critical
CVE-2018-1000076
rubygems: Improper verification of signatures in tarball allows to install mis-signed gem
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Ruby Advisory DB. Rated lower by Red Hat (medium), Amazon (medium), Oracle (medium), Ubuntu (low).
Description
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.jruby:jruby-stdlib | 9.1.16.0 |
| rubygems::GitHub Security Advisory RubyGems | rubygems-update | 2.7.6 |
| rubygems::Ruby Advisory Database | rubygems-update | >= 2.7.6 |
| amazon linux 1 | ruby20, ruby20-debuginfo, ruby20-devel and 46 more | 2.0.0.648-1.31.amzn1 and 24 more |
| amazon linux 2 | ruby, ruby-debuginfo, ruby-devel and 13 more | 2.0.0.648-36.amzn2.0.1 and 8 more |
| debian 11 | rubygems | 3.2.0~rc.1-1 |
| debian 12 | jruby, rubygems | 9.1.17.0-1 and 1 more |
| debian 13 | jruby, rubygems | 9.1.17.0-1 and 1 more |
| debian 14 | jruby, rubygems | 9.1.17.0-1 and 1 more |
| debian 7 | jruby, ruby1.9.1, rubygems | 1.5.6-5+deb7u1 and 2 more |
| debian 8 | jruby, ruby2.1 | 1.5.6-9+deb8u1 and 1 more |
| debian 9 | jruby, ruby2.3 | 1.7.26-1+deb9u1 and 1 more |
Show all 110 entries from 25 sources
| Source | Package | Fixed in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.jruby:jruby-stdlib | 9.1.16.0 |
| rubygems::GitHub Security Advisory RubyGems | rubygems-update | 2.7.6 |
| rubygems::Ruby Advisory Database | rubygems-update | >= 2.7.6 |
| amazon linux 1 | ruby20 | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-debuginfo | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-devel | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-doc | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-irb | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-libs | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby22 | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-debuginfo | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-devel | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-doc | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-irb | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-libs | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby23 | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-debuginfo | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-devel | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-doc | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-irb | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-libs | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby24 | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-debuginfo | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-devel | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-doc | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-irb | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-libs | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | rubygem20-bigdecimal | 1.2.0-1.31.amzn1 |
| amazon linux 1 | rubygem20-io-console | 0.4.2-1.31.amzn1 |
| amazon linux 1 | rubygem20-psych | 2.0.0-1.31.amzn1 |
| amazon linux 1 | rubygem22-bigdecimal | 1.2.6-1.11.amzn1 |
| amazon linux 1 | rubygem22-io-console | 0.4.3-1.11.amzn1 |
| amazon linux 1 | rubygem22-psych | 2.0.8.1-1.11.amzn1 |
| amazon linux 1 | rubygem23-bigdecimal | 1.2.8-1.19.amzn1 |
| amazon linux 1 | rubygem23-did_you_mean | 1.0.0-1.19.amzn1 |
| amazon linux 1 | rubygem23-io-console | 0.4.5-1.19.amzn1 |
| amazon linux 1 | rubygem23-json | 1.8.3.1-1.19.amzn1 |
| amazon linux 1 | rubygem23-psych | 2.1.0.1-1.19.amzn1 |
| amazon linux 1 | rubygem24-bigdecimal | 1.3.2-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-did_you_mean | 1.1.0-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-io-console | 0.4.6-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-json | 2.0.4-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-psych | 2.2.2-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-xmlrpc | 0.2.1-1.30.6.amzn1 |
| amazon linux 1 | rubygems20 | 2.0.14.1-1.31.amzn1 |
| amazon linux 1 | rubygems20-devel | 2.0.14.1-1.31.amzn1 |
| amazon linux 1 | rubygems22 | 2.4.5.2-1.11.amzn1 |
| amazon linux 1 | rubygems22-devel | 2.4.5.2-1.11.amzn1 |
| amazon linux 1 | rubygems23 | 2.5.2.3-1.19.amzn1 |
| amazon linux 1 | rubygems23-devel | 2.5.2.3-1.19.amzn1 |
| amazon linux 1 | rubygems24 | 2.6.14.1-1.30.6.amzn1 |
| amazon linux 1 | rubygems24-devel | 2.6.14.1-1.30.6.amzn1 |
| amazon linux 2 | ruby | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-debuginfo | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-devel | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-doc | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-irb | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-libs | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | ruby-tcltk | 2.0.0.648-36.amzn2.0.1 |
| amazon linux 2 | rubygem-bigdecimal | 1.2.0-36.amzn2.0.1 |
| amazon linux 2 | rubygem-io-console | 0.4.2-36.amzn2.0.1 |
| amazon linux 2 | rubygem-json | 1.7.7-36.amzn2.0.1 |
| amazon linux 2 | rubygem-minitest | 4.3.2-36.amzn2.0.1 |
| amazon linux 2 | rubygem-psych | 2.0.0-36.amzn2.0.1 |
| amazon linux 2 | rubygem-rake | 0.9.6-36.amzn2.0.1 |
| amazon linux 2 | rubygem-rdoc | 4.0.0-36.amzn2.0.1 |
| amazon linux 2 | rubygems | 2.0.14.1-36.amzn2.0.1 |
| amazon linux 2 | rubygems-devel | 2.0.14.1-36.amzn2.0.1 |
| debian 11 | rubygems | 3.2.0~rc.1-1 |
| debian 12 | jruby | 9.1.17.0-1 |
| debian 12 | rubygems | 3.2.0~rc.1-1 |
| debian 13 | jruby | 9.1.17.0-1 |
| debian 13 | rubygems | 3.2.0~rc.1-1 |
| debian 14 | jruby | 9.1.17.0-1 |
| debian 14 | rubygems | 3.2.0~rc.1-1 |
| debian 7 | jruby | 1.5.6-5+deb7u1 |
| debian 7 | ruby1.9.1 | 1.9.3.194-8.1+deb7u8 |
| debian 7 | rubygems | 1.8.24-1+deb7u2 |
| debian 8 | jruby | 1.5.6-9+deb8u1 |
| debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| debian 9 | jruby | 1.7.26-1+deb9u1 |
| debian 9 | ruby2.3 | 2.3.3-1+deb9u3 |
| echo | jruby | 9.1.17.0-1 |
| echo | rubygems | 3.2.0~rc.1-1 |
| Oracle Linux 7 | ruby | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-devel | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-doc | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-irb | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-libs | 2.0.0.648-36.el7 |
| Oracle Linux 7 | ruby-tcltk | 2.0.0.648-36.el7 |
| Oracle Linux 7 | rubygem-bigdecimal | 1.2.0-36.el7 |
| Oracle Linux 7 | rubygem-io-console | 0.4.2-36.el7 |
| Oracle Linux 7 | rubygem-json | 1.7.7-36.el7 |
| Oracle Linux 7 | rubygem-minitest | 4.3.2-36.el7 |
| Oracle Linux 7 | rubygem-psych | 2.0.0-36.el7 |
| Oracle Linux 7 | rubygem-rake | 0.9.6-36.el7 |
| Oracle Linux 7 | rubygem-rdoc | 4.0.0-36.el7 |
| Oracle Linux 7 | rubygems | 2.0.14.1-36.el7 |
| Oracle Linux 7 | rubygems-devel | 2.0.14.1-36.el7 |
| Red Hat | rubygems | no fix listed |
| ubuntu 14.04 | ruby2.0 | 2.0.0.484-1ubuntu2.6 |
| ubuntu 14.04-ESM | jruby | 1.5.6-9+deb8u2build0.14.04.1~esm2 |
| ubuntu 16.04 | ruby2.3 | 2.3.1-2~16.04.7 |
| ubuntu 16.04-ESM | ruby2.3 | 2.3.1-2~16.04.7 |
| ubuntu 17.10 | ruby2.3 | 2.3.3-1ubuntu1.4 |
| ubuntu 18.04 | ruby2.5 | 2.5.1-1 |
| ubuntu 18.04-ESM | ruby2.5 | 2.5.1-1 |
| ubuntu 18.10 | ruby2.5 | 2.5.1-1 |
| ubuntu 19.04 | ruby2.5 | 2.5.1-1 |
| ubuntu 19.10 | ruby2.5 | 2.5.1-1 |
References
- http://blog.rubygems.org/2018/02/15/2.7.6-released.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
- https://access.redhat.com/errata/RHSA-2018:3729
- https://access.redhat.com/errata/RHSA-2018:3730
- https://access.redhat.com/errata/RHSA-2018:3731
- https://access.redhat.com/errata/RHSA-2019:2028
- https://access.redhat.com/errata/RHSA-2020:0542
- https://access.redhat.com/errata/RHSA-2020:0591
All 28 references
- https://access.redhat.com/errata/RHSA-2020:0663
- https://access.redhat.com/security/cve/CVE-2018-1000076
- https://github.com/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7
- https://github.com/rubygems/rubygems
- https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693
- https://linux.oracle.com/cve/CVE-2018-1000076.html
- https://linux.oracle.com/errata/ELSA-2019-2028.html
- https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html
- https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html
- https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000076
- https://ubuntu.com/security/notices/USN-3621-1
- https://usn.ubuntu.com/3621-1
- https://usn.ubuntu.com/3621-1/
- https://www.cve.org/CVERecord?id=CVE-2018-1000076
- https://www.debian.org/security/2018/dsa-4219
- https://www.debian.org/security/2018/dsa-4259
- https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/