An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-mongoUpgrade rubygem-mongo-docUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygem-mysql2-doc | May 13, 2022 | Jun 17, 2019 |
| Alpine Linux | — | Upgrade ruby | Jun 17, 2019 | Jun 17, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygemsUpgrade rubygem-rdocUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade ruby-tcltkUpgrade rubyUpgrade ruby-libsUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-minitest | Apr 27, 2020 | Jun 17, 2019 |
| Amazon_linux | — | Upgrade ruby20Upgrade ruby21Upgrade ruby24 | Aug 13, 2019 | Mar 5, 2019 |
| Centos_linux | — | Upgrade rubygem-did_you_meanUpgrade rubygem-io-consoleUpgrade rubygem-bundler-docUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-mysql2-docUpgrade rubygem-rakeUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade rubygems-develUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson-docUpgrade rubygem-io-console-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-psych-debuginfoUpgrade rubygem-pgUpgrade ruby-irbUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-opensslUpgrade rubygem-abrt-docUpgrade rubygem-jsonUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-bson-debuginfoUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade ruby-tcltkUpgrade rubyUpgrade rubygem-pg-debugsourceUpgrade rubygemsUpgrade rubygem-pg-debuginfoUpgrade ruby-develUpgrade ruby-libs-debuginfoUpgrade ruby-libsUpgrade rubygem-bundlerUpgrade rubygem-net-telnetUpgrade rubygem-abrtUpgrade rubygem-bson-debugsource | May 23, 2019 | Mar 5, 2019 |
| Debian | — | Upgrade jrubyUpgrade rubygems | Apr 1, 2019 | Apr 1, 2019 |
| Freebsd | — | Upgrade ruby23-gemsUpgrade ruby24-gemsUpgrade ruby25-gems | Mar 16, 2019 | Mar 15, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-21/ruby-tk to version 2.1.6-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-21 to version 2.1.6-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.0-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.11.0.1.3.0 on Solaris 11.4 | Jul 17, 2019 | Jun 17, 2019 |
| Oracle_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubyUpgrade rubygem-rakeUpgrade rubygem-abrtUpgrade ruby-tcltkUpgrade rubygem-bundlerUpgrade ruby-docUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2Upgrade rubygem-mongo-docUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade rubygem-mongoUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade rubygem-test-unitUpgrade rubygem-bundler-docUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-minitestUpgrade rubygem-bson-docUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-psych | May 16, 2019 | Mar 5, 2019 |
| Redhat_linux | — | Upgrade ruby-develUpgrade rubygem-psych-debuginfoUpgrade rubygem-mongo-docUpgrade rubyUpgrade ruby-docUpgrade rubygem-pg-debuginfoUpgrade ruby-irbUpgrade rubygem-xmlrpcUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-test-unitUpgrade rubygem-abrtUpgrade rubygem-io-consoleUpgrade rubygem-opensslUpgrade rubygem-rakeUpgrade rubygem-mysql2Upgrade rubygem-mysql2-docUpgrade rubygem-bsonUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-pg-debugsourceUpgrade rubygem-bundlerUpgrade rubygems-develUpgrade rubygemsUpgrade ruby-libs-debuginfoUpgrade rubygem-bson-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-pgUpgrade rubygem-openssl-debuginfoUpgrade rubygem-rdocUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-mongoUpgrade rubygem-bundler-docUpgrade ruby-tcltkUpgrade rubygem-bson-docUpgrade rubygem-json-debuginfoUpgrade rubygem-minitestUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-console-debuginfo | May 16, 2019 | May 15, 2019 |
| Rocky_linux | — | Upgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson | Mar 12, 2024 | Jun 17, 2019 |
| Suse | — | Upgrade ruby2.5Upgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.5-develUpgrade ruby2.5-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.1-stdlibUpgrade ruby2.1-develUpgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.1Upgrade libruby2_1-2_1Upgrade ruby2.5-docUpgrade yast2-ruby-bindings | Jul 22, 2019 | Mar 5, 2019 |
| Ubuntu | — | Upgrade ruby2.0Upgrade ruby1.9.3Upgrade ruby2.5Upgrade libruby2.0Upgrade ruby2.3Upgrade libruby1.9.1Upgrade ruby1.9.1Upgrade libruby2.3Upgrade libruby2.5 | Apr 24, 2019 | Mar 5, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub