CVE-2018-1000079
Description
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.
Risk Information
Base Score
5.5
MODERATE
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
0.316
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Multiple vulnerabilities are fixed in Ruby-rubygems-update 2.7.6 | Windows |
| Multiple vulnerabilities are fixed in JRuby-jruby-stdlib 9.1.16.0 | Windows |
| (RHSA-2019:2028) ruby security update ruby-2.0.0.648-36.el7.x86_64.rpm | Linux |
| (RHSA-2019:2028) ruby security update ruby-devel-2.0.0.648-36.el7.x86_64.rpm | Linux |
| (RHSA-2019:2028) ruby security update ruby-doc-2.0.0.648-36.el7.noarch.rpm | Linux |
| (RHSA-2019:2028) ruby security update ruby-irb-2.0.0.648-36.el7.noarch.rpm | Linux |
| (RHSA-2019:2028) ruby security update ruby-libs-2.0.0.648-36.el7.i686.rpm | Linux |
| (RHSA-2019:2028) ruby security update ruby-libs-2.0.0.648-36.el7.x86_64.rpm | Linux |
| (RHSA-2019:2028) ruby security update ruby-tcltk-2.0.0.648-36.el7.x86_64.rpm | Linux |
| (RHSA-2019:2028) ruby security update rubygem-bigdecimal-1.2.0-36.el7.x86_64.rpm | Linux |
| (RHSA-2019:2028) ruby security update rubygem-io-console-0.4.2-36.el7.x86_64.rpm | Linux |
| (RHSA-2019:2028) ruby security update rubygem-json-1.7.7-36.el7.x86_64.rpm | Linux |
| (RHSA-2019:2028) ruby security update rubygem-minitest-4.3.2-36.el7.noarch.rpm | Linux |
| (RHSA-2019:2028) ruby security update rubygem-psych-2.0.0-36.el7.x86_64.rpm | Linux |
| (RHSA-2019:2028) ruby security update rubygem-rake-0.9.6-36.el7.noarch.rpm | Linux |
| (RHSA-2019:2028) ruby security update rubygem-rdoc-4.0.0-36.el7.noarch.rpm | Linux |
| (RHSA-2019:2028) ruby security update rubygems-2.0.14.1-36.el7.noarch.rpm | Linux |
| (RHSA-2019:2028) ruby security update rubygems-devel-2.0.14.1-36.el7.noarch.rpm | Linux |
| SUSE-SU-2020:1570-1(SUSE Linux Enterprise Server 12-SP4 ) libruby2_1-2_1-2.1.9-19.3.2.x86_64.rpm | Linux |
| SUSE-SU-2020:1570-1(SUSE Linux Enterprise Server 12-SP4 ) libruby2_1-2_1-debuginfo-2.1.9-19.3.2.x86_64.rpm | Linux |
| SUSE-SU-2020:1570-1(SUSE Linux Enterprise Server 12-SP4 ) ruby2.1-2.1.9-19.3.2.x86_64.rpm | Linux |
| SUSE-SU-2020:1570-1(SUSE Linux Enterprise Server 12-SP4 ) ruby2.1-debuginfo-2.1.9-19.3.2.x86_64.rpm | Linux |
| SUSE-SU-2020:1570-1(SUSE Linux Enterprise Server 12-SP4 ) ruby2.1-debugsource-2.1.9-19.3.2.x86_64.rpm | Linux |
| SUSE-SU-2020:1570-1(SUSE Linux Enterprise Server 12-SP4 ) ruby2.1-stdlib-2.1.9-19.3.2.x86_64.rpm | Linux |
| SUSE-SU-2020:1570-1(SUSE Linux Enterprise Server 12-SP4 ) ruby2.1-stdlib-debuginfo-2.1.9-19.3.2.x86_64.rpm | Linux |
| SUSE-SU-2020:1570-1(SUSE Linux Enterprise Server 12-SP5 ) libruby2_1-2_1-2.1.9-19.3.2.x86_64_SP5.rpm | Linux |
| SUSE-SU-2020:1570-1(SUSE Linux Enterprise Server 12-SP5 ) libruby2_1-2_1-debuginfo-2.1.9-19.3.2.x86_64_SP5.rpm | Linux |
| SUSE-SU-2020:1570-1(SUSE Linux Enterprise Server 12-SP5 ) ruby2.1-2.1.9-19.3.2.x86_64_SP5.rpm | Linux |
| SUSE-SU-2020:1570-1(SUSE Linux Enterprise Server 12-SP5 ) ruby2.1-debuginfo-2.1.9-19.3.2.x86_64_SP5.rpm | Linux |
| SUSE-SU-2020:1570-1(SUSE Linux Enterprise Server 12-SP5 ) ruby2.1-debugsource-2.1.9-19.3.2.x86_64_SP5.rpm | Linux |
| SUSE-SU-2020:1570-1(SUSE Linux Enterprise Server 12-SP5 ) ruby2.1-stdlib-2.1.9-19.3.2.x86_64_SP5.rpm | Linux |
| SUSE-SU-2020:1570-1(SUSE Linux Enterprise Server 12-SP5 ) ruby2.1-stdlib-debuginfo-2.1.9-19.3.2.x86_64_SP5.rpm | Linux |
| (RHSA-2019:2028)Moderate: security update ruby-debuginfo-2.0.0.648-36.el7.i686.rpm | Linux |
| (RHSA-2019:2028)Moderate: security update ruby-debuginfo-2.0.0.648-36.el7.x86_64.rpm | Linux |
| Ruby update (ELSA-2019-2028) ruby-2.0.0.648-36.el7.x86_64.rpm | Linux |
| Ruby-irb update (ELSA-2019-2028) ruby-irb-2.0.0.648-36.el7.noarch.rpm | Linux |
| Ruby-libs update (ELSA-2019-2028) ruby-libs-2.0.0.648-36.el7.i686.rpm | Linux |
| Ruby-libs update (ELSA-2019-2028) ruby-libs-2.0.0.648-36.el7.x86_64.rpm | Linux |
| Rubygem-bigdecimal update (ELSA-2019-2028) rubygem-bigdecimal-1.2.0-36.el7.x86_64.rpm | Linux |
| Rubygem-io-console update (ELSA-2019-2028) rubygem-io-console-0.4.2-36.el7.x86_64.rpm | Linux |
| Rubygem-json update (ELSA-2019-2028) rubygem-json-1.7.7-36.el7.x86_64.rpm | Linux |
| Rubygem-psych update (ELSA-2019-2028) rubygem-psych-2.0.0-36.el7.x86_64.rpm | Linux |
| Rubygem-rdoc update (ELSA-2019-2028) rubygem-rdoc-4.0.0-36.el7.noarch.rpm | Linux |
| Rubygems update (ELSA-2019-2028) rubygems-2.0.14.1-36.el7.noarch.rpm | Linux |
| Multiple vulnerabilities are fixed in Ruby-rubygems-update for Linux 2.7.6 | Linux |
| Multiple vulnerabilities are fixed in JRuby-jruby-stdlib for Linux 9.1.16.0 | Linux |
| Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) Vulnerability (CVE-2018-1000079) | NCM |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234