc-0:6.0.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-test-unit-0:3.2.7-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygem-xmlrpc-0:0.3.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygems-0:2.7.6-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-Alt-RHSCL-3.2:rh-ruby25-rubygems-devel-0:2.7.6-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-ruby-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-ruby-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-ruby-0:2.5.3-6.el7.src	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-ruby-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-ruby-devel-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-ruby-devel-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-ruby-devel-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-ruby-doc-0:2.5.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-ruby-irb-0:2.5.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-ruby-libs-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-ruby-libs-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-ruby-libs-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-did_you_mean-0:1.2.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-json-0:2.1.0-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-json-0:2.1.0-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-json-0:2.1.0-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-minitest-0:5.10.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-net-telnet-0:0.1.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-power_assert-0:1.1.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-rake-0:12.3.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-rdoc-0:6.0.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-test-unit-0:3.2.7-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygem-xmlrpc-0:0.3.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygems-0:2.7.6-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.4.Z:rh-ruby25-rubygems-devel-0:2.7.6-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-ruby-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-ruby-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-ruby-0:2.5.3-6.el7.src	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-ruby-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-ruby-devel-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-ruby-devel-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-ruby-devel-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-ruby-doc-0:2.5.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-ruby-irb-0:2.5.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-ruby-libs-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-ruby-libs-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-ruby-libs-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-did_you_mean-0:1.2.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-json-0:2.1.0-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-json-0:2.1.0-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-json-0:2.1.0-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-minitest-0:5.10.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-net-telnet-0:0.1.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-power_assert-0:1.1.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-rake-0:12.3.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-rdoc-0:6.0.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-test-unit-0:3.2.7-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygem-xmlrpc-0:0.3.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygems-0:2.7.6-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.5.Z:rh-ruby25-rubygems-devel-0:2.7.6-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-ruby-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-ruby-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-ruby-0:2.5.3-6.el7.src	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-ruby-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-ruby-devel-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-ruby-devel-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-ruby-devel-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-ruby-doc-0:2.5.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-ruby-irb-0:2.5.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-ruby-libs-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-ruby-libs-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-ruby-libs-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-did_you_mean-0:1.2.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-json-0:2.1.0-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-json-0:2.1.0-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-json-0:2.1.0-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-minitest-0:5.10.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-net-telnet-0:0.1.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-power_assert-0:1.1.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-rake-0:12.3.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-rdoc-0:6.0.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-test-unit-0:3.2.7-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygem-xmlrpc-0:0.3.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygems-0:2.7.6-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2-7.6.Z:rh-ruby25-rubygems-devel-0:2.7.6-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-0:2.5.3-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-0:2.5.3-6.el7.src	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-devel-0:2.5.3-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-devel-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-devel-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-devel-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-doc-0:2.5.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-irb-0:2.5.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-libs-0:2.5.3-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-libs-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-libs-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-ruby-libs-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-did_you_mean-0:1.2.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-json-0:2.1.0-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-json-0:2.1.0-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-json-0:2.1.0-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-json-0:2.1.0-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-minitest-0:5.10.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-net-telnet-0:0.1.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-power_assert-0:1.1.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-rake-0:12.3.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-rdoc-0:6.0.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-test-unit-0:3.2.7-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygem-xmlrpc-0:0.3.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygems-0:2.7.6-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RHSCL-3.2:rh-ruby25-rubygems-devel-0:2.7.6-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-0:2.5.3-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-0:2.5.3-6.el7.src	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-devel-0:2.5.3-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-devel-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-devel-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-devel-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-doc-0:2.5.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-irb-0:2.5.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-libs-0:2.5.3-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-libs-0:2.5.3-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-libs-0:2.5.3-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-ruby-libs-0:2.5.3-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-did_you_mean-0:1.2.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-io-console-0:0.4.6-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-json-0:2.1.0-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-json-0:2.1.0-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-json-0:2.1.0-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-json-0:2.1.0-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-minitest-0:5.10.3-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-net-telnet-0:0.1.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-openssl-0:2.1.2-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-power_assert-0:1.1.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-psych-0:3.0.2-6.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-rake-0:12.3.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-rdoc-0:6.0.1-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-test-unit-0:3.2.7-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygem-xmlrpc-0:0.3.0-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygems-0:2.7.6-6.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RHSCL-3.2:rh-ruby25-rubygems-devel-0:2.7.6-6.el7.noarch	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2018-6914

It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create temporary files and directories outside of the dedicated directory.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 267 products, the same list as for CVE-2017-17742

Threats

Impact Low

CVE-2018-8777

It was found that WEBrick could be forced to use an excessive amount of memory during the processing of HTTP requests, leading to a Denial of Service. An attacker could use this flaw to send huge requests to a WEBrick application, resulting in the server running out of memory.

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 267 products, the same list as for CVE-2017-17742

Threats

Impact Moderate

CVE-2018-8778

A integer underflow was found in the way String#unpack decodes the unpacking format. An attacker, able to control the unpack format, could use this flaw to disclose arbitrary parts of the application's memory.

4.8 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 267 products, the same list as for CVE-2017-17742

Threats

Impact Moderate

CVE-2018-8779

It was found that the UNIXSocket::open and UNIXServer::open ruby methods did not handle the NULL byte properly. An attacker, able to inject NULL bytes in the socket path, could possibly trigger an unspecified behavior of the ruby script.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-626 - Null Byte Interaction Error (Poison Null Byte)

Affected products

Fixed 267 products, the same list as for CVE-2017-17742

Threats

Impact Low

CVE-2018-8780

It was found that the methods from the Dir class did not properly handle strings containing the NULL byte. An attacker, able to inject NULL bytes in a path, could possibly trigger an unspecified behavior of the ruby script.

6.5 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 267 products, the same list as for CVE-2017-17742

Threats

Impact Moderate

CVE-2018-16395

An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 267 products, the same list as for CVE-2017-17742

Threats

Impact Important

CVE-2018-16396

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.

5.9 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-20 - Improper Input Validation

Affected products

Fixed 267 products, the same list as for CVE-2017-17742

Threats

Impact Moderate

CVE-2018-1000073

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.

5.5 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 267 products, the same list as for CVE-2017-17742

Threats

Impact Moderate

CVE-2018-1000074

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6.

7.8 (High)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-502 - Deserialization of Untrusted Data

Affected products

Fixed 267 products, the same list as for CVE-2017-17742

Threats

Impact Moderate

CVE-2018-1000075

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.

3.3 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 267 products, the same list as for CVE-2017-17742

Threats

Impact Low

CVE-2018-1000076

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.

5.5 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE-347 - Improper Verification of Cryptographic Signature

Affected products

Fixed 267 products, the same list as for CVE-2017-17742

Threats

Impact Moderate

CVE-2018-1000077

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.

5.5 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE-20 - Improper Input Validation

Affected products

Fixed 267 products, the same list as for CVE-2017-17742

Threats

Impact Moderate

CVE-2018-1000078

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.

6.1 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 267 products, the same list as for CVE-2017-17742

Threats

Impact Moderate

CVE-2018-1000079

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.

5.5 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 267 products, the same list as for CVE-2017-17742

Threats

Impact Moderate

References

88 references

URL	Category
https://access.redhat.com/errata/RHSA-2018:3731	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=1547418	external
https://bugzilla.redhat.com/show_bug.cgi?id=1547419	external
https://bugzilla.redhat.com/show_bug.cgi?id=1547420	external
https://bugzilla.redhat.com/show_bug.cgi?id=1547421	external
https://bugzilla.redhat.com/show_bug.cgi?id=1547422	external
https://bugzilla.redhat.com/show_bug.cgi?id=1547425	external
https://bugzilla.redhat.com/show_bug.cgi?id=1547426	external
https://bugzilla.redhat.com/show_bug.cgi?id=1561947	external
https://bugzilla.redhat.com/show_bug.cgi?id=1561948	external
https://bugzilla.redhat.com/show_bug.cgi?id=1561949	external
https://bugzilla.redhat.com/show_bug.cgi?id=1561950	external
https://bugzilla.redhat.com/show_bug.cgi?id=1561952	external
https://bugzilla.redhat.com/show_bug.cgi?id=1561953	external
https://bugzilla.redhat.com/show_bug.cgi?id=1643086	external
https://bugzilla.redhat.com/show_bug.cgi?id=1643089	external
https://bugzilla.redhat.com/show_bug.cgi?id=1650588	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2017-17742	self
https://bugzilla.redhat.com/show_bug.cgi?id=1561952	external
https://www.cve.org/CVERecord?id=CVE-2017-17742	external
https://nvd.nist.gov/vuln/detail/CVE-2017-17742	external
https://www.ruby-lang.org/en/news/2018/03/28/http…	external
https://access.redhat.com/security/cve/CVE-2018-6914	self
https://bugzilla.redhat.com/show_bug.cgi?id=1561947	external
https://www.cve.org/CVERecord?id=CVE-2018-6914	external
https://nvd.nist.gov/vuln/detail/CVE-2018-6914	external
https://www.ruby-lang.org/en/news/2018/03/28/unin…	external
https://access.redhat.com/security/cve/CVE-2018-8777	self
https://bugzilla.redhat.com/show_bug.cgi?id=1561950	external
https://www.cve.org/CVERecord?id=CVE-2018-8777	external
https://nvd.nist.gov/vuln/detail/CVE-2018-8777	external
https://www.ruby-lang.org/en/news/2018/03/28/larg…	external
https://access.redhat.com/security/cve/CVE-2018-8778	self
https://bugzilla.redhat.com/show_bug.cgi?id=1561953	external
https://www.cve.org/CVERecord?id=CVE-2018-8778	external
https://nvd.nist.gov/vuln/detail/CVE-2018-8778	external
https://www.ruby-lang.org/en/news/2018/03/28/buff…	external
https://access.redhat.com/security/cve/CVE-2018-8779	self
https://bugzilla.redhat.com/show_bug.cgi?id=1561948	external
https://www.cve.org/CVERecord?id=CVE-2018-8779	external
https://nvd.nist.gov/vuln/detail/CVE-2018-8779	external
https://www.ruby-lang.org/en/news/2018/03/28/pois…	external
https://access.redhat.com/security/cve/CVE-2018-8780	self
https://bugzilla.redhat.com/show_bug.cgi?id=1561949	external
https://www.cve.org/CVERecord?id=CVE-2018-8780	external
https://nvd.nist.gov/vuln/detail/CVE-2018-8780	external
https://www.ruby-lang.org/en/news/2018/03/28/pois…	external
https://access.redhat.com/security/cve/CVE-2018-16395	self
https://bugzilla.redhat.com/show_bug.cgi?id=1643086	external
https://www.cve.org/CVERecord?id=CVE-2018-16395	external
https://nvd.nist.gov/vuln/detail/CVE-2018-16395	external
https://www.ruby-lang.org/en/news/2018/10/17/open…	external
https://access.redhat.com/security/cve/CVE-2018-16396	self
https://bugzilla.redhat.com/show_bug.cgi?id=1643089	external
https://www.cve.org/CVERecord?id=CVE-2018-16396	external
https://nvd.nist.gov/vuln/detail/CVE-2018-16396	external
https://www.ruby-lang.org/en/news/2018/10/17/not-…	external
https://access.redhat.com/security/cve/CVE-2018-1000073	self
https://bugzilla.redhat.com/show_bug.cgi?id=1547418	external
https://www.cve.org/CVERecord?id=CVE-2018-1000073	external
https://nvd.nist.gov/vuln/detail/CVE-2018-1000073	external
https://www.ruby-lang.org/en/news/2018/02/17/mult…	external
https://access.redhat.com/security/cve/CVE-2018-1000074	self
https://bugzilla.redhat.com/show_bug.cgi?id=1547419	external
https://www.cve.org/CVERecord?id=CVE-2018-1000074	external
https://nvd.nist.gov/vuln/detail/CVE-2018-1000074	external
https://access.redhat.com/security/cve/CVE-2018-1000075	self
https://bugzilla.redhat.com/show_bug.cgi?id=1547420	external
https://www.cve.org/CVERecord?id=CVE-2018-1000075	external
https://nvd.nist.gov/vuln/detail/CVE-2018-1000075	external
https://access.redhat.com/security/cve/CVE-2018-1000076	self
https://bugzilla.redhat.com/show_bug.cgi?id=1547421	external
https://www.cve.org/CVERecord?id=CVE-2018-1000076	external
https://nvd.nist.gov/vuln/detail/CVE-2018-1000076	external
https://access.redhat.com/security/cve/CVE-2018-1000077	self
https://bugzilla.redhat.com/show_bug.cgi?id=1547422	external
https://www.cve.org/CVERecord?id=CVE-2018-1000077	external
https://nvd.nist.gov/vuln/detail/CVE-2018-1000077	external
https://access.redhat.com/security/cve/CVE-2018-1000078	self
https://bugzilla.redhat.com/show_bug.cgi?id=1547425	external
https://www.cve.org/CVERecord?id=CVE-2018-1000078	external
https://nvd.nist.gov/vuln/detail/CVE-2018-1000078	external
https://access.redhat.com/security/cve/CVE-2018-1000079	self
https://bugzilla.redhat.com/show_bug.cgi?id=1547426	external
https://www.cve.org/CVERecord?id=CVE-2018-1000079	external
https://nvd.nist.gov/vuln/detail/CVE-2018-1000079	external

JSON

To clipboard

Loading 1.2 MB of JSON…

CVE-2017-17742 (GCVE-0-2017-17742)

Vulnerability from cvelistv5 – Published: 2018-04-03 00:00 – Updated: 2024-08-05 20:59

Summary

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

20 references

URL	Tags
https://usn.ubuntu.com/3685-1/	vendor-advisory
https://www.ruby-lang.org/en/news/2018/03/28/ruby…
http://www.securityfocus.com/bid/103684	vdb-entry
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisory
http://www.securitytracker.com/id/1042004	vdb-entry
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisory
https://lists.debian.org/debian-lts-announce/2018…	mailing-list
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisory
https://www.ruby-lang.org/en/news/2018/03/28/http…
https://www.ruby-lang.org/en/news/2018/03/28/ruby…
https://lists.debian.org/debian-lts-announce/2018…	mailing-list
https://www.ruby-lang.org/en/news/2018/03/28/ruby…
https://www.debian.org/security/2018/dsa-4259	vendor-advisory
https://www.ruby-lang.org/en/news/2018/03/28/ruby…
https://lists.debian.org/debian-lts-announce/2018…	mailing-list
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisory
https://lists.debian.org/debian-lts-announce/2019…	mailing-list
https://lists.debian.org/debian-lts-announce/2020…	mailing-list
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Date Public

2018-03-28 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:59:17.715Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3685-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3685-1/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/"
          },
          {
            "name": "103684",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/103684"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "name": "1042004",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1042004"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/"
          },
          {
            "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/"
          },
          {
            "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1359-1] ruby1.8 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "[debian-lts-announce] 20191210 [SECURITY] [DLA 2027-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html"
          },
          {
            "name": "[debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html"
          },
          {
            "name": "[debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-03-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-30T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3685-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/3685-1/"
        },
        {
          "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/"
        },
        {
          "name": "103684",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/103684"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "name": "1042004",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securitytracker.com/id/1042004"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "url": "https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/"
        },
        {
          "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/"
        },
        {
          "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
        },
        {
          "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/"
        },
        {
          "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1359-1] ruby1.8 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "[debian-lts-announce] 20191210 [SECURITY] [DLA 2027-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html"
        },
        {
          "name": "[debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html"
        },
        {
          "name": "[debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-17742",
    "datePublished": "2018-04-03T00:00:00.000Z",
    "dateReserved": "2017-12-18T00:00:00.000Z",
    "dateUpdated": "2024-08-05T20:59:17.715Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1000073 (GCVE-0-2018-1000073)

Vulnerability from cvelistv5 – Published: 2018-03-13 15:00 – Updated: 2024-08-05 12:33

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

14 references

URL	Tags
https://www.debian.org/security/2018/dsa-4219	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3621-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://github.com/rubygems/rubygems/commit/1b931…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4259	vendor-advisoryx_refsource_DEBIAN
http://blog.rubygems.org/2018/02/15/2.7.6-released.html	x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0542	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0663	vendor-advisoryx_refsource_REDHAT

Date Public

2018-03-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:33:49.113Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4219",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4219"
          },
          {
            "name": "USN-3621-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-1/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/1b931fc03b819b9a0214be3eaca844ef534175e2"
          },
          {
            "name": "[debian-lts-announce] 20180827 [SECURITY] [DLA 1480-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "RHSA-2020:0542",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0542"
          },
          {
            "name": "RHSA-2020:0591",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0591"
          },
          {
            "name": "RHSA-2020:0663",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0663"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-02-18T00:00:00.000Z",
      "datePublic": "2018-03-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-03T18:06:14.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-4219",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4219"
        },
        {
          "name": "USN-3621-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-1/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/1b931fc03b819b9a0214be3eaca844ef534175e2"
        },
        {
          "name": "[debian-lts-announce] 20180827 [SECURITY] [DLA 1480-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "RHSA-2020:0542",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0542"
        },
        {
          "name": "RHSA-2020:0591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0591"
        },
        {
          "name": "RHSA-2020:0663",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0663"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2/18/2018 7:55:29",
          "ID": "CVE-2018-1000073",
          "REQUESTER": "craig.ingram@salesforce.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4219",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4219"
            },
            {
              "name": "USN-3621-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-1/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/1b931fc03b819b9a0214be3eaca844ef534175e2",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/1b931fc03b819b9a0214be3eaca844ef534175e2"
            },
            {
              "name": "[debian-lts-announce] 20180827 [SECURITY] [DLA 1480-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html"
            },
            {
              "name": "DSA-4259",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4259"
            },
            {
              "name": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html",
              "refsource": "MISC",
              "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            },
            {
              "name": "RHSA-2020:0542",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0542"
            },
            {
              "name": "RHSA-2020:0591",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0591"
            },
            {
              "name": "RHSA-2020:0663",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0663"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000073",
    "datePublished": "2018-03-13T15:00:00.000Z",
    "dateReserved": "2018-02-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:33:49.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1000074 (GCVE-0-2018-1000074)

Vulnerability from cvelistv5 – Published: 2018-03-13 15:00 – Updated: 2024-08-05 12:33

Summary

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

18 references

URL	Tags
https://usn.ubuntu.com/3685-1/	vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/3621-2/	vendor-advisoryx_refsource_UBUNTU
https://github.com/rubygems/rubygems/commit/254e3…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4219	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3621-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4259	vendor-advisoryx_refsource_DEBIAN
http://blog.rubygems.org/2018/02/15/2.7.6-released.html	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0542	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0663	vendor-advisoryx_refsource_REDHAT

Date Public

2018-03-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:33:49.164Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3685-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3685-1/"
          },
          {
            "name": "USN-3621-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-2/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d"
          },
          {
            "name": "[debian-lts-announce] 20180417 [SECURITY] [DLA 1352-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00017.html"
          },
          {
            "name": "DSA-4219",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4219"
          },
          {
            "name": "USN-3621-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-1/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "name": "[debian-lts-announce] 20180827 [SECURITY] [DLA 1480-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
          },
          {
            "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "RHSA-2020:0542",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0542"
          },
          {
            "name": "RHSA-2020:0591",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0591"
          },
          {
            "name": "RHSA-2020:0663",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0663"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-02-18T00:00:00.000Z",
      "datePublic": "2018-03-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-03T18:06:20.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3685-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3685-1/"
        },
        {
          "name": "USN-3621-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-2/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d"
        },
        {
          "name": "[debian-lts-announce] 20180417 [SECURITY] [DLA 1352-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00017.html"
        },
        {
          "name": "DSA-4219",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4219"
        },
        {
          "name": "USN-3621-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-1/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "name": "[debian-lts-announce] 20180827 [SECURITY] [DLA 1480-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
        },
        {
          "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "RHSA-2020:0542",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0542"
        },
        {
          "name": "RHSA-2020:0591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0591"
        },
        {
          "name": "RHSA-2020:0663",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0663"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2/18/2018 7:58:35",
          "ID": "CVE-2018-1000074",
          "REQUESTER": "craig.ingram@salesforce.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3685-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3685-1/"
            },
            {
              "name": "USN-3621-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-2/"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d"
            },
            {
              "name": "[debian-lts-announce] 20180417 [SECURITY] [DLA 1352-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00017.html"
            },
            {
              "name": "DSA-4219",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4219"
            },
            {
              "name": "USN-3621-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-1/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "[debian-lts-announce] 20180827 [SECURITY] [DLA 1480-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html"
            },
            {
              "name": "DSA-4259",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4259"
            },
            {
              "name": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html",
              "refsource": "MISC",
              "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
            },
            {
              "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            },
            {
              "name": "RHSA-2020:0542",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0542"
            },
            {
              "name": "RHSA-2020:0591",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0591"
            },
            {
              "name": "RHSA-2020:0663",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0663"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000074",
    "datePublished": "2018-03-13T15:00:00.000Z",
    "dateReserved": "2018-02-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:33:49.164Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1000075 (GCVE-0-2018-1000075)

Vulnerability from cvelistv5 – Published: 2018-03-13 15:00 – Updated: 2024-08-05 12:33

Summary

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

18 references

URL	Tags
https://www.debian.org/security/2018/dsa-4219	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3621-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://github.com/rubygems/rubygems/commit/92e98…	x_refsource_MISC
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4259	vendor-advisoryx_refsource_DEBIAN
http://blog.rubygems.org/2018/02/15/2.7.6-released.html	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0542	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0663	vendor-advisoryx_refsource_REDHAT

Date Public

2018-03-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:33:49.137Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4219",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4219"
          },
          {
            "name": "USN-3621-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-1/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/92e98bf8f810bd812f919120d4832df51bc25d83"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
          },
          {
            "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
          },
          {
            "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
          },
          {
            "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "RHSA-2020:0542",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0542"
          },
          {
            "name": "RHSA-2020:0591",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0591"
          },
          {
            "name": "RHSA-2020:0663",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0663"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-02-18T00:00:00.000Z",
      "datePublic": "2018-03-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-03T18:06:15.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-4219",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4219"
        },
        {
          "name": "USN-3621-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-1/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/92e98bf8f810bd812f919120d4832df51bc25d83"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
        },
        {
          "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
        },
        {
          "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
        },
        {
          "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "RHSA-2020:0542",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0542"
        },
        {
          "name": "RHSA-2020:0591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0591"
        },
        {
          "name": "RHSA-2020:0663",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0663"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2/18/2018 8:01:41",
          "ID": "CVE-2018-1000075",
          "REQUESTER": "craig.ingram@salesforce.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4219",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4219"
            },
            {
              "name": "USN-3621-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-1/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/92e98bf8f810bd812f919120d4832df51bc25d83",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/92e98bf8f810bd812f919120d4832df51bc25d83"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
            },
            {
              "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
            },
            {
              "name": "DSA-4259",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4259"
            },
            {
              "name": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html",
              "refsource": "MISC",
              "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
            },
            {
              "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
            },
            {
              "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            },
            {
              "name": "RHSA-2020:0542",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0542"
            },
            {
              "name": "RHSA-2020:0591",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0591"
            },
            {
              "name": "RHSA-2020:0663",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0663"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000075",
    "datePublished": "2018-03-13T15:00:00.000Z",
    "dateReserved": "2018-02-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:33:49.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1000076 (GCVE-0-2018-1000076)

Vulnerability from cvelistv5 – Published: 2018-03-13 15:00 – Updated: 2024-08-05 12:33

Summary

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

18 references

URL	Tags
https://www.debian.org/security/2018/dsa-4219	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3621-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4259	vendor-advisoryx_refsource_DEBIAN
http://blog.rubygems.org/2018/02/15/2.7.6-released.html	x_refsource_MISC
https://github.com/rubygems/rubygems/commit/f5042…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0542	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0663	vendor-advisoryx_refsource_REDHAT

Date Public

2018-03-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:33:49.167Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4219",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4219"
          },
          {
            "name": "USN-3621-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-1/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
          },
          {
            "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693"
          },
          {
            "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
          },
          {
            "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "RHSA-2020:0542",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0542"
          },
          {
            "name": "RHSA-2020:0591",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0591"
          },
          {
            "name": "RHSA-2020:0663",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0663"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-02-18T00:00:00.000Z",
      "datePublic": "2018-03-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-03T18:06:17.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-4219",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4219"
        },
        {
          "name": "USN-3621-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-1/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
        },
        {
          "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693"
        },
        {
          "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
        },
        {
          "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "RHSA-2020:0542",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0542"
        },
        {
          "name": "RHSA-2020:0591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0591"
        },
        {
          "name": "RHSA-2020:0663",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0663"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2/18/2018 8:04:21",
          "ID": "CVE-2018-1000076",
          "REQUESTER": "craig.ingram@salesforce.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4219",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4219"
            },
            {
              "name": "USN-3621-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-1/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
            },
            {
              "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
            },
            {
              "name": "DSA-4259",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4259"
            },
            {
              "name": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html",
              "refsource": "MISC",
              "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693"
            },
            {
              "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
            },
            {
              "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            },
            {
              "name": "RHSA-2020:0542",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0542"
            },
            {
              "name": "RHSA-2020:0591",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0591"
            },
            {
              "name": "RHSA-2020:0663",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0663"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000076",
    "datePublished": "2018-03-13T15:00:00.000Z",
    "dateReserved": "2018-02-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:33:49.167Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1000077 (GCVE-0-2018-1000077)

Vulnerability from cvelistv5 – Published: 2018-03-13 15:00 – Updated: 2024-08-05 12:33

Summary

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

18 references

URL	Tags
https://www.debian.org/security/2018/dsa-4219	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3621-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4259	vendor-advisoryx_refsource_DEBIAN
https://github.com/rubygems/rubygems/commit/feade…	x_refsource_MISC
http://blog.rubygems.org/2018/02/15/2.7.6-released.html	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0542	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0663	vendor-advisoryx_refsource_REDHAT

Date Public

2018-03-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:33:49.191Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4219",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4219"
          },
          {
            "name": "USN-3621-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-1/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
          },
          {
            "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
          },
          {
            "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
          },
          {
            "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "RHSA-2020:0542",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0542"
          },
          {
            "name": "RHSA-2020:0591",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0591"
          },
          {
            "name": "RHSA-2020:0663",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0663"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-02-18T00:00:00.000Z",
      "datePublic": "2018-03-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-03T18:06:16.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-4219",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4219"
        },
        {
          "name": "USN-3621-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-1/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
        },
        {
          "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
        },
        {
          "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
        },
        {
          "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "RHSA-2020:0542",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0542"
        },
        {
          "name": "RHSA-2020:0591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0591"
        },
        {
          "name": "RHSA-2020:0663",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0663"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2/18/2018 8:06:57",
          "ID": "CVE-2018-1000077",
          "REQUESTER": "craig.ingram@salesforce.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4219",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4219"
            },
            {
              "name": "USN-3621-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-1/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
            },
            {
              "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
            },
            {
              "name": "DSA-4259",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4259"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964"
            },
            {
              "name": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html",
              "refsource": "MISC",
              "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
            },
            {
              "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
            },
            {
              "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            },
            {
              "name": "RHSA-2020:0542",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0542"
            },
            {
              "name": "RHSA-2020:0591",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0591"
            },
            {
              "name": "RHSA-2020:0663",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0663"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000077",
    "datePublished": "2018-03-13T15:00:00.000Z",
    "dateReserved": "2018-02-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:33:49.191Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1000078 (GCVE-0-2018-1000078)

Vulnerability from cvelistv5 – Published: 2018-03-13 15:00 – Updated: 2024-08-05 12:33

Summary

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

18 references

URL	Tags
https://www.debian.org/security/2018/dsa-4219	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3621-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4259	vendor-advisoryx_refsource_DEBIAN
http://blog.rubygems.org/2018/02/15/2.7.6-released.html	x_refsource_MISC
https://github.com/rubygems/rubygems/commit/66a28…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0542	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0663	vendor-advisoryx_refsource_REDHAT

Date Public

2018-03-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:33:49.191Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4219",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4219"
          },
          {
            "name": "USN-3621-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-1/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
          },
          {
            "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb"
          },
          {
            "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
          },
          {
            "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "RHSA-2020:0542",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0542"
          },
          {
            "name": "RHSA-2020:0591",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0591"
          },
          {
            "name": "RHSA-2020:0663",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0663"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-02-18T00:00:00.000Z",
      "datePublic": "2018-03-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-03T18:06:22.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-4219",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4219"
        },
        {
          "name": "USN-3621-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-1/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
        },
        {
          "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb"
        },
        {
          "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
        },
        {
          "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "RHSA-2020:0542",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0542"
        },
        {
          "name": "RHSA-2020:0591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0591"
        },
        {
          "name": "RHSA-2020:0663",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0663"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2/18/2018 8:09:26",
          "ID": "CVE-2018-1000078",
          "REQUESTER": "craig.ingram@salesforce.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4219",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4219"
            },
            {
              "name": "USN-3621-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-1/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
            },
            {
              "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
            },
            {
              "name": "DSA-4259",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4259"
            },
            {
              "name": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html",
              "refsource": "MISC",
              "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb"
            },
            {
              "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
            },
            {
              "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            },
            {
              "name": "RHSA-2020:0542",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0542"
            },
            {
              "name": "RHSA-2020:0591",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0591"
            },
            {
              "name": "RHSA-2020:0663",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0663"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000078",
    "datePublished": "2018-03-13T15:00:00.000Z",
    "dateReserved": "2018-02-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:33:49.191Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1000079 (GCVE-0-2018-1000079)

Vulnerability from cvelistv5 – Published: 2018-03-13 15:00 – Updated: 2024-08-05 12:33

Summary

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

15 references

URL	Tags
https://www.debian.org/security/2018/dsa-4219	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3621-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://github.com/rubygems/rubygems/commit/666ef…	x_refsource_MISC
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4259	vendor-advisoryx_refsource_DEBIAN
https://github.com/rubygems/rubygems/commit/f83f9…	x_refsource_MISC
http://blog.rubygems.org/2018/02/15/2.7.6-released.html	x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0542	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0663	vendor-advisoryx_refsource_REDHAT

Date Public

2018-03-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:33:49.201Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4219",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4219"
          },
          {
            "name": "USN-3621-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-1/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "RHSA-2020:0542",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0542"
          },
          {
            "name": "RHSA-2020:0591",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0591"
          },
          {
            "name": "RHSA-2020:0663",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0663"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-02-18T00:00:00.000Z",
      "datePublic": "2018-03-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-03T18:06:18.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-4219",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4219"
        },
        {
          "name": "USN-3621-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-1/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "RHSA-2020:0542",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0542"
        },
        {
          "name": "RHSA-2020:0591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0591"
        },
        {
          "name": "RHSA-2020:0663",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0663"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2/18/2018 8:11:09",
          "ID": "CVE-2018-1000079",
          "REQUESTER": "craig.ingram@salesforce.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4219",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4219"
            },
            {
              "name": "USN-3621-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-1/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
            },
            {
              "name": "DSA-4259",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4259"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759"
            },
            {
              "name": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html",
              "refsource": "MISC",
              "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            },
            {
              "name": "RHSA-2020:0542",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0542"
            },
            {
              "name": "RHSA-2020:0591",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0591"
            },
            {
              "name": "RHSA-2020:0663",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0663"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000079",
    "datePublished": "2018-03-13T15:00:00.000Z",
    "dateReserved": "2018-02-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:33:49.201Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-16395 (GCVE-0-2018-16395)

Vulnerability from cvelistv5 – Published: 2018-11-16 18:00 – Updated: 2024-08-05 10:24

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

19 references

URL	Tags
https://www.ruby-lang.org/en/news/2018/10/17/open…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:3738	vendor-advisoryx_refsource_REDHAT
https://www.ruby-lang.org/en/news/2018/11/06/ruby…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://hackerone.com/reports/387250	x_refsource_MISC
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://www.ruby-lang.org/en/news/2018/10/17/ruby…	x_refsource_CONFIRM
https://www.debian.org/security/2018/dsa-4332	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3808-1/	vendor-advisoryx_refsource_UBUNTU
https://www.ruby-lang.org/en/news/2018/10/17/ruby…	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2019022…	x_refsource_CONFIRM
https://www.ruby-lang.org/en/news/2018/10/17/ruby…	x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
http://www.securitytracker.com/id/1042105	vdb-entryx_refsource_SECTRACK
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:1948	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2565	vendor-advisoryx_refsource_REDHAT
https://www.oracle.com/security-alerts/cpujan2020.html	x_refsource_MISC

Date Public

2018-10-17 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:24:32.106Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/"
          },
          {
            "name": "RHSA-2018:3738",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3738"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/387250"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/"
          },
          {
            "name": "DSA-4332",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4332"
          },
          {
            "name": "USN-3808-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3808-1/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190221-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/"
          },
          {
            "name": "[debian-lts-announce] 20181028 [SECURITY] [DLA 1558-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html"
          },
          {
            "name": "1042105",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1042105"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:1948",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1948"
          },
          {
            "name": "RHSA-2019:2565",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2565"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-10-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-15T19:15:22.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/"
        },
        {
          "name": "RHSA-2018:3738",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3738"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/387250"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/"
        },
        {
          "name": "DSA-4332",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4332"
        },
        {
          "name": "USN-3808-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3808-1/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190221-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/"
        },
        {
          "name": "[debian-lts-announce] 20181028 [SECURITY] [DLA 1558-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html"
        },
        {
          "name": "1042105",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1042105"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:1948",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1948"
        },
        {
          "name": "RHSA-2019:2565",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2565"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-16395",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/"
            },
            {
              "name": "RHSA-2018:3738",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3738"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "https://hackerone.com/reports/387250",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/387250"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/"
            },
            {
              "name": "DSA-4332",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4332"
            },
            {
              "name": "USN-3808-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3808-1/"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190221-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190221-0002/"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/"
            },
            {
              "name": "[debian-lts-announce] 20181028 [SECURITY] [DLA 1558-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html"
            },
            {
              "name": "1042105",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1042105"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:1948",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1948"
            },
            {
              "name": "RHSA-2019:2565",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2565"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-16395",
    "datePublished": "2018-11-16T18:00:00.000Z",
    "dateReserved": "2018-09-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T10:24:32.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-16396 (GCVE-0-2018-16396)

Vulnerability from cvelistv5 – Published: 2018-11-16 18:00 – Updated: 2024-08-05 10:24

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

16 references

URL	Tags
https://hackerone.com/reports/385070	x_refsource_MISC
https://www.ruby-lang.org/en/news/2018/11/06/ruby…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://www.ruby-lang.org/en/news/2018/10/17/ruby…	x_refsource_CONFIRM
https://www.debian.org/security/2018/dsa-4332	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3808-1/	vendor-advisoryx_refsource_UBUNTU
https://www.ruby-lang.org/en/news/2018/10/17/ruby…	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2019022…	x_refsource_CONFIRM
https://www.ruby-lang.org/en/news/2018/10/17/not-…	x_refsource_CONFIRM
https://www.ruby-lang.org/en/news/2018/10/17/ruby…	x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
http://www.securitytracker.com/id/1042106	vdb-entryx_refsource_SECTRACK
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT

Date Public

2018-10-17 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:24:32.115Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/385070"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/"
          },
          {
            "name": "DSA-4332",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4332"
          },
          {
            "name": "USN-3808-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3808-1/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190221-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/"
          },
          {
            "name": "[debian-lts-announce] 20181028 [SECURITY] [DLA 1558-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html"
          },
          {
            "name": "1042106",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1042106"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-10-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-08-06T16:06:27.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/385070"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/"
        },
        {
          "name": "DSA-4332",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4332"
        },
        {
          "name": "USN-3808-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3808-1/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190221-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/"
        },
        {
          "name": "[debian-lts-announce] 20181028 [SECURITY] [DLA 1558-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html"
        },
        {
          "name": "1042106",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1042106"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-16396",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/385070",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/385070"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/"
            },
            {
              "name": "DSA-4332",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4332"
            },
            {
              "name": "USN-3808-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3808-1/"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190221-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190221-0002/"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/"
            },
            {
              "name": "[debian-lts-announce] 20181028 [SECURITY] [DLA 1558-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html"
            },
            {
              "name": "1042106",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1042106"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-16396",
    "datePublished": "2018-11-16T18:00:00.000Z",
    "dateReserved": "2018-09-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T10:24:32.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2018_3731

CVE-2017-17742 (GCVE-0-2017-17742)

CVE-2018-1000073 (GCVE-0-2018-1000073)

CVE-2018-1000074 (GCVE-0-2018-1000074)

CVE-2018-1000075 (GCVE-0-2018-1000075)

CVE-2018-1000076 (GCVE-0-2018-1000076)

CVE-2018-1000077 (GCVE-0-2018-1000077)

CVE-2018-1000078 (GCVE-0-2018-1000078)

CVE-2018-1000079 (GCVE-0-2018-1000079)

CVE-2018-16395 (GCVE-0-2018-16395)

CVE-2018-16396 (GCVE-0-2018-16396)

Tags

Sightings

Nomenclature