CVE-2018-1000077

Published: 13 March 2018

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.

From the Ubuntu Security Team

It was discovered that the RubyGems embedded in JRuby failed to validate the a gem's homepage URL. As a result, a malicious gem could set an invalid or malicious homepage URL.

Notes

ruby{1.9.1,2.0,2.3} and jruby ship an embedded rubygems.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000077
• https://github.com/rubygems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964
• https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/
• https://ubuntu.com/security/notices/USN-3621-1
• NVD
• Launchpad
• Debian