An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-mongo-docUpgrade rubygem-mongoUpgrade rubygem-abrtUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade rubygem-mysql2-doc | May 13, 2022 | Jun 17, 2019 |
| Alpine Linux | — | Upgrade ruby | Jun 17, 2019 | Jun 17, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-io-consoleUpgrade ruby-irbUpgrade ruby-tcltkUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubyUpgrade ruby-libsUpgrade rubygem-jsonUpgrade ruby-docUpgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-rdoc | Apr 27, 2020 | Jun 17, 2019 |
| Amazon_linux | — | Upgrade ruby24Upgrade ruby21Upgrade ruby20 | Aug 13, 2019 | Mar 5, 2019 |
| Centos_linux | — | Upgrade ruby-irbUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-tcltkUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-docUpgrade ruby-develUpgrade rubygem-abrtUpgrade rubygem-net-telnetUpgrade rubygem-pg-debuginfoUpgrade ruby-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-bson-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-bson-debugsourceUpgrade rubygem-mongoUpgrade rubygem-abrt-docUpgrade ruby-libsUpgrade rubygem-pgUpgrade rubygem-jsonUpgrade rubygem-bundlerUpgrade rubygem-opensslUpgrade rubygem-mysql2-debugsourceUpgrade rubygems-develUpgrade rubygem-json-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-did_you_meanUpgrade rubygem-rdocUpgrade rubygem-test-unitUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-bson-docUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygem-mysql2-docUpgrade ruby-docUpgrade rubygem-bsonUpgrade rubygem-rakeUpgrade rubygem-bundler-docUpgrade rubygem-io-consoleUpgrade rubygem-xmlrpc | May 23, 2019 | Mar 5, 2019 |
| Debian | — | Upgrade rubygemsUpgrade jruby | Apr 1, 2019 | Apr 1, 2019 |
| Freebsd | — | Upgrade ruby24-gemsUpgrade ruby23-gemsUpgrade ruby25-gems | Mar 16, 2019 | Mar 15, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-21/ruby-tk to version 2.1.6-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.0-11.4.11.0.1.3.0 on Solaris 11.4Upgrade runtime/ruby-21 to version 2.1.6-11.4.11.0.1.3.0 on Solaris 11.4 | Jul 17, 2019 | Jun 17, 2019 |
| Oracle_linux | — | Upgrade rubygem-pg-docUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade rubyUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-abrtUpgrade rubygem-did_you_meanUpgrade ruby-tcltkUpgrade rubygem-rdocUpgrade ruby-irbUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2Upgrade rubygem-mongo-docUpgrade rubygem-bson-docUpgrade rubygem-xmlrpcUpgrade rubygem-psychUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade rubygem-jsonUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygem-bundler-docUpgrade rubygem-bsonUpgrade rubygem-test-unitUpgrade rubygem-minitest | May 16, 2019 | Mar 5, 2019 |
| Redhat_linux | — | Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-did_you_meanUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-opensslUpgrade rubygem-test-unitUpgrade rubygem-pg-debugsourceUpgrade rubygem-bsonUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygem-psych-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-mongo-docUpgrade rubyUpgrade ruby-irbUpgrade rubygem-xmlrpcUpgrade rubygem-bigdecimalUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mongoUpgrade ruby-debugsourceUpgrade rubygem-abrt-docUpgrade rubygems-develUpgrade rubygem-io-console-debuginfoUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade rubygem-power_assertUpgrade rubygem-rdocUpgrade rubygem-bson-docUpgrade rubygem-bundler-docUpgrade ruby-tcltk | May 16, 2019 | May 15, 2019 |
| Rocky_linux | — | Upgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-bson-debuginfoUpgrade rubygem-pgUpgrade rubygem-bsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debugsource | Mar 12, 2024 | Jun 17, 2019 |
| Suse | — | Upgrade ruby2.5-stdlibUpgrade libruby2_1-2_1Upgrade ruby2.5-devel-extraUpgrade ruby2.5-docUpgrade ruby2.5-doc-riUpgrade ruby2.1-develUpgrade ruby2.1Upgrade libruby2_5-2_5Upgrade yast2-ruby-bindingsUpgrade ruby2.1-stdlibUpgrade ruby2.5Upgrade ruby2.5-develUpgrade ruby-bundled-gems-rpmhelper | Jul 22, 2019 | Mar 5, 2019 |
| Ubuntu | — | Upgrade libruby1.9.1Upgrade libruby2.0Upgrade libruby2.5Upgrade libruby2.3Upgrade ruby2.3Upgrade ruby1.9.1Upgrade ruby1.9.3Upgrade ruby2.0Upgrade ruby2.5 | Apr 24, 2019 | Mar 5, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub