Vulnerability-Lookup

SUSE-SU-2019:1804-1

Vulnerability from csaf_suse - Published: 2019-07-10 08:40 - Updated: 2026-09-20 13:14

Summary

Security update for ruby-bundled-gems-rpmhelper, ruby2.5

Severity

Important

Notes

Title of the patch: Security update for ruby-bundled-gems-rpmhelper, ruby2.5

Description of the patch: This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues: Changes in ruby2.5: Update to 2.5.5 and 2.5.4: https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed: - CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627) - CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623) - CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622) - CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620) - CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617) - CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611) Ruby 2.5 was updated to 2.5.3: This release includes some bug fixes and some security fixes. Security issues fixed: - CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532) - CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530) Ruby 2.5 was updated to 2.5.1: This release includes some bug fixes and some security fixes. Security issues fixed: - CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434) - CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441) - CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436) - CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433) - CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440) - CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437) - Multiple vulnerabilities in RubyGems were fixed: - CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058) - CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014) - CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011) - CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010) - CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009) - CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008) - CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007) Other changes: - Fixed Net::POPMail methods modify frozen literal when using default arg - ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790) - build with PIE support (bsc#1130028) Changes in ruby-bundled-gems-rpmhelper: - Add a new helper for bundled ruby gems.

Patchnames: SUSE-2019-1804,SUSE-SLE-Module-Basesystem-15-2019-1804,SUSE-SLE-Module-Basesystem-15-SP1-2019-1804,SUSE-SLE-Module-Development-Tools-OBS-15-2019-1804,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-1804

CVE-2017-17742

4.7 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Affected products

Recommended 280 products

Product	Version	Remediation
Unresolved product id: SUSE Enterprise Storage 6:libruby2_5-2_5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:libruby2_5-2_5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:libruby2_5-2_5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:libruby2_5-2_5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-devel-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-devel-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-devel-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-devel-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-devel-extra-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-devel-extra-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-devel-extra-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-devel-extra-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-stdlib-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-stdlib-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-stdlib-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 6:ruby2.5-stdlib-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:libruby2_5-2_5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:libruby2_5-2_5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:libruby2_5-2_5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:libruby2_5-2_5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-devel-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-devel-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-devel-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-devel-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-stdlib-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-stdlib-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-stdlib-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 15:ruby2.5-stdlib-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:libruby2_5-2_5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:libruby2_5-2_5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:libruby2_5-2_5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:libruby2_5-2_5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-devel-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-devel-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-devel-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-devel-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-stdlib-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-stdlib-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-stdlib-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15:ruby2.5-stdlib-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:libruby2_5-2_5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:libruby2_5-2_5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:libruby2_5-2_5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:libruby2_5-2_5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-devel-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-devel-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-devel-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-devel-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-stdlib-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-stdlib-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-stdlib-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15:ruby2.5-stdlib-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:libruby2_5-2_5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:libruby2_5-2_5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:libruby2_5-2_5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:libruby2_5-2_5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-devel-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-devel-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-devel-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-devel-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-stdlib-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-stdlib-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-stdlib-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15:ruby2.5-stdlib-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:libruby2_5-2_5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-devel-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-devel-extra-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP1:ruby2.5-stdlib-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:libruby2_5-2_5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:libruby2_5-2_5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:libruby2_5-2_5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:libruby2_5-2_5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-devel-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-devel-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-devel-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-devel-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-devel-extra-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-stdlib-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-stdlib-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-stdlib-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15:ruby2.5-stdlib-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:libruby2_5-2_5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:libruby2_5-2_5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:libruby2_5-2_5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:libruby2_5-2_5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-devel-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-devel-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-devel-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-devel-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-devel-extra-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-devel-extra-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-devel-extra-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-devel-extra-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-stdlib-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-stdlib-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-stdlib-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Proxy 4.0:ruby2.5-stdlib-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:libruby2_5-2_5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:libruby2_5-2_5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:libruby2_5-2_5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:libruby2_5-2_5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-devel-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-devel-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-devel-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-devel-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-devel-extra-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-devel-extra-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-devel-extra-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-devel-extra-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-stdlib-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-stdlib-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-stdlib-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Retail Branch Server 4.0:ruby2.5-stdlib-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:libruby2_5-2_5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:libruby2_5-2_5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:libruby2_5-2_5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:libruby2_5-2_5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-devel-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-devel-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-devel-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-devel-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-devel-extra-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-devel-extra-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-devel-extra-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-devel-extra-0:2.5.5-4.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-stdlib-0:2.5.5-4.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-stdlib-0:2.5.5-4.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-stdlib-0:2.5.5-4.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Server 4.0:ruby2.5-stdlib-0:2.5.5-4.3.1.x86_64	—	Vendor Fix

Threats

Impact low

CVE-2018-1000073

5.5 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact moderate

CVE-2018-1000074

7.8 (High)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact important

CVE-2018-1000075

3.3 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact low

CVE-2018-1000076

5.5 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact moderate

CVE-2018-1000077

5.5 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact moderate

CVE-2018-1000078

6.1 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact moderate

CVE-2018-1000079

5.5 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact moderate

CVE-2018-16395

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact moderate

CVE-2018-16396

4.8 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact moderate

CVE-2018-6914

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact low

CVE-2018-8777

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact important

CVE-2018-8778

6.5 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact moderate

CVE-2018-8779

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact low

CVE-2018-8780

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact low

CVE-2019-8320

7.4 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact moderate

CVE-2019-8321

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact moderate

CVE-2019-8322

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact moderate

CVE-2019-8323

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact moderate

CVE-2019-8324

7.8 (High)


                
                  CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact moderate

CVE-2019-8325

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 280 products, the same list as for CVE-2017-17742

Threats

Impact moderate

References

101 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1082007	self
https://bugzilla.suse.com/1082008	self
https://bugzilla.suse.com/1082009	self
https://bugzilla.suse.com/1082010	self
https://bugzilla.suse.com/1082011	self
https://bugzilla.suse.com/1082014	self
https://bugzilla.suse.com/1082058	self
https://bugzilla.suse.com/1087433	self
https://bugzilla.suse.com/1087434	self
https://bugzilla.suse.com/1087436	self
https://bugzilla.suse.com/1087437	self
https://bugzilla.suse.com/1087440	self
https://bugzilla.suse.com/1087441	self
https://bugzilla.suse.com/1112530	self
https://bugzilla.suse.com/1112532	self
https://bugzilla.suse.com/1130028	self
https://bugzilla.suse.com/1130611	self
https://bugzilla.suse.com/1130617	self
https://bugzilla.suse.com/1130620	self
https://bugzilla.suse.com/1130622	self
https://bugzilla.suse.com/1130623	self
https://bugzilla.suse.com/1130627	self
https://bugzilla.suse.com/1133790	self
https://www.suse.com/security/cve/CVE-2017-17742/	self
https://www.suse.com/security/cve/CVE-2018-1000073/	self
https://www.suse.com/security/cve/CVE-2018-1000074/	self
https://www.suse.com/security/cve/CVE-2018-1000075/	self
https://www.suse.com/security/cve/CVE-2018-1000076/	self
https://www.suse.com/security/cve/CVE-2018-1000077/	self
https://www.suse.com/security/cve/CVE-2018-1000078/	self
https://www.suse.com/security/cve/CVE-2018-1000079/	self
https://www.suse.com/security/cve/CVE-2018-16395/	self
https://www.suse.com/security/cve/CVE-2018-16396/	self
https://www.suse.com/security/cve/CVE-2018-6914/	self
https://www.suse.com/security/cve/CVE-2018-8777/	self
https://www.suse.com/security/cve/CVE-2018-8778/	self
https://www.suse.com/security/cve/CVE-2018-8779/	self
https://www.suse.com/security/cve/CVE-2018-8780/	self
https://www.suse.com/security/cve/CVE-2019-8320/	self
https://www.suse.com/security/cve/CVE-2019-8321/	self
https://www.suse.com/security/cve/CVE-2019-8322/	self
https://www.suse.com/security/cve/CVE-2019-8323/	self
https://www.suse.com/security/cve/CVE-2019-8324/	self
https://www.suse.com/security/cve/CVE-2019-8325/	self
https://www.suse.com/security/cve/CVE-2017-17742	external
https://bugzilla.suse.com/1087434	external
https://bugzilla.suse.com/1136906	external
https://bugzilla.suse.com/1152992	external
https://www.suse.com/security/cve/CVE-2018-1000073	external
https://bugzilla.suse.com/1082007	external
https://www.suse.com/security/cve/CVE-2018-1000074	external
https://bugzilla.suse.com/1082008	external
https://bugzilla.suse.com/1175764	external
https://www.suse.com/security/cve/CVE-2018-1000075	external
https://bugzilla.suse.com/1082014	external
https://www.suse.com/security/cve/CVE-2018-1000076	external
https://bugzilla.suse.com/1082009	external
https://www.suse.com/security/cve/CVE-2018-1000077	external
https://bugzilla.suse.com/1082010	external
https://bugzilla.suse.com/1183937	external
https://www.suse.com/security/cve/CVE-2018-1000078	external
https://bugzilla.suse.com/1082011	external
https://www.suse.com/security/cve/CVE-2018-1000079	external
https://bugzilla.suse.com/1082058	external
https://www.suse.com/security/cve/CVE-2018-16395	external
https://bugzilla.suse.com/1112530	external
https://bugzilla.suse.com/1136906	external
https://www.suse.com/security/cve/CVE-2018-16396	external
https://bugzilla.suse.com/1112532	external
https://bugzilla.suse.com/1136906	external
https://www.suse.com/security/cve/CVE-2018-6914	external
https://bugzilla.suse.com/1087441	external
https://bugzilla.suse.com/1136906	external
https://www.suse.com/security/cve/CVE-2018-8777	external
https://bugzilla.suse.com/1087436	external
https://bugzilla.suse.com/1136906	external
https://www.suse.com/security/cve/CVE-2018-8778	external
https://bugzilla.suse.com/1087433	external
https://bugzilla.suse.com/1136906	external
https://www.suse.com/security/cve/CVE-2018-8779	external
https://bugzilla.suse.com/1087440	external
https://bugzilla.suse.com/1136906	external
https://www.suse.com/security/cve/CVE-2018-8780	external
https://bugzilla.suse.com/1087437	external
https://bugzilla.suse.com/1136906	external
https://www.suse.com/security/cve/CVE-2019-8320	external
https://bugzilla.suse.com/1130627	external
https://www.suse.com/security/cve/CVE-2019-8321	external
https://bugzilla.suse.com/1130623	external
https://www.suse.com/security/cve/CVE-2019-8322	external
https://bugzilla.suse.com/1130622	external
https://www.suse.com/security/cve/CVE-2019-8323	external
https://bugzilla.suse.com/1130620	external
https://www.suse.com/security/cve/CVE-2019-8324	external
https://bugzilla.suse.com/1130617	external
https://www.suse.com/security/cve/CVE-2019-8325	external
https://bugzilla.suse.com/1130611	external

JSON

To clipboard

Loading 1.7 MB of JSON…

CVE-2017-17742 (GCVE-0-2017-17742)

Vulnerability from cvelistv5 – Published: 2018-04-03 00:00 – Updated: 2024-08-05 20:59

Summary

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

20 references

URL	Tags
https://usn.ubuntu.com/3685-1/	vendor-advisory
https://www.ruby-lang.org/en/news/2018/03/28/ruby…
http://www.securityfocus.com/bid/103684	vdb-entry
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisory
http://www.securitytracker.com/id/1042004	vdb-entry
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisory
https://lists.debian.org/debian-lts-announce/2018…	mailing-list
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisory
https://www.ruby-lang.org/en/news/2018/03/28/http…
https://www.ruby-lang.org/en/news/2018/03/28/ruby…
https://lists.debian.org/debian-lts-announce/2018…	mailing-list
https://www.ruby-lang.org/en/news/2018/03/28/ruby…
https://www.debian.org/security/2018/dsa-4259	vendor-advisory
https://www.ruby-lang.org/en/news/2018/03/28/ruby…
https://lists.debian.org/debian-lts-announce/2018…	mailing-list
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisory
https://lists.debian.org/debian-lts-announce/2019…	mailing-list
https://lists.debian.org/debian-lts-announce/2020…	mailing-list
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Date Public

2018-03-28 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:59:17.715Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3685-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3685-1/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/"
          },
          {
            "name": "103684",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/103684"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "name": "1042004",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1042004"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/"
          },
          {
            "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/"
          },
          {
            "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1359-1] ruby1.8 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "[debian-lts-announce] 20191210 [SECURITY] [DLA 2027-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html"
          },
          {
            "name": "[debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html"
          },
          {
            "name": "[debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-03-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-30T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3685-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/3685-1/"
        },
        {
          "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/"
        },
        {
          "name": "103684",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/103684"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "name": "1042004",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securitytracker.com/id/1042004"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "url": "https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/"
        },
        {
          "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/"
        },
        {
          "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
        },
        {
          "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/"
        },
        {
          "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1359-1] ruby1.8 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "[debian-lts-announce] 20191210 [SECURITY] [DLA 2027-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html"
        },
        {
          "name": "[debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html"
        },
        {
          "name": "[debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-17742",
    "datePublished": "2018-04-03T00:00:00.000Z",
    "dateReserved": "2017-12-18T00:00:00.000Z",
    "dateUpdated": "2024-08-05T20:59:17.715Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1000073 (GCVE-0-2018-1000073)

Vulnerability from cvelistv5 – Published: 2018-03-13 15:00 – Updated: 2024-08-05 12:33

Summary

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

14 references

URL	Tags
https://www.debian.org/security/2018/dsa-4219	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3621-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://github.com/rubygems/rubygems/commit/1b931…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4259	vendor-advisoryx_refsource_DEBIAN
http://blog.rubygems.org/2018/02/15/2.7.6-released.html	x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0542	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0663	vendor-advisoryx_refsource_REDHAT

Date Public

2018-03-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:33:49.113Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4219",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4219"
          },
          {
            "name": "USN-3621-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-1/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/1b931fc03b819b9a0214be3eaca844ef534175e2"
          },
          {
            "name": "[debian-lts-announce] 20180827 [SECURITY] [DLA 1480-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "RHSA-2020:0542",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0542"
          },
          {
            "name": "RHSA-2020:0591",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0591"
          },
          {
            "name": "RHSA-2020:0663",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0663"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-02-18T00:00:00.000Z",
      "datePublic": "2018-03-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-03T18:06:14.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-4219",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4219"
        },
        {
          "name": "USN-3621-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-1/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/1b931fc03b819b9a0214be3eaca844ef534175e2"
        },
        {
          "name": "[debian-lts-announce] 20180827 [SECURITY] [DLA 1480-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "RHSA-2020:0542",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0542"
        },
        {
          "name": "RHSA-2020:0591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0591"
        },
        {
          "name": "RHSA-2020:0663",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0663"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2/18/2018 7:55:29",
          "ID": "CVE-2018-1000073",
          "REQUESTER": "craig.ingram@salesforce.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4219",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4219"
            },
            {
              "name": "USN-3621-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-1/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/1b931fc03b819b9a0214be3eaca844ef534175e2",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/1b931fc03b819b9a0214be3eaca844ef534175e2"
            },
            {
              "name": "[debian-lts-announce] 20180827 [SECURITY] [DLA 1480-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html"
            },
            {
              "name": "DSA-4259",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4259"
            },
            {
              "name": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html",
              "refsource": "MISC",
              "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            },
            {
              "name": "RHSA-2020:0542",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0542"
            },
            {
              "name": "RHSA-2020:0591",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0591"
            },
            {
              "name": "RHSA-2020:0663",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0663"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000073",
    "datePublished": "2018-03-13T15:00:00.000Z",
    "dateReserved": "2018-02-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:33:49.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1000074 (GCVE-0-2018-1000074)

Vulnerability from cvelistv5 – Published: 2018-03-13 15:00 – Updated: 2024-08-05 12:33

Summary

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

18 references

URL	Tags
https://usn.ubuntu.com/3685-1/	vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/3621-2/	vendor-advisoryx_refsource_UBUNTU
https://github.com/rubygems/rubygems/commit/254e3…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4219	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3621-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4259	vendor-advisoryx_refsource_DEBIAN
http://blog.rubygems.org/2018/02/15/2.7.6-released.html	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0542	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0663	vendor-advisoryx_refsource_REDHAT

Date Public

2018-03-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:33:49.164Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3685-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3685-1/"
          },
          {
            "name": "USN-3621-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-2/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d"
          },
          {
            "name": "[debian-lts-announce] 20180417 [SECURITY] [DLA 1352-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00017.html"
          },
          {
            "name": "DSA-4219",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4219"
          },
          {
            "name": "USN-3621-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-1/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "name": "[debian-lts-announce] 20180827 [SECURITY] [DLA 1480-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
          },
          {
            "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "RHSA-2020:0542",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0542"
          },
          {
            "name": "RHSA-2020:0591",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0591"
          },
          {
            "name": "RHSA-2020:0663",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0663"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-02-18T00:00:00.000Z",
      "datePublic": "2018-03-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-03T18:06:20.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3685-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3685-1/"
        },
        {
          "name": "USN-3621-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-2/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d"
        },
        {
          "name": "[debian-lts-announce] 20180417 [SECURITY] [DLA 1352-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00017.html"
        },
        {
          "name": "DSA-4219",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4219"
        },
        {
          "name": "USN-3621-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-1/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "name": "[debian-lts-announce] 20180827 [SECURITY] [DLA 1480-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
        },
        {
          "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "RHSA-2020:0542",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0542"
        },
        {
          "name": "RHSA-2020:0591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0591"
        },
        {
          "name": "RHSA-2020:0663",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0663"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2/18/2018 7:58:35",
          "ID": "CVE-2018-1000074",
          "REQUESTER": "craig.ingram@salesforce.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3685-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3685-1/"
            },
            {
              "name": "USN-3621-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-2/"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d"
            },
            {
              "name": "[debian-lts-announce] 20180417 [SECURITY] [DLA 1352-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00017.html"
            },
            {
              "name": "DSA-4219",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4219"
            },
            {
              "name": "USN-3621-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-1/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "[debian-lts-announce] 20180827 [SECURITY] [DLA 1480-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html"
            },
            {
              "name": "DSA-4259",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4259"
            },
            {
              "name": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html",
              "refsource": "MISC",
              "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
            },
            {
              "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            },
            {
              "name": "RHSA-2020:0542",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0542"
            },
            {
              "name": "RHSA-2020:0591",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0591"
            },
            {
              "name": "RHSA-2020:0663",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0663"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000074",
    "datePublished": "2018-03-13T15:00:00.000Z",
    "dateReserved": "2018-02-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:33:49.164Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1000075 (GCVE-0-2018-1000075)

Vulnerability from cvelistv5 – Published: 2018-03-13 15:00 – Updated: 2024-08-05 12:33

Summary

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

18 references

URL	Tags
https://www.debian.org/security/2018/dsa-4219	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3621-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://github.com/rubygems/rubygems/commit/92e98…	x_refsource_MISC
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4259	vendor-advisoryx_refsource_DEBIAN
http://blog.rubygems.org/2018/02/15/2.7.6-released.html	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0542	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0663	vendor-advisoryx_refsource_REDHAT

Date Public

2018-03-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:33:49.137Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4219",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4219"
          },
          {
            "name": "USN-3621-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-1/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/92e98bf8f810bd812f919120d4832df51bc25d83"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
          },
          {
            "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
          },
          {
            "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
          },
          {
            "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "RHSA-2020:0542",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0542"
          },
          {
            "name": "RHSA-2020:0591",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0591"
          },
          {
            "name": "RHSA-2020:0663",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0663"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-02-18T00:00:00.000Z",
      "datePublic": "2018-03-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-03T18:06:15.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-4219",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4219"
        },
        {
          "name": "USN-3621-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-1/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/92e98bf8f810bd812f919120d4832df51bc25d83"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
        },
        {
          "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
        },
        {
          "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
        },
        {
          "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "RHSA-2020:0542",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0542"
        },
        {
          "name": "RHSA-2020:0591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0591"
        },
        {
          "name": "RHSA-2020:0663",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0663"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2/18/2018 8:01:41",
          "ID": "CVE-2018-1000075",
          "REQUESTER": "craig.ingram@salesforce.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4219",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4219"
            },
            {
              "name": "USN-3621-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-1/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/92e98bf8f810bd812f919120d4832df51bc25d83",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/92e98bf8f810bd812f919120d4832df51bc25d83"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
            },
            {
              "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
            },
            {
              "name": "DSA-4259",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4259"
            },
            {
              "name": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html",
              "refsource": "MISC",
              "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
            },
            {
              "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
            },
            {
              "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            },
            {
              "name": "RHSA-2020:0542",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0542"
            },
            {
              "name": "RHSA-2020:0591",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0591"
            },
            {
              "name": "RHSA-2020:0663",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0663"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000075",
    "datePublished": "2018-03-13T15:00:00.000Z",
    "dateReserved": "2018-02-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:33:49.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1000076 (GCVE-0-2018-1000076)

Vulnerability from cvelistv5 – Published: 2018-03-13 15:00 – Updated: 2024-08-05 12:33

Summary

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

18 references

URL	Tags
https://www.debian.org/security/2018/dsa-4219	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3621-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4259	vendor-advisoryx_refsource_DEBIAN
http://blog.rubygems.org/2018/02/15/2.7.6-released.html	x_refsource_MISC
https://github.com/rubygems/rubygems/commit/f5042…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0542	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0663	vendor-advisoryx_refsource_REDHAT

Date Public

2018-03-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:33:49.167Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4219",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4219"
          },
          {
            "name": "USN-3621-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-1/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
          },
          {
            "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693"
          },
          {
            "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
          },
          {
            "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "RHSA-2020:0542",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0542"
          },
          {
            "name": "RHSA-2020:0591",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0591"
          },
          {
            "name": "RHSA-2020:0663",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0663"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-02-18T00:00:00.000Z",
      "datePublic": "2018-03-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-03T18:06:17.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-4219",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4219"
        },
        {
          "name": "USN-3621-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-1/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
        },
        {
          "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693"
        },
        {
          "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
        },
        {
          "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "RHSA-2020:0542",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0542"
        },
        {
          "name": "RHSA-2020:0591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0591"
        },
        {
          "name": "RHSA-2020:0663",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0663"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2/18/2018 8:04:21",
          "ID": "CVE-2018-1000076",
          "REQUESTER": "craig.ingram@salesforce.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4219",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4219"
            },
            {
              "name": "USN-3621-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-1/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
            },
            {
              "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
            },
            {
              "name": "DSA-4259",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4259"
            },
            {
              "name": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html",
              "refsource": "MISC",
              "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693"
            },
            {
              "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
            },
            {
              "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            },
            {
              "name": "RHSA-2020:0542",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0542"
            },
            {
              "name": "RHSA-2020:0591",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0591"
            },
            {
              "name": "RHSA-2020:0663",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0663"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000076",
    "datePublished": "2018-03-13T15:00:00.000Z",
    "dateReserved": "2018-02-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:33:49.167Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1000077 (GCVE-0-2018-1000077)

Vulnerability from cvelistv5 – Published: 2018-03-13 15:00 – Updated: 2024-08-05 12:33

Summary

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

18 references

URL	Tags
https://www.debian.org/security/2018/dsa-4219	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3621-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4259	vendor-advisoryx_refsource_DEBIAN
https://github.com/rubygems/rubygems/commit/feade…	x_refsource_MISC
http://blog.rubygems.org/2018/02/15/2.7.6-released.html	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0542	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0663	vendor-advisoryx_refsource_REDHAT

Date Public

2018-03-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:33:49.191Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4219",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4219"
          },
          {
            "name": "USN-3621-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-1/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
          },
          {
            "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
          },
          {
            "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
          },
          {
            "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "RHSA-2020:0542",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0542"
          },
          {
            "name": "RHSA-2020:0591",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0591"
          },
          {
            "name": "RHSA-2020:0663",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0663"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-02-18T00:00:00.000Z",
      "datePublic": "2018-03-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-03T18:06:16.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-4219",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4219"
        },
        {
          "name": "USN-3621-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-1/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
        },
        {
          "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
        },
        {
          "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
        },
        {
          "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "RHSA-2020:0542",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0542"
        },
        {
          "name": "RHSA-2020:0591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0591"
        },
        {
          "name": "RHSA-2020:0663",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0663"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2/18/2018 8:06:57",
          "ID": "CVE-2018-1000077",
          "REQUESTER": "craig.ingram@salesforce.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4219",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4219"
            },
            {
              "name": "USN-3621-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-1/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
            },
            {
              "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
            },
            {
              "name": "DSA-4259",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4259"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964"
            },
            {
              "name": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html",
              "refsource": "MISC",
              "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
            },
            {
              "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
            },
            {
              "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            },
            {
              "name": "RHSA-2020:0542",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0542"
            },
            {
              "name": "RHSA-2020:0591",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0591"
            },
            {
              "name": "RHSA-2020:0663",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0663"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000077",
    "datePublished": "2018-03-13T15:00:00.000Z",
    "dateReserved": "2018-02-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:33:49.191Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1000078 (GCVE-0-2018-1000078)

Vulnerability from cvelistv5 – Published: 2018-03-13 15:00 – Updated: 2024-08-05 12:33

Summary

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

18 references

URL	Tags
https://www.debian.org/security/2018/dsa-4219	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3621-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4259	vendor-advisoryx_refsource_DEBIAN
http://blog.rubygems.org/2018/02/15/2.7.6-released.html	x_refsource_MISC
https://github.com/rubygems/rubygems/commit/66a28…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0542	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0663	vendor-advisoryx_refsource_REDHAT

Date Public

2018-03-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:33:49.191Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4219",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4219"
          },
          {
            "name": "USN-3621-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-1/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
          },
          {
            "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb"
          },
          {
            "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
          },
          {
            "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "RHSA-2020:0542",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0542"
          },
          {
            "name": "RHSA-2020:0591",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0591"
          },
          {
            "name": "RHSA-2020:0663",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0663"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-02-18T00:00:00.000Z",
      "datePublic": "2018-03-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-03T18:06:22.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-4219",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4219"
        },
        {
          "name": "USN-3621-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-1/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
        },
        {
          "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb"
        },
        {
          "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
        },
        {
          "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "RHSA-2020:0542",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0542"
        },
        {
          "name": "RHSA-2020:0591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0591"
        },
        {
          "name": "RHSA-2020:0663",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0663"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2/18/2018 8:09:26",
          "ID": "CVE-2018-1000078",
          "REQUESTER": "craig.ingram@salesforce.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4219",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4219"
            },
            {
              "name": "USN-3621-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-1/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "[debian-lts-announce] 20180402 [SECURITY] [DLA 1337-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html"
            },
            {
              "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
            },
            {
              "name": "DSA-4259",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4259"
            },
            {
              "name": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html",
              "refsource": "MISC",
              "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb"
            },
            {
              "name": "[debian-lts-announce] 20180401 [SECURITY] [DLA 1336-1] rubygems security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html"
            },
            {
              "name": "[debian-lts-announce] 20190520 [SECURITY] [DLA 1796-1] jruby security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            },
            {
              "name": "RHSA-2020:0542",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0542"
            },
            {
              "name": "RHSA-2020:0591",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0591"
            },
            {
              "name": "RHSA-2020:0663",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0663"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000078",
    "datePublished": "2018-03-13T15:00:00.000Z",
    "dateReserved": "2018-02-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:33:49.191Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1000079 (GCVE-0-2018-1000079)

Vulnerability from cvelistv5 – Published: 2018-03-13 15:00 – Updated: 2024-08-05 12:33

Summary

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

15 references

URL	Tags
https://www.debian.org/security/2018/dsa-4219	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3621-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://github.com/rubygems/rubygems/commit/666ef…	x_refsource_MISC
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4259	vendor-advisoryx_refsource_DEBIAN
https://github.com/rubygems/rubygems/commit/f83f9…	x_refsource_MISC
http://blog.rubygems.org/2018/02/15/2.7.6-released.html	x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0542	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0663	vendor-advisoryx_refsource_REDHAT

Date Public

2018-03-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:33:49.201Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4219",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4219"
          },
          {
            "name": "USN-3621-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3621-1/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
          },
          {
            "name": "DSA-4259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4259"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          },
          {
            "name": "RHSA-2020:0542",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0542"
          },
          {
            "name": "RHSA-2020:0591",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0591"
          },
          {
            "name": "RHSA-2020:0663",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0663"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-02-18T00:00:00.000Z",
      "datePublic": "2018-03-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-03T18:06:18.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-4219",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4219"
        },
        {
          "name": "USN-3621-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3621-1/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
        },
        {
          "name": "DSA-4259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4259"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        },
        {
          "name": "RHSA-2020:0542",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0542"
        },
        {
          "name": "RHSA-2020:0591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0591"
        },
        {
          "name": "RHSA-2020:0663",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0663"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2/18/2018 8:11:09",
          "ID": "CVE-2018-1000079",
          "REQUESTER": "craig.ingram@salesforce.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4219",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4219"
            },
            {
              "name": "USN-3621-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3621-1/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
            },
            {
              "name": "DSA-4259",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4259"
            },
            {
              "name": "https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759"
            },
            {
              "name": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html",
              "refsource": "MISC",
              "url": "http://blog.rubygems.org/2018/02/15/2.7.6-released.html"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            },
            {
              "name": "RHSA-2020:0542",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0542"
            },
            {
              "name": "RHSA-2020:0591",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0591"
            },
            {
              "name": "RHSA-2020:0663",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0663"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000079",
    "datePublished": "2018-03-13T15:00:00.000Z",
    "dateReserved": "2018-02-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:33:49.201Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-16395 (GCVE-0-2018-16395)

Vulnerability from cvelistv5 – Published: 2018-11-16 18:00 – Updated: 2024-08-05 10:24

Summary

An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

19 references

URL	Tags
https://www.ruby-lang.org/en/news/2018/10/17/open…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:3738	vendor-advisoryx_refsource_REDHAT
https://www.ruby-lang.org/en/news/2018/11/06/ruby…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://hackerone.com/reports/387250	x_refsource_MISC
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://www.ruby-lang.org/en/news/2018/10/17/ruby…	x_refsource_CONFIRM
https://www.debian.org/security/2018/dsa-4332	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3808-1/	vendor-advisoryx_refsource_UBUNTU
https://www.ruby-lang.org/en/news/2018/10/17/ruby…	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2019022…	x_refsource_CONFIRM
https://www.ruby-lang.org/en/news/2018/10/17/ruby…	x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
http://www.securitytracker.com/id/1042105	vdb-entryx_refsource_SECTRACK
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:1948	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2565	vendor-advisoryx_refsource_REDHAT
https://www.oracle.com/security-alerts/cpujan2020.html	x_refsource_MISC

Date Public

2018-10-17 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:24:32.106Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/"
          },
          {
            "name": "RHSA-2018:3738",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3738"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/387250"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/"
          },
          {
            "name": "DSA-4332",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4332"
          },
          {
            "name": "USN-3808-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3808-1/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190221-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/"
          },
          {
            "name": "[debian-lts-announce] 20181028 [SECURITY] [DLA 1558-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html"
          },
          {
            "name": "1042105",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1042105"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:1948",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1948"
          },
          {
            "name": "RHSA-2019:2565",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2565"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-10-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-15T19:15:22.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/"
        },
        {
          "name": "RHSA-2018:3738",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3738"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/387250"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/"
        },
        {
          "name": "DSA-4332",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4332"
        },
        {
          "name": "USN-3808-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3808-1/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190221-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/"
        },
        {
          "name": "[debian-lts-announce] 20181028 [SECURITY] [DLA 1558-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html"
        },
        {
          "name": "1042105",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1042105"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:1948",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1948"
        },
        {
          "name": "RHSA-2019:2565",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2565"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-16395",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/"
            },
            {
              "name": "RHSA-2018:3738",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3738"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "https://hackerone.com/reports/387250",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/387250"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/"
            },
            {
              "name": "DSA-4332",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4332"
            },
            {
              "name": "USN-3808-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3808-1/"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190221-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190221-0002/"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/"
            },
            {
              "name": "[debian-lts-announce] 20181028 [SECURITY] [DLA 1558-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html"
            },
            {
              "name": "1042105",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1042105"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:1948",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1948"
            },
            {
              "name": "RHSA-2019:2565",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2565"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-16395",
    "datePublished": "2018-11-16T18:00:00.000Z",
    "dateReserved": "2018-09-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T10:24:32.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-16396 (GCVE-0-2018-16396)

Vulnerability from cvelistv5 – Published: 2018-11-16 18:00 – Updated: 2024-08-05 10:24

Summary

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

16 references

URL	Tags
https://hackerone.com/reports/385070	x_refsource_MISC
https://www.ruby-lang.org/en/news/2018/11/06/ruby…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:3729	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3730	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3731	vendor-advisoryx_refsource_REDHAT
https://www.ruby-lang.org/en/news/2018/10/17/ruby…	x_refsource_CONFIRM
https://www.debian.org/security/2018/dsa-4332	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3808-1/	vendor-advisoryx_refsource_UBUNTU
https://www.ruby-lang.org/en/news/2018/10/17/ruby…	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2019022…	x_refsource_CONFIRM
https://www.ruby-lang.org/en/news/2018/10/17/not-…	x_refsource_CONFIRM
https://www.ruby-lang.org/en/news/2018/10/17/ruby…	x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
http://www.securitytracker.com/id/1042106	vdb-entryx_refsource_SECTRACK
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2028	vendor-advisoryx_refsource_REDHAT

Date Public

2018-10-17 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:24:32.115Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/385070"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/"
          },
          {
            "name": "RHSA-2018:3729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3729"
          },
          {
            "name": "RHSA-2018:3730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3730"
          },
          {
            "name": "RHSA-2018:3731",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3731"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/"
          },
          {
            "name": "DSA-4332",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4332"
          },
          {
            "name": "USN-3808-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3808-1/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190221-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/"
          },
          {
            "name": "[debian-lts-announce] 20181028 [SECURITY] [DLA 1558-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html"
          },
          {
            "name": "1042106",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1042106"
          },
          {
            "name": "openSUSE-SU-2019:1771",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
          },
          {
            "name": "RHSA-2019:2028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2028"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-10-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-08-06T16:06:27.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/385070"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/"
        },
        {
          "name": "RHSA-2018:3729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3729"
        },
        {
          "name": "RHSA-2018:3730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3730"
        },
        {
          "name": "RHSA-2018:3731",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3731"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/"
        },
        {
          "name": "DSA-4332",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4332"
        },
        {
          "name": "USN-3808-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3808-1/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190221-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/"
        },
        {
          "name": "[debian-lts-announce] 20181028 [SECURITY] [DLA 1558-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html"
        },
        {
          "name": "1042106",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1042106"
        },
        {
          "name": "openSUSE-SU-2019:1771",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
        },
        {
          "name": "RHSA-2019:2028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2028"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-16396",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/385070",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/385070"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/"
            },
            {
              "name": "RHSA-2018:3729",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3729"
            },
            {
              "name": "RHSA-2018:3730",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3730"
            },
            {
              "name": "RHSA-2018:3731",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3731"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/"
            },
            {
              "name": "DSA-4332",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4332"
            },
            {
              "name": "USN-3808-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3808-1/"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190221-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190221-0002/"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/"
            },
            {
              "name": "[debian-lts-announce] 20181028 [SECURITY] [DLA 1558-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html"
            },
            {
              "name": "1042106",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1042106"
            },
            {
              "name": "openSUSE-SU-2019:1771",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html"
            },
            {
              "name": "RHSA-2019:2028",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2028"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-16396",
    "datePublished": "2018-11-16T18:00:00.000Z",
    "dateReserved": "2018-09-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T10:24:32.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2019:1804-1

CVE-2017-17742 (GCVE-0-2017-17742)

CVE-2018-1000073 (GCVE-0-2018-1000073)

CVE-2018-1000074 (GCVE-0-2018-1000074)

CVE-2018-1000075 (GCVE-0-2018-1000075)

CVE-2018-1000076 (GCVE-0-2018-1000076)

CVE-2018-1000077 (GCVE-0-2018-1000077)

CVE-2018-1000078 (GCVE-0-2018-1000078)

CVE-2018-1000079 (GCVE-0-2018-1000079)

CVE-2018-16395 (GCVE-0-2018-16395)

CVE-2018-16396 (GCVE-0-2018-16396)

Tags

Sightings

Nomenclature

Related by attack behaviour