CVE-2018-1000075

Published: 13 March 2018

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.

From the Ubuntu Security Team

It was discovered that the RubyGems embedded in JRuby failed to validate the size value in the tar header of ruby gem packages. An attacker could use this vulnerability to cause a denial of service via an infinite loop.

Notes

ruby{1.9.1,2.0,2.3} and jruby ship an embedded rubygems.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000075
• https://github.com/rubygems/rubygems/commit/92e98bf8f810bd812f919120d4832df51bc25d83
• https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/
• https://ubuntu.com/security/notices/USN-3621-1
• NVD
• Launchpad
• Debian