CRITICAL9.8
GHSA-mc6j-h948-v2p6
RubyGems Improper Verification of Cryptographic Signature vulnerability
Quick fix
GHSA-mc6j-h948-v2p6 — rubygems-update: upgrade to the fixed version with the command below.
bundle update rubygems-updateDetails
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, and Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contain an Improper Verification of Cryptographic Signature vulnerability in package.rb. This can result in a mis-signed gem being installed, as the tarball would contain multiple gem signatures. This vulnerability has been fixed in 2.7.6.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.jruby:jruby-stdlib
Introduced in:
0Fixed in: 9.1.16.0Fix
# pom.xml: bump <version>9.1.16.0</version> for org.jruby:jruby-stdlibReferences
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000076[ADVISORY]
- https://github.com/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7[WEB]
- https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693[WEB]
- https://www.debian.org/security/2018/dsa-4259[WEB]
- https://www.debian.org/security/2018/dsa-4219[WEB]
- https://usn.ubuntu.com/3621-1[WEB]
- https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html[WEB]
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html[WEB]
- https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html[WEB]
- https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html[WEB]
- https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html[WEB]
- https://github.com/rubygems/rubygems[PACKAGE]
- https://access.redhat.com/errata/RHSA-2020:0663[WEB]
- https://access.redhat.com/errata/RHSA-2020:0591[WEB]
- https://access.redhat.com/errata/RHSA-2020:0542[WEB]
- https://access.redhat.com/errata/RHSA-2019:2028[WEB]
- https://access.redhat.com/errata/RHSA-2018:3731[WEB]
- https://access.redhat.com/errata/RHSA-2018:3730[WEB]
- https://access.redhat.com/errata/RHSA-2018:3729[WEB]
- http://blog.rubygems.org/2018/02/15/2.7.6-released.html[WEB]
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html[WEB]