Rubygems vulnerabilities, page 2
37 vulnerabilities
Known vulnerabilities in Rubygems products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 7 products.
MediumCVE-2012-2139debian · ruby-mail +2 moredebian ruby-mailDirectory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter.EPSS4.92%MediumCVE-2012-2125debian · rubygems +3 moredebian rubygemsRubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.EPSS2.47%HighCVE-2012-2140debian · ruby-mail +2 moredebian ruby-mailThe Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.EPSS4.47%HighCVE-2017-0901Alpine Linuxalpine · ruby +16 morealpine rubyRubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.EPSS29.44%HighCVE-2017-0900Alpine Linuxalpine · ruby +13 morealpine rubyRubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.EPSS8.49%CriticalCVE-2017-0899Alpine Linuxalpine · ruby +14 morealpine rubyRubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.EPSS11.10%HighCVE-2017-0902Alpine Linuxalpine · ruby +15 morealpine rubyRubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.EPSS4.75%CriticalCVE-2017-0903canonical · ubuntu_linux +14 morecanonical ubuntu_linuxRubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.EPSS15.85%CriticalCVE-2024-21654rubygems · rubygems.orgrubygems.org MFA Bypass through password reset function could allow account takeoverRubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.EPSS0.48%MediumCVE-2024-35221opensuse · ruby2.5&distro=openSUSE Leap 15.6 +16 moreDenial of service when publishing a package on rubygems.orgRubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-based metadata of a gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks). This was patched. There is is no action required by users. This issue is also tracked as GHSL-2024-001 and was discovered by the GitHub security lab.EPSS0.49%HighCVE-2019-8322Alpine Linuxalpine · ruby +11 morealpine rubyAn issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.EPSS3.28%HighCVE-2019-8321Alpine Linuxalpine · ruby +11 morealpine rubyAn issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.EPSS3.28%HighCVE-2019-8325Alpine Linuxalpine · ruby +11 morealpine rubyAn issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)EPSS3.28%HighCVE-2019-8320Alpine Linuxalpine · ruby +9 morealpine rubyA Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.EPSS4.19%HighCVE-2019-8324Alpine Linuxalpine · ruby +78 morealpine rubyAn issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.EPSS3.22%HighCVE-2019-8323Alpine Linuxalpine · ruby +11 morealpine rubyAn issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.EPSS3.28%HighCVE-2023-40165rubygems · rubygems.orgUnauthorized gem replacement for full names ending in numbers on rubygems.orgrubygems.org is the Ruby community's primary gem (library) hosting service. Insufficient input validation allowed malicious actors to replace any uploaded gem version that had a platform, version number, or gem name matching `/-\d/`, permanently replacing the legitimate upload in the canonical gem storage bucket, and triggering an immediate CDN purge so that the malicious gem would be served immediately. The maintainers have checked all gems matching the `/-\d/` pattern and can confirm that no unexpected `.gem`s were found. As a result, we believe this vulnerability was _not_ exploited. The easiest way to ensure that a user's applications were not exploited by this vulnerability is to check that all of your downloaded .gems have a checksum that matches the checksum recorded in the RubyGems.org database. RubyGems contributor Maciej Mensfeld wrote a tool to automatically check that all downloaded .gem files match the checksums recorded in the RubyGems.org database. You can use it by running: `bundle add bundler-integrity` followed by `bundle exec bundler-integrity`. Neither this tool nor anything else can prove you were not exploited, but the can assist your investigation by quickly comparing RubyGems API-provided checksums with the checksums of files on your disk. The issue has been patched with improved input validation and the changes are live. No action is required on the part of the user. Users are advised to validate their local gems.EPSS0.46%