An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-pg-docUpgrade rubygem-abrtUpgrade rubygem-pgUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-docUpgrade rubygem-bsonUpgrade rubygem-mongoUpgrade rubygem-mysql2Upgrade rubygem-bson-docUpgrade rubygem-abrt-doc | May 13, 2022 | Jun 17, 2019 |
| Alpine Linux | — | Upgrade ruby | Jun 17, 2019 | Jun 17, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygems-develUpgrade rubygemsUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade ruby-develUpgrade rubygem-rdocUpgrade ruby-libsUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade ruby-tcltkUpgrade rubygem-jsonUpgrade rubygem-minitestUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade ruby | Apr 27, 2020 | Jun 17, 2019 |
| Amazon_linux | — | Upgrade ruby20Upgrade ruby24Upgrade ruby21 | Aug 13, 2019 | Mar 5, 2019 |
| Centos_linux | — | Upgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubyUpgrade ruby-irbUpgrade ruby-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygemsUpgrade ruby-tcltkUpgrade rubygem-abrtUpgrade rubygem-jsonUpgrade ruby-libsUpgrade ruby-libs-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bundlerUpgrade rubygem-pgUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-power_assertUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-abrt-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-psychUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-did_you_meanUpgrade rubygem-mongo-docUpgrade ruby-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-bson-docUpgrade rubygem-bsonUpgrade rubygem-json-debuginfoUpgrade rubygem-rdocUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-test-unit | May 23, 2019 | Mar 5, 2019 |
| Debian | — | Upgrade rubygemsUpgrade jruby | Apr 1, 2019 | Apr 1, 2019 |
| Freebsd | — | Upgrade ruby23-gemsUpgrade ruby24-gemsUpgrade ruby25-gems | Mar 16, 2019 | Mar 15, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.0-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-21 to version 2.1.6-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-21/ruby-tk to version 2.1.6-11.4.11.0.1.3.0 on Solaris 11.4 | Jul 17, 2019 | Jun 17, 2019 |
| Oracle_linux | — | Upgrade rubygem-opensslUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-xmlrpcUpgrade rubygem-net-telnetUpgrade rubygem-bsonUpgrade rubygemsUpgrade rubygem-bson-docUpgrade rubygem-bundler-docUpgrade rubygem-test-unitUpgrade rubygem-minitestUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade rubygem-mysql2-docUpgrade ruby-irbUpgrade rubygem-pg-docUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade ruby-tcltkUpgrade rubygem-abrtUpgrade rubygem-mongo-docUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade ruby-docUpgrade ruby | May 16, 2019 | Mar 5, 2019 |
| Redhat_linux | — | Upgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-docUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-bundlerUpgrade rubygem-mongo-docUpgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade ruby-docUpgrade rubygem-test-unitUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade rubygem-opensslUpgrade rubygem-xmlrpcUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debugsourceUpgrade rubygems-develUpgrade ruby-libs-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-pgUpgrade rubygem-bundler-docUpgrade rubygem-rdocUpgrade rubygem-bson-debugsourceUpgrade rubygem-mongoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-net-telnetUpgrade rubygem-bson-docUpgrade rubygem-io-console-debuginfoUpgrade rubygems | May 16, 2019 | May 15, 2019 |
| Rocky_linux | — | Upgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade rubygem-mysql2 | Mar 12, 2024 | Jun 17, 2019 |
| Suse | — | Upgrade ruby2.5-develUpgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.5Upgrade ruby2.5-doc-riUpgrade libruby2_5-2_5Upgrade ruby2.1-develUpgrade ruby2.1Upgrade ruby2.5-devel-extraUpgrade libruby2_1-2_1Upgrade ruby2.5-stdlibUpgrade ruby2.1-stdlibUpgrade ruby2.5-docUpgrade yast2-ruby-bindings | Jul 22, 2019 | Mar 5, 2019 |
| Ubuntu | — | Upgrade ruby2.3Upgrade libruby2.0Upgrade libruby2.3Upgrade libruby2.5Upgrade libruby1.9.1Upgrade ruby1.9.1Upgrade ruby2.5Upgrade ruby1.9.3Upgrade ruby2.0 | Apr 24, 2019 | Mar 5, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub