CVE-2018-1000076

Published: 13 March 2018

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.

From the Ubuntu Security Team

It was discovered that the RubyGems embedded in JRuby did not properly verify cryptographic signatures of gems. An attacker could use this vulnerability to trick a victim into installing a malicious gem.

Notes

ruby{1.9.1,2.0,2.3} and jruby ship an embedded rubygems.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000076
• https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693
• https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/
• https://ubuntu.com/security/notices/USN-3621-1
• NVD
• Launchpad
• Debian