An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-docUpgrade rubygem-abrtUpgrade rubygem-mongoUpgrade rubygem-mongo-docUpgrade rubygem-pg-docUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade rubygem-mysql2 | May 13, 2022 | Jun 17, 2019 |
| Alpine Linux | — | Upgrade ruby | Jun 17, 2019 | Jun 17, 2019 |
| Amazon Linux Ami 2 | — | Upgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade rubygemsUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade rubygem-io-consoleUpgrade rubyUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade ruby-docUpgrade ruby-irb | Apr 27, 2020 | Jun 17, 2019 |
| Amazon_linux | — | Upgrade ruby24Upgrade ruby21Upgrade ruby20 | Aug 13, 2019 | Mar 5, 2019 |
| Centos_linux | — | Upgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2Upgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygem-pg-debuginfoUpgrade rubygem-net-telnetUpgrade ruby-develUpgrade rubyUpgrade rubygem-minitestUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-tcltkUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-irbUpgrade rubygem-pg-docUpgrade ruby-libsUpgrade ruby-libs-debuginfoUpgrade rubygem-bundlerUpgrade ruby-debugsourceUpgrade rubygem-mongoUpgrade rubygem-pgUpgrade rubygem-abrtUpgrade rubygem-pg-debugsourceUpgrade rubygem-jsonUpgrade rubygem-opensslUpgrade rubygem-abrt-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-did_you_meanUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson-docUpgrade rubygem-bsonUpgrade ruby-docUpgrade rubygem-bundler-docUpgrade rubygem-xmlrpcUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade rubygem-psych | May 23, 2019 | Mar 5, 2019 |
| Debian | — | Upgrade rubygemsUpgrade jruby | Apr 1, 2019 | Apr 1, 2019 |
| Freebsd | — | Upgrade ruby24-gemsUpgrade ruby23-gemsUpgrade ruby25-gems | Mar 16, 2019 | Mar 15, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-21/ruby-tk to version 2.1.6-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.0-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-21 to version 2.1.6-11.4.11.0.1.3.0 on Solaris 11.4 | Jul 17, 2019 | Jun 17, 2019 |
| Oracle_linux | — | Upgrade ruby-tcltkUpgrade rubygem-bigdecimalUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2Upgrade ruby-irbUpgrade rubygem-mongo-docUpgrade rubygem-rakeUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-pg-docUpgrade rubyUpgrade ruby-docUpgrade rubygem-pgUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-mongoUpgrade rubygem-bson-docUpgrade rubygem-xmlrpcUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-bsonUpgrade rubygem-test-unitUpgrade rubygem-bundler-docUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade rubygem-opensslUpgrade rubygem-json | May 16, 2019 | Mar 5, 2019 |
| Redhat_linux | — | Upgrade rubygem-did_you_meanUpgrade rubygem-abrtUpgrade rubygem-test-unitUpgrade rubygem-pg-debugsourceUpgrade rubygem-bsonUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-docUpgrade ruby-libsUpgrade rubygem-pg-debuginfoUpgrade rubygem-opensslUpgrade rubyUpgrade ruby-irbUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2Upgrade ruby-develUpgrade ruby-docUpgrade rubygem-bundlerUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-jsonUpgrade rubygem-mongo-docUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-power_assertUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade ruby-libs-debuginfoUpgrade rubygemsUpgrade ruby-tcltkUpgrade rubygem-bundler-docUpgrade rubygems-develUpgrade rubygem-io-console-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mongoUpgrade rubygem-bigdecimal-debuginfo | May 16, 2019 | May 15, 2019 |
| Rocky_linux | — | Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bsonUpgrade rubygem-bson-debuginfoUpgrade rubygem-pgUpgrade rubygem-mysql2 | Mar 12, 2024 | Jun 17, 2019 |
| Suse | — | Upgrade ruby2.5-stdlibUpgrade yast2-ruby-bindingsUpgrade ruby2.5-doc-riUpgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.1-develUpgrade libruby2_1-2_1Upgrade ruby2.5-docUpgrade ruby2.1-stdlibUpgrade ruby2.1Upgrade ruby2.5Upgrade ruby2.5-develUpgrade ruby-bundled-gems-rpmhelper | Jul 22, 2019 | Mar 5, 2019 |
| Ubuntu | — | Upgrade ruby2.5Upgrade ruby2.0Upgrade ruby1.9.3Upgrade libruby2.3Upgrade ruby1.9.1Upgrade libruby2.5Upgrade ruby2.3Upgrade libruby2.0Upgrade libruby1.9.1 | Apr 24, 2019 | Mar 5, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub