crítica
CVE-2018-1000076
rubygems: Improper verification of signatures in tarball allows to install mis-signed gem
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Ruby Advisory DB. Más baja según Red Hat (media), Amazon (media), Oracle (media), Ubuntu (baja).
Descripción
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.jruby:jruby-stdlib | 9.1.16.0 |
| rubygems::GitHub Security Advisory RubyGems | rubygems-update | 2.7.6 |
| rubygems::Ruby Advisory Database | rubygems-update | >= 2.7.6 |
| amazon linux 1 | ruby20, ruby20-debuginfo, ruby20-devel y 46 más | 2.0.0.648-1.31.amzn1 y 24 más |
| amazon linux 2 | ruby, ruby-debuginfo, ruby-devel y 13 más | 2.0.0.648-36.amzn2.0.1 y 8 más |
| debian 11 | rubygems | 3.2.0~rc.1-1 |
| debian 12 | jruby, rubygems | 9.1.17.0-1 y 1 más |
| debian 13 | jruby, rubygems | 9.1.17.0-1 y 1 más |
| debian 14 | jruby, rubygems | 9.1.17.0-1 y 1 más |
| debian 7 | jruby, ruby1.9.1, rubygems | 1.5.6-5+deb7u1 y 2 más |
| debian 8 | jruby, ruby2.1 | 1.5.6-9+deb8u1 y 1 más |
| debian 9 | jruby, ruby2.3 | 1.7.26-1+deb9u1 y 1 más |
Mostrar las 110 entradas de 25 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.jruby:jruby-stdlib | 9.1.16.0 |
| rubygems::GitHub Security Advisory RubyGems | rubygems-update | 2.7.6 |
| rubygems::Ruby Advisory Database | rubygems-update | >= 2.7.6 |
| amazon linux 1 | ruby20 | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-debuginfo | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-devel | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-doc | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-irb | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-libs | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby22 | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-debuginfo | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-devel | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-doc | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-irb | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-libs | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby23 | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-debuginfo | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-devel | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-doc | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-irb | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-libs | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby24 | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-debuginfo | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-devel | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-doc | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-irb | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-libs | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | rubygem20-bigdecimal | 1.2.0-1.31.amzn1 |
| amazon linux 1 | rubygem20-io-console | 0.4.2-1.31.amzn1 |
| amazon linux 1 | rubygem20-psych | 2.0.0-1.31.amzn1 |
| amazon linux 1 | rubygem22-bigdecimal | 1.2.6-1.11.amzn1 |
| amazon linux 1 | rubygem22-io-console | 0.4.3-1.11.amzn1 |
| amazon linux 1 | rubygem22-psych | 2.0.8.1-1.11.amzn1 |
| amazon linux 1 | rubygem23-bigdecimal | 1.2.8-1.19.amzn1 |
| amazon linux 1 | rubygem23-did_you_mean | 1.0.0-1.19.amzn1 |
| amazon linux 1 | rubygem23-io-console | 0.4.5-1.19.amzn1 |
| amazon linux 1 | rubygem23-json | 1.8.3.1-1.19.amzn1 |
| amazon linux 1 | rubygem23-psych | 2.1.0.1-1.19.amzn1 |
| amazon linux 1 | rubygem24-bigdecimal | 1.3.2-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-did_you_mean | 1.1.0-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-io-console | 0.4.6-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-json | 2.0.4-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-psych | 2.2.2-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-xmlrpc | 0.2.1-1.30.6.amzn1 |
| amazon linux 1 | rubygems20 | 2.0.14.1-1.31.amzn1 |
| amazon linux 1 | rubygems20-devel | 2.0.14.1-1.31.amzn1 |
| amazon linux 1 | rubygems22 | 2.4.5.2-1.11.amzn1 |
| amazon linux 1 | rubygems22-devel | 2.4.5.2-1.11.amzn1 |
| amazon linux 1 | rubygems23 | 2.5.2.3-1.19.amzn1 |
| amazon linux 1 | rubygems23-devel | 2.5.2.3-1.19.amzn1 |
| amazon linux 1 | rubygems24 | 2.6.14.1-1.30.6.amzn1 |
| amazon linux 1 | rubygems24-devel | 2.6.14.1-1.30.6.amzn1 |
| amazon linux 2 | ruby | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-debuginfo | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-devel | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-doc | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-irb | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-libs | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-tcltk | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | rubygem-bigdecimal | 1.2.0-36.amzn2.0.1 |
| amazon linux 2 | rubygem-io-console | 0.4.2-36.amzn2.0.1 |
| amazon linux 2 | rubygem-json | 1.7.7-36.amzn2.0.1 |
| amazon linux 2 | rubygem-minitest | 4.3.2-36.amzn2.0.1 |
| amazon linux 2 | rubygem-psych | 2.0.0-36.amzn2.0.1 |
| amazon linux 2 | rubygem-rake | 0.9.6-36.amzn2.0.1 |
| amazon linux 2 | rubygem-rdoc | 4.0.0-36.amzn2.0.1 |
| amazon linux 2 | rubygems | 2.0.14.1-36.amzn2.0.1 |
| amazon linux 2 | rubygems-devel | 2.0.14.1-36.amzn2.0.1 |
| debian 11 | rubygems | 3.2.0~rc.1-1 |
| debian 12 | jruby | 9.1.17.0-1 |
| debian 12 | rubygems | 3.2.0~rc.1-1 |
| debian 13 | jruby | 9.1.17.0-1 |
| debian 13 | rubygems | 3.2.0~rc.1-1 |
| debian 14 | jruby | 9.1.17.0-1 |
| debian 14 | rubygems | 3.2.0~rc.1-1 |
| debian 7 | jruby | 1.5.6-5+deb7u1 |
| debian 7 | ruby1.9.1 | 1.9.3.194-8.1+deb7u8 |
| debian 7 | rubygems | 1.8.24-1+deb7u2 |
| debian 8 | jruby | 1.5.6-9+deb8u1 |
| debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| debian 9 | jruby | 1.7.26-1+deb9u1 |
| debian 9 | ruby2.3 | 2.3.3-1+deb9u3 |
| echo | jruby | 9.1.17.0-1 |
| echo | rubygems | 3.2.0~rc.1-1 |
| Oracle Linux 7 | ruby | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-devel | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-doc | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-irb | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-libs | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-tcltk | 2.0.0.648-36.el7 |
| Oracle Linux 7 | rubygem-bigdecimal | 1.2.0-36.el7 |
| Oracle Linux 7 | rubygem-io-console | 0.4.2-36.el7 |
| Oracle Linux 7 | rubygem-json | 1.7.7-36.el7 |
| Oracle Linux 7 | rubygem-minitest | 4.3.2-36.el7 |
| Oracle Linux 7 | rubygem-psych | 2.0.0-36.el7 |
| Oracle Linux 7 | rubygem-rake | 0.9.6-36.el7 |
| Oracle Linux 7 | rubygem-rdoc | 4.0.0-36.el7 |
| Oracle Linux 7 | rubygems | 2.0.14.1-36.el7 |
| Oracle Linux 7 | rubygems-devel | 2.0.14.1-36.el7 |
| Red Hat | rubygems | sin corrección indicada |
| ubuntu 14.04 | ruby2.0 | 2.0.0.484-1ubuntu2.6 |
| ubuntu 14.04-ESM | jruby | 1.5.6-9+deb8u2build0.14.04.1~esm2 |
| ubuntu 16.04 | ruby2.3 | 2.3.1-2~16.04.7 |
| ubuntu 16.04-ESM | ruby2.3 | 2.3.1-2~16.04.7 |
| ubuntu 17.10 | ruby2.3 | 2.3.3-1ubuntu1.4 |
| ubuntu 18.04 | ruby2.5 | 2.5.1-1 |
| ubuntu 18.04-ESM | ruby2.5 | 2.5.1-1 |
| ubuntu 18.10 | ruby2.5 | 2.5.1-1 |
| ubuntu 19.04 | ruby2.5 | 2.5.1-1 |
| ubuntu 19.10 | ruby2.5 | 2.5.1-1 |
Referencias
- http://blog.rubygems.org/2018/02/15/2.7.6-released.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
- https://access.redhat.com/errata/RHSA-2018:3729
- https://access.redhat.com/errata/RHSA-2018:3730
- https://access.redhat.com/errata/RHSA-2018:3731
- https://access.redhat.com/errata/RHSA-2019:2028
- https://access.redhat.com/errata/RHSA-2020:0542
- https://access.redhat.com/errata/RHSA-2020:0591
Las 28 referencias
- https://access.redhat.com/errata/RHSA-2020:0663
- https://access.redhat.com/security/cve/CVE-2018-1000076
- https://github.com/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7
- https://github.com/rubygems/rubygems
- https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693
- https://linux.oracle.com/cve/CVE-2018-1000076.html
- https://linux.oracle.com/errata/ELSA-2019-2028.html
- https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html
- https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html
- https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000076
- https://ubuntu.com/security/notices/USN-3621-1
- https://usn.ubuntu.com/3621-1
- https://usn.ubuntu.com/3621-1/
- https://www.cve.org/CVERecord?id=CVE-2018-1000076
- https://www.debian.org/security/2018/dsa-4219
- https://www.debian.org/security/2018/dsa-4259
- https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/