CVE-2018-1000079 — Path Traversal in Rubygems

CWE-22 — Path Traversal13 documents7 sources
Severity
5.5MEDIUMNVD
OSV7.5
EPSS
0.3%
top 45.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
RubygemsJrubyDebian Jruby+1 more
Timeline
PublishedMar 13
Latest updateMay 14

Description

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶debiandebian/rubygems< jruby 9.1.17.0-1 (bookworm)
▶Debianrubygems/rubygems< 3.2.0~rc.1-1+3
▶NVDrubygems/rubygems2.2.9+3
▶debiandebian/jruby< jruby 9.1.17.0-1 (bookworm)
▶Debianjruby/jruby< 9.1.17.0-1+2

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
GHSA
RubyGems Path Traversal vulnerability↗2022-05-14
▶
OSV
RubyGems Path Traversal vulnerability↗2022-05-14
▶
OSV
ruby1.9.1, ruby2.0 regression↗2018-04-13
▶
OSV
ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities↗2018-04-05
▶
OSV
CVE-2018-1000079: RubyGems version Ruby 2↗2018-03-13
▶

📋Vendor Advisories

4
Ubuntu
Ruby regression↗2018-04-13
▶
Ubuntu
Ruby vulnerabilities↗2018-04-05
▶
Red Hat
rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations↗2018-02-15
▶
Debian
CVE-2018-1000079: jruby - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and ...↗2018
▶

💬Community

3
Bugzilla
CVE-2018-1000073 CVE-2018-1000074 CVE-2018-1000075 CVE-2018-1000076 CVE-2018-1000077 CVE-2018-1000078 CVE-2018-1000079 rubygems: various flaws [fedora-all]↗2018-02-21
▶
Bugzilla
CVE-2018-1000079 rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations↗2018-02-21
▶
Bugzilla
CVE-2018-1000073 rubygems: Path traversal when writing to a symlinked basedir outside of the root↗2018-02-21
▶