rubygems-update 2.1.10
Unsafe Object Deserialization Vulnerability in RubyGems
critical severity CVE-2017-0903>= 2.6.14
< 2.0.0
There is a possible unsafe object deserialization vulnerability in RubyGems. It is possible for YAML deserialization of gem specifications to bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
RubyGems ANSI escape sequence vulnerability
critical severity CVE-2017-0899>= 2.4.5.3, >= 2.5.2.1, >= 2.6.13
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
RubyGems Infinite Loop vulnerability
high severity CVE-2018-1000075>= 2.7.6
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.
RubyGems Deserialization of Untrusted Data vulnerability
high severity CVE-2018-1000074>= 2.7.6
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and
earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data
vulnerability in owner command that can result in code execution. This attack requires
the victim to run the gem owner command on a gem with a specially crafted YAML
file. This vulnerability is fixed in 2.7.6.
RubyGems Link Following vulnerability
high severity CVE-2018-1000073>= 2.7.6
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and
earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability
in install_location function of package.rb that can result in path traversal
when writing to a symlinked basedir outside of the root. This vulnerability appears
to have been fixed in 2.7.6.
RubyGems DNS request hijacking vulnerability
high severity CVE-2017-0902>= 2.4.5.3, >= 2.5.2.1, >= 2.6.13
RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to down load and install gems from a server that the attacker controls.
RubyGems vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files
high severity CVE-2017-0901>= 2.4.5.3, >= 2.5.2.1, >= 2.6.13
RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
RubyGems DoS vulnerability in the query command
high severity CVE-2017-0900>= 2.4.5.3, >= 2.5.2.1, >= 2.6.13
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem
specifications to cause a denial of service attack against RubyGems clients
who have issued a query command.
RubyGems Path Traversal vulnerability
medium severity CVE-2018-1000079>= 2.7.6
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem writing to arbitrary filesystem locations during installation. This attack appears to be exploitable via installation of a malicious gem. This vulnerability is fixed in 2.7.6.
RubyGems Cross-site Scripting vulnerability
medium severity CVE-2018-1000078>= 2.7.6
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack requires the victim to browse to a malicious gem on a vulnerable gem server. This vulnerability is fixed in 2.7.6.
RubyGems Improper Input Validation vulnerability
medium severity CVE-2018-1000077>= 2.7.6
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem setting an invalid homepage URL. This vulnerability is fixed in 2.7.6.
RubyGems remote_fetcher.rb api_endpoint() Function Missing SRV Record Hostname Validation Request Hijacking
medium severity CVE-2015-4020~> 2.0.17, ~> 2.2.5, >= 2.4.8
RubyGems contains a flaw in the api_endpoint() function in remote_fetcher.rb that is triggered when handling hostnames in SRV records. With a specially crafted response, a context-dependent attacker may conduct DNS hijacking attacks. This vulnerability is due to an incomplete fix for CVE-2015-3900, which allowed redirection to an arbitrary gem server in any security domain.
CVE-2015-3900 rubygems: DNS hijacking vulnerability in api_endpoint()
medium severity CVE-2015-3900~> 2.0.16, ~> 2.2.4, >= 2.4.7
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack." A flaw was found in a way rubygems verified the API endpoint hostname retrieved through a DNS SRV record. A man-in-the-middle attacker could use this flaw to force a client to download content from an untrusted domain.
No officially reported memory leakage issues detected.
This gem version does not have any officially reported memory leaked issues.
No license issues detected.
This gem version has a license in the gemspec.
This gem version is available.
This gem version has not been yanked and is still available for usage.