Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
25 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.
Recommended action: Upgrade to 1.8.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
Recommended action: Upgrade to 1.8.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Algorithmic complexity vulnerability in Gem::Version::ANCHOREDVERSIONPATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
Recommended action: Upgrade to 2.1.5, 2.0.10, 1.8.27 or 1.8.23.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.3.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3900.
Recommended action: Upgrade to 2.4.8, 2.2.5 or 2.0.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem writing to arbitrary filesystem locations during installation. This attack appears to be exploitable via installation of a malicious gem. This vulnerability is fixed in 2.7.6.
Recommended action: Upgrade to 2.7.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
Recommended action: Upgrade to 2.4.7, 2.2.4 or 2.0.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Algorithmic complexity vulnerability in Gem::Version::VERSIONPATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
Recommended action: Upgrade to 2.1.0, 2.0.8, 1.8.26 or 1.8.23.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
RubyGems versions 2.6.12 and earlier are vulnerable to maliciously crafted gem specifications that cause a denial of service attack against RubyGems clients who have issued a query command.
Recommended action: Upgrade to 2.6.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack requires the victim to run the gem owner command on a gem with a specially crafted YAML file. This vulnerability is fixed in 2.7.6.
Recommended action: Upgrade to 2.7.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, and Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contain an Improper Verification of Cryptographic Signature vulnerability in package.rb. This can result in a mis-signed gem being installed, as the tarball would contain multiple gem signatures. This vulnerability has been fixed in 2.7.6.
Recommended action: Upgrade to 2.7.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem setting an invalid homepage URL. This vulnerability is fixed in 2.7.6.
Recommended action: Upgrade to 2.7.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack requires the victim to browse to a malicious gem on a vulnerable gem server. This vulnerability is fixed in 2.7.6.
Recommended action: Upgrade to 2.7.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.
Recommended action: Upgrade to 2.7.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
RubyGems versions 2.6.12 and earlier fail to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
Recommended action: Upgrade to 2.6.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution. The issue has been patched in 2.6.14.
Recommended action: Upgrade to 2.6.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
RubyGems prior to 2.6.13 is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
Recommended action: Upgrade to 2.6.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.
Recommended action: Upgrade to 2.6.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in installlocation function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.
Recommended action: Upgrade to 2.7.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The extractfiles function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.
Recommended action: Upgrade to 0.9.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alerterror without escaping, escape sequence injection is possible. (There are many ways to cause an error.)
Recommended action: Upgrade to 3.0.2 or 2.7.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.
Recommended action: Upgrade to 3.0.3 or 2.7.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensureloadablespec during the preinstall check.
Recommended action: Upgrade to 3.0.2 or 2.7.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
Recommended action: Upgrade to 3.0.2 or 2.7.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
Recommended action: Upgrade to 3.0.2 or 2.7.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#withresponse may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.
Recommended action: Upgrade to 3.0.2 or 2.7.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.