rubygems-update 2.1.10

13 security vulnerabilities found in version 2.1.10

Unsafe Object Deserialization Vulnerability in RubyGems

critical severity CVE-2017-0903
critical severity CVE-2017-0903
Patched versions: >= 2.6.14
Unaffected versions: < 2.0.0

There is a possible unsafe object deserialization vulnerability in RubyGems. It is possible for YAML deserialization of gem specifications to bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

RubyGems ANSI escape sequence vulnerability

critical severity CVE-2017-0899
critical severity CVE-2017-0899
Patched versions: >= 2.4.5.3, >= 2.5.2.1, >= 2.6.13

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

RubyGems Infinite Loop vulnerability

high severity CVE-2018-1000075
high severity CVE-2018-1000075
Patched versions: >= 2.7.6

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.

RubyGems Deserialization of Untrusted Data vulnerability

high severity CVE-2018-1000074
high severity CVE-2018-1000074
Patched versions: >= 2.7.6

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack requires the victim to run the gem owner command on a gem with a specially crafted YAML file. This vulnerability is fixed in 2.7.6.

RubyGems Link Following vulnerability

high severity CVE-2018-1000073
high severity CVE-2018-1000073
Patched versions: >= 2.7.6

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.

RubyGems DNS request hijacking vulnerability

high severity CVE-2017-0902
high severity CVE-2017-0902
Patched versions: >= 2.4.5.3, >= 2.5.2.1, >= 2.6.13

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to down load and install gems from a server that the attacker controls.

RubyGems vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files

high severity CVE-2017-0901
high severity CVE-2017-0901
Patched versions: >= 2.4.5.3, >= 2.5.2.1, >= 2.6.13

RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

RubyGems DoS vulnerability in the query command

high severity CVE-2017-0900
high severity CVE-2017-0900
Patched versions: >= 2.4.5.3, >= 2.5.2.1, >= 2.6.13

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a query command.

RubyGems Path Traversal vulnerability

medium severity CVE-2018-1000079
medium severity CVE-2018-1000079
Patched versions: >= 2.7.6

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem writing to arbitrary filesystem locations during installation. This attack appears to be exploitable via installation of a malicious gem. This vulnerability is fixed in 2.7.6.

RubyGems Cross-site Scripting vulnerability

medium severity CVE-2018-1000078
medium severity CVE-2018-1000078
Patched versions: >= 2.7.6

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack requires the victim to browse to a malicious gem on a vulnerable gem server. This vulnerability is fixed in 2.7.6.

RubyGems Improper Input Validation vulnerability

medium severity CVE-2018-1000077
medium severity CVE-2018-1000077
Patched versions: >= 2.7.6

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem setting an invalid homepage URL. This vulnerability is fixed in 2.7.6.

RubyGems remote_fetcher.rb api_endpoint() Function Missing SRV Record Hostname Validation Request Hijacking

medium severity CVE-2015-4020
medium severity CVE-2015-4020
Patched versions: ~> 2.0.17, ~> 2.2.5, >= 2.4.8

RubyGems contains a flaw in the api_endpoint() function in remote_fetcher.rb that is triggered when handling hostnames in SRV records. With a specially crafted response, a context-dependent attacker may conduct DNS hijacking attacks. This vulnerability is due to an incomplete fix for CVE-2015-3900, which allowed redirection to an arbitrary gem server in any security domain.

CVE-2015-3900 rubygems: DNS hijacking vulnerability in api_endpoint()

medium severity CVE-2015-3900
medium severity CVE-2015-3900
Patched versions: ~> 2.0.16, ~> 2.2.4, >= 2.4.7

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack." A flaw was found in a way rubygems verified the API endpoint hostname retrieved through a DNS SRV record. A man-in-the-middle attacker could use this flaw to force a client to download content from an untrusted domain.

No officially reported memory leakage issues detected.


This gem version does not have any officially reported memory leaked issues.

No license issues detected.


This gem version has a license in the gemspec.

This gem version is available.


This gem version has not been yanked and is still available for usage.