RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade rubyUpgrade ruby2.2 | Aug 22, 2024 | Aug 31, 2017 |
| Amazon_linux | — | Upgrade ruby22Upgrade ruby24Upgrade ruby23 | Oct 3, 2017 | Aug 31, 2017 |
| Centos_linux | — | Upgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade ruby-develUpgrade ruby-docUpgrade rubygems-develUpgrade rubygem-jsonUpgrade ruby-debuginfoUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygemsUpgrade ruby-tcltkUpgrade rubygem-minitestUpgrade ruby-libsUpgrade ruby-irb | Mar 13, 2018 | Aug 31, 2017 |
| Debian | — | Upgrade ruby1.9.1Upgrade rubygems | Dec 5, 2017 | Aug 31, 2017 |
| Gentoo Linux | — | Upgrade dev-ruby/rubygems. | Oct 30, 2017 | Aug 31, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Mar 16, 2018 | Aug 31, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Mar 16, 2018 | Aug 31, 2017 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Aug 31, 2017 |
| Oracle_linux | — | Upgrade rubygem-jsonUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-rdocUpgrade ruby-tcltkUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade ruby-develUpgrade ruby-docUpgrade rubyUpgrade rubygem-rakeUpgrade rubygem-io-console | Mar 1, 2018 | Sep 1, 2017 |
| Redhat_linux | — | Upgrade ruby-docUpgrade rubygem-minitestUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-tcltkUpgrade rubygems-develUpgrade ruby-develUpgrade rubygem-rakeUpgrade ruby-libsUpgrade rubygem-jsonNo solution existsUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade rubyUpgrade ruby-debuginfoUpgrade rubygems | Mar 1, 2018 | Aug 31, 2017 |
| Suse | — | Upgrade ruby2.1-develUpgrade yast2-ruby-bindingsUpgrade ruby2.1-stdlibUpgrade ruby2.1Upgrade libruby2_1-2_1 | Jun 10, 2020 | Aug 31, 2017 |
| Ubuntu | — | Upgrade ruby1.9.1Upgrade ruby1.9.3Upgrade libruby2.0Upgrade libruby2.3Upgrade ruby2.3Upgrade libruby1.9.1Upgrade ruby2.0 | Oct 5, 2017 | Aug 31, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub