Vulnerabilities > CVE-2018-1000077 - Improper Input Validation vulnerability in multiple products

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE
network
low complexity
rubygems
debian
CWE-20
nessus

Summary

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.

Vulnerable Configurations

Part Description Count
Application
Rubygems
150
OS
Debian
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Server Side Include (SSI) Injection
    An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
  • Cross Zone Scripting
    An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Nessus

  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0221_RUBY.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ruby packages installed that are affected by multiple vulnerabilities: - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure. (CVE-2018-8778) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000073) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed. (CVE-2018-8780) - Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument. (CVE-2018-6914) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption). (CVE-2018-8777) - Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick. (CVE-2017-17742) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000074) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000078) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000079) - An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats. (CVE-2018-16396) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket. (CVE-2018-8779) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000075) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000076) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000077) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id131412
    published2019-12-02
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131412
    titleNewStart CGSL CORE 5.04 / MAIN 5.04 : ruby Multiple Vulnerabilities (NS-SA-2019-0221)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from ZTE advisory NS-SA-2019-0221. The text
    # itself is copyright (C) ZTE, Inc.
    
    include("compat.inc");
    
    if (description)
    {
      script_id(131412);
      script_version("1.2");
      script_cvs_date("Date: 2019/12/04");
    
      script_cve_id(
        "CVE-2017-17742",
        "CVE-2018-6914",
        "CVE-2018-8777",
        "CVE-2018-8778",
        "CVE-2018-8779",
        "CVE-2018-8780",
        "CVE-2018-16396",
        "CVE-2018-1000073",
        "CVE-2018-1000074",
        "CVE-2018-1000075",
        "CVE-2018-1000076",
        "CVE-2018-1000077",
        "CVE-2018-1000078",
        "CVE-2018-1000079"
      );
      script_bugtraq_id(
        103683,
        103684,
        103686,
        103693,
        103739,
        103767,
        105955
      );
    
      script_name(english:"NewStart CGSL CORE 5.04 / MAIN 5.04 : ruby Multiple Vulnerabilities (NS-SA-2019-0221)");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote machine is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ruby packages installed that are affected by
    multiple vulnerabilities:
    
      - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before
        2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an
        attacker controlling the unpacking format (similar to
        format string vulnerabilities) can trigger a buffer
        under-read in the String#unpack method, resulting in a
        massive and controlled information disclosure.
        (CVE-2018-8778)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Directory
        Traversal vulnerability in install_location function of
        package.rb that can result in path traversal when
        writing to a symlinked basedir outside of the root. This
        vulnerability appears to have been fixed in 2.7.6.
        (CVE-2018-1000073)
    
      - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before
        2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the
        Dir.open, Dir.new, Dir.entries and Dir.empty? methods do
        not check NULL characters. When using the corresponding
        method, unintentional directory traversal may be
        performed. (CVE-2018-8780)
    
      - Directory traversal vulnerability in the Dir.mktmpdir
        method in the tmpdir library in Ruby before 2.2.10,
        2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before
        2.5.1, and 2.6.0-preview1 might allow attackers to
        create arbitrary directories or files via a .. (dot dot)
        in the prefix argument. (CVE-2018-6914)
    
      - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before
        2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an
        attacker can pass a large HTTP request with a crafted
        header to WEBrick server or a crafted body to WEBrick
        server/handler and cause a denial of service (memory
        consumption). (CVE-2018-8777)
    
      - Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before
        2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an
        HTTP Response Splitting attack. An attacker can inject a
        crafted key and value into an HTTP response for the HTTP
        server of WEBrick. (CVE-2017-17742)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Deserialization
        of Untrusted Data vulnerability in owner command that
        can result in code execution. This attack appear to be
        exploitable via victim must run the `gem owner` command
        on a gem with a specially crafted YAML file. This
        vulnerability appears to have been fixed in 2.7.6.
        (CVE-2018-1000074)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Cross Site
        Scripting (XSS) vulnerability in gem server display of
        homepage attribute that can result in XSS. This attack
        appear to be exploitable via the victim must browse to a
        malicious gem on a vulnerable gem server. This
        vulnerability appears to have been fixed in 2.7.6.
        (CVE-2018-1000078)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Directory
        Traversal vulnerability in gem installation that can
        result in the gem could write to arbitrary filesystem
        locations during installation. This attack appear to be
        exploitable via the victim must install a malicious gem.
        This vulnerability appears to have been fixed in 2.7.6.
        (CVE-2018-1000079)
    
      - An issue was discovered in Ruby before 2.3.8, 2.4.x
        before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before
        2.6.0-preview3. It does not taint strings that result
        from unpacking tainted strings with some formats.
        (CVE-2018-16396)
    
      - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before
        2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the
        UNIXServer.open and UNIXSocket.open methods are not
        checked for null characters. It may be connected to an
        unintended socket. (CVE-2018-8779)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a infinite loop
        caused by negative size vulnerability in ruby gem
        package tar header that can result in a negative size
        could cause an infinite loop.. This vulnerability
        appears to have been fixed in 2.7.6. (CVE-2018-1000075)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Improper
        Verification of Cryptographic Signature vulnerability in
        package.rb that can result in a mis-signed gem could be
        installed, as the tarball would contain multiple gem
        signatures.. This vulnerability appears to have been
        fixed in 2.7.6. (CVE-2018-1000076)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Improper Input
        Validation vulnerability in ruby gems specification
        homepage attribute that can result in a malicious gem
        could set an invalid homepage URL. This vulnerability
        appears to have been fixed in 2.7.6. (CVE-2018-1000077)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"http://security.gd-linux.com/notice/NS-SA-2019-0221");
      script_set_attribute(attribute:"solution", value:
    "Upgrade the vulnerable CGSL ruby packages. Note that updated packages may not be available yet. Please contact ZTE for
    more information.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8780");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/03/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/11/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/02");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"NewStart CGSL Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/ZTE-CGSL/release");
    if (isnull(release) || release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, "NewStart Carrier Grade Server Linux");
    
    if (release !~ "CGSL CORE 5.04" &&
        release !~ "CGSL MAIN 5.04")
      audit(AUDIT_OS_NOT, 'NewStart CGSL CORE 5.04 / NewStart CGSL MAIN 5.04');
    
    if (!get_kb_item("Host/ZTE-CGSL/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "NewStart Carrier Grade Server Linux", cpu);
    
    flag = 0;
    
    pkgs = {
      "CGSL CORE 5.04": [
        "ruby-2.0.0.648-36.el7",
        "ruby-debuginfo-2.0.0.648-36.el7",
        "ruby-devel-2.0.0.648-36.el7",
        "ruby-doc-2.0.0.648-36.el7",
        "ruby-irb-2.0.0.648-36.el7",
        "ruby-libs-2.0.0.648-36.el7",
        "ruby-tcltk-2.0.0.648-36.el7",
        "rubygem-bigdecimal-1.2.0-36.el7",
        "rubygem-io-console-0.4.2-36.el7",
        "rubygem-json-1.7.7-36.el7",
        "rubygem-minitest-4.3.2-36.el7",
        "rubygem-psych-2.0.0-36.el7",
        "rubygem-rake-0.9.6-36.el7",
        "rubygem-rdoc-4.0.0-36.el7",
        "rubygems-2.0.14.1-36.el7",
        "rubygems-devel-2.0.14.1-36.el7"
      ],
      "CGSL MAIN 5.04": [
        "ruby-2.0.0.648-36.el7",
        "ruby-debuginfo-2.0.0.648-36.el7",
        "ruby-devel-2.0.0.648-36.el7",
        "ruby-doc-2.0.0.648-36.el7",
        "ruby-irb-2.0.0.648-36.el7",
        "ruby-libs-2.0.0.648-36.el7",
        "ruby-tcltk-2.0.0.648-36.el7",
        "rubygem-bigdecimal-1.2.0-36.el7",
        "rubygem-io-console-0.4.2-36.el7",
        "rubygem-json-1.7.7-36.el7",
        "rubygem-minitest-4.3.2-36.el7",
        "rubygem-psych-2.0.0-36.el7",
        "rubygem-rake-0.9.6-36.el7",
        "rubygem-rdoc-4.0.0-36.el7",
        "rubygems-2.0.14.1-36.el7",
        "rubygems-devel-2.0.14.1-36.el7"
      ]
    };
    pkg_list = pkgs[release];
    
    foreach (pkg in pkg_list)
      if (rpm_check(release:"ZTE " + release, reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ruby");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2230.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.(CVE-2016-7798) - Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.(CVE-2017-17742) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.(CVE-2018-1000073) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6.(CVE-2018-1000074) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.(CVE-2018-1000077) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.(CVE-2018-1000078) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.(CVE-2018-1000079) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-08
    modified2019-11-08
    plugin id130692
    published2019-11-08
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130692
    titleEulerOS 2.0 SP5 : ruby (EulerOS-SA-2019-2230)
  • NASL familyAmazon Linux Local Security Checks
    NASL idAL2_ALAS-2018-983.NASL
    descriptionPath traversal when writing to a symlinked basedir outside of the root RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000073) Improper verification of signatures in tarball allows to install mis-signed gem : RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000076) Infinite loop vulnerability due to negative size in tar header causes Denial of Service RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000075) Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution : The
    last seen2020-06-01
    modified2020-06-02
    plugin id109136
    published2018-04-18
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109136
    titleAmazon Linux 2 : ruby (ALAS-2018-983)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-1804-1.NASL
    descriptionThis update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues : Changes in ruby2.5 : Update to 2.5.5 and 2.5.4 : https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed : CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627) CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623) CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622) CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620) CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617) CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611) Ruby 2.5 was updated to 2.5.3 : This release includes some bug fixes and some security fixes. Security issues fixed: CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532) CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530) Ruby 2.5 was updated to 2.5.1 : This release includes some bug fixes and some security fixes. Security issues fixed: CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434) CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441) CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436) CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433) CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440) CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437) Multiple vulnerabilities in RubyGems were fixed : - CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058) - CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014) - CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011) - CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010) - CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009) - CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008) - CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007) Other changes: Fixed Net::POPMail methods modify frozen literal when using default arg ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790) build with PIE support (bsc#1130028) Changes in ruby-bundled-gems-rpmhelper: Add a new helper for bundled ruby gems. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id126617
    published2019-07-11
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126617
    titleSUSE SLED15 / SLES15 Security Update : ruby-bundled-gems-rpmhelper, ruby2.5 (SUSE-SU-2019:1804-1)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-0542.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7.5 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * ruby: DoS by large request in WEBrick (CVE-2018-8777) * ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) * rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) * rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) * rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) * rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) * rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) * rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) * rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-03-18
    modified2020-02-19
    plugin id133785
    published2020-02-19
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133785
    titleRHEL 7 : ruby (RHSA-2020:0542)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1337.NASL
    descriptionMultiple vulnerabilities were found in the rubygems package management framework, embedded in JRuby, a pure-Java implementation of the Ruby programming language. CVE-2018-1000075 A negative size vulnerability in ruby gem package tar header that could cause an infinite loop. CVE-2018-1000076 Ruby gems package improperly verifies cryptographic signatures. A mis-signed gem could be installed if the tarball contains multiple gem signatures. CVE-2018-1000077 An improper input validation vulnerability in ruby gems specification homepage attribute could allow malicious gem to set an invalid homepage URL. CVE-2018-1000078 Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute For Debian 7
    last seen2020-03-17
    modified2018-04-03
    plugin id108788
    published2018-04-03
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108788
    titleDebian DLA-1337-1 : jruby security update
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2250.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.(CVE-2017-17742) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.(CVE-2018-1000073) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6.(CVE-2018-1000074) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.(CVE-2018-1000077) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.(CVE-2018-1000078) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.(CVE-2018-1000079) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-08
    modified2019-11-08
    plugin id130712
    published2019-11-08
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130712
    titleEulerOS 2.0 SP3 : ruby (EulerOS-SA-2019-2250)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1358.NASL
    descriptionMultiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2017-17742 Aaron Patterson reported that WEBrick bundled with Ruby was vulnerable to an HTTP response splitting vulnerability. It was possible for an attacker to inject fake HTTP responses if a script accepted an external input and output it without modifications. CVE-2018-6914 ooooooo_q discovered a directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library. It made it possible for attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument. CVE-2018-8777 Eric Wong reported an out-of-memory DoS vulnerability related to a large request in WEBrick bundled with Ruby. CVE-2018-8778 aerodudrizzt found a buffer under-read vulnerability in the Ruby String#unpack method. If a big number was passed with the specifier @, the number was treated as a negative value, and an out-of-buffer read occurred. Attackers could read data on heaps if an script accepts an external input as the argument of String#unpack. CVE-2018-8779 ooooooo_q reported that the UNIXServer.open and UNIXSocket.open methods of the socket library bundled with Ruby did not check for NUL bytes in the path argument. The lack of check made the methods vulnerable to unintentional socket creation and unintentional socket access. CVE-2018-8780 ooooooo_q discovered an unintentional directory traversal in some methods in Dir, by the lack of checking for NUL bytes in their parameter. CVE-2018-1000075 A negative size vulnerability in ruby gem package tar header that could cause an infinite loop. CVE-2018-1000076 Ruby gems package improperly verifies cryptographic signatures. A mis-signed gem could be installed if the tarball contains multiple gem signatures. CVE-2018-1000077 An improper input validation vulnerability in ruby gems specification homepage attribute could allow malicious gem to set an invalid homepage URL. CVE-2018-1000078 Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute For Debian 7
    last seen2020-03-17
    modified2018-04-24
    plugin id109283
    published2018-04-24
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109283
    titleDebian DLA-1358-1 : ruby1.9.1 security update
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2028.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * ruby: HTTP response splitting in WEBrick (CVE-2017-17742) * ruby: DoS by large request in WEBrick (CVE-2018-8777) * ruby: Buffer under-read in String#unpack (CVE-2018-8778) * ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) * ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives (CVE-2018-16396) * rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) * rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) * rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) * rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) * rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) * rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) * ruby: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (CVE-2018-6914) * ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket (CVE-2018-8779) * rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id127649
    published2019-08-12
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127649
    titleRHEL 7 : ruby (RHSA-2019:2028)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2018-983.NASL
    descriptionPath traversal when writing to a symlinked basedir outside of the root RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000073) Improper verification of signatures in tarball allows to install mis-signed gem : RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000076) Infinite loop vulnerability due to negative size in tar header causes Denial of Service RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000075) Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution : The
    last seen2020-06-01
    modified2020-06-02
    plugin id108846
    published2018-04-06
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108846
    titleAmazon Linux AMI : ruby20 / ruby22,ruby23,ruby24 (ALAS-2018-983)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0245_RUBY.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ruby packages installed that are affected by multiple vulnerabilities: - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure. (CVE-2018-8778) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000073) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed. (CVE-2018-8780) - Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument. (CVE-2018-6914) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption). (CVE-2018-8777) - Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick. (CVE-2017-17742) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000074) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000078) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000079) - An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats. (CVE-2018-16396) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket. (CVE-2018-8779) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000075) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000076) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000077) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id132492
    published2019-12-31
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132492
    titleNewStart CGSL CORE 5.05 / MAIN 5.05 : ruby Multiple Vulnerabilities (NS-SA-2019-0245)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-0591.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * ruby: DoS by large request in WEBrick (CVE-2018-8777) * ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) * rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) * rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) * rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) * rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) * rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) * rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) * rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-03-18
    modified2020-02-26
    plugin id134063
    published2020-02-26
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134063
    titleRHEL 7 : ruby (RHSA-2020:0591)
  • NASL familyAmazon Linux Local Security Checks
    NASL idAL2_ALAS-2019-1276.NASL
    descriptionIt was found that WEBrick could be forced to use an excessive amount of memory during the processing of HTTP requests, leading to a Denial of Service. An attacker could use this flaw to send huge requests to a WEBrick application, resulting in the server running out of memory. (CVE-2018-8777) It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create temporary files and directories outside of the dedicated directory. (CVE-2018-6914) It was found that WEBrick did not sanitize headers sent back to clients, resulting in a response-splitting vulnerability. An attacker, able to control the server
    last seen2020-06-01
    modified2020-06-02
    plugin id128290
    published2019-08-28
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128290
    titleAmazon Linux 2 : ruby (ALAS-2019-1276)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20190806_RUBY_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - ruby: HTTP response splitting in WEBrick (CVE-2017-17742) - ruby: DoS by large request in WEBrick (CVE-2018-8777) - ruby: Buffer under-read in String#unpack (CVE-2018-8778) - ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) - ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives (CVE-2018-16396) - rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) - rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) - rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) - rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) - rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) - rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) - ruby: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (CVE-2018-6914) - ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket (CVE-2018-8779) - rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075)
    last seen2020-03-18
    modified2019-08-27
    plugin id128260
    published2019-08-27
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128260
    titleScientific Linux Security Update : ruby on SL7.x x86_64 (20190806)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1336.NASL
    descriptionMultiple vulnerabilities were found in rubygems, a package management framework for Ruby. CVE-2018-1000075 A negative size vulnerability in ruby gem package tar header that could cause an infinite loop. CVE-2018-1000076 Ruby gems package improperly verifies cryptographic signatures. A mis-signed gem could be installed if the tarball contains multiple gem signatures. CVE-2018-1000077 An improper input validation vulnerability in ruby gems specification homepage attribute could allow malicious gem to set an invalid homepage URL. CVE-2018-1000078 Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute For Debian 7
    last seen2020-03-17
    modified2018-04-02
    plugin id108770
    published2018-04-02
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108770
    titleDebian DLA-1336-1 : rubygems security update
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1195.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition.(CVE-2017-9229) - An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.(CVE-2017-9227) - An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it
    last seen2020-03-19
    modified2020-03-13
    plugin id134484
    published2020-03-13
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134484
    titleEulerOS Virtualization for ARM 64 3.0.2.0 : ruby (EulerOS-SA-2020-1195)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1421.NASL
    descriptionMultiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2015-9096 SMTP command injection in Net::SMTP via CRLF sequences in a RCPT TO or MAIL FROM command. CVE-2016-2339 Exploitable heap overflow in Fiddle::Function.new. CVE-2016-7798 Incorrect handling of initialization vector in the GCM mode in the OpenSSL extension. CVE-2017-0898 Buffer underrun vulnerability in Kernel.sprintf. CVE-2017-0899 ANSI escape sequence vulnerability in RubyGems. CVE-2017-0900 DoS vulnerability in the RubyGems query command. CVE-2017-0901 gem installer allowed a malicious gem to overwrite arbitrary files. CVE-2017-0902 RubyGems DNS request hijacking vulnerability. CVE-2017-0903 Max Justicz reported that RubyGems is prone to an unsafe object deserialization vulnerability. When parsed by an application which processes gems, a specially crafted YAML formatted gem specification can lead to remote code execution. CVE-2017-10784 Yusuke Endoh discovered an escape sequence injection vulnerability in the Basic authentication of WEBrick. An attacker can take advantage of this flaw to inject malicious escape sequences to the WEBrick log and potentially execute control characters on the victim
    last seen2020-06-01
    modified2020-06-02
    plugin id111081
    published2018-07-16
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111081
    titleDebian DLA-1421-1 : ruby2.1 security update
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2019-2028.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * ruby: HTTP response splitting in WEBrick (CVE-2017-17742) * ruby: DoS by large request in WEBrick (CVE-2018-8777) * ruby: Buffer under-read in String#unpack (CVE-2018-8778) * ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) * ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives (CVE-2018-16396) * rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) * rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) * rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) * rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) * rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) * rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) * ruby: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (CVE-2018-6914) * ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket (CVE-2018-8779) * rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id128332
    published2019-08-30
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128332
    titleCentOS 7 : ruby (CESA-2019:2028)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3621-1.NASL
    descriptionIt was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to access sensitive information. (CVE-2018-1000073) It was discovered that Ruby incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000074) It was discovered that Ruby incorrectly handled certain files. An attacker could possibly use this to cause a denial of service. (CVE-2018-1000075) It was discovered that Ruby incorrectly handled certain crypto signatures. An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000076) It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000077, CVE-2018-1000078, CVE-2018-1000079). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id108879
    published2018-04-06
    reporterUbuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108879
    titleUbuntu 14.04 LTS / 16.04 LTS / 17.10 : ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities (USN-3621-1)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4219.NASL
    descriptionSeveral vulnerabilities were discovered in jruby, a Java implementation of the Ruby programming language. They would allow an attacker to use specially crafted gem files to mount cross-site scripting attacks, cause denial of service through an infinite loop, write arbitrary files, or run malicious code.
    last seen2020-06-01
    modified2020-06-02
    plugin id110418
    published2018-06-11
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110418
    titleDebian DSA-4219-1 : jruby - security update
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3621-2.NASL
    descriptionUSN-3621-1 fixed vulnerabilities in Ruby. The update caused an issue due to an incomplete patch for CVE-2018-1000074. This update reverts the problematic patch pending further investigation. We apologize for the inconvenience. Original advisory details : It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to access sensitive information. (CVE-2018-1000073) It was discovered that Ruby incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000074) It was discovered that Ruby incorrectly handled certain files. An attacker could possibly use this to cause a denial of service. (CVE-2018-1000075) It was discovered that Ruby incorrectly handled certain crypto signatures. An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000076) It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000077, CVE-2018-1000078, CVE-2018-1000079). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id109058
    published2018-04-16
    reporterUbuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109058
    titleUbuntu 14.04 LTS : ruby1.9.1, ruby2.0 regression (USN-3621-2)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1796.NASL
    descriptionMultiple vulnerabilities have been discovered in jruby, Java implementation of the Ruby programming language. CVE-2018-1000074 Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file CVE-2018-1000075 an infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop CVE-2018-1000076 Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures. CVE-2018-1000077 Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL CVE-2018-1000078 Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server CVE-2019-8321 Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible CVE-2019-8322 The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur CVE-2019-8323 Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur. CVE-2019-8324 A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec CVE-2019-8325 Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.) For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id125297
    published2019-05-21
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125297
    titleDebian DLA-1796-1 : jruby security update
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4259.NASL
    descriptionSeveral vulnerabilities have been discovered in the interpreter for the Ruby language, which may result in incorrect processing of HTTP/FTP, directory traversal, command injection, unintended socket creation or information disclosure. This update also fixes several issues in RubyGems which could allow an attacker to use specially crafted gem files to mount cross-site scripting attacks, cause denial of service through an infinite loop, write arbitrary files, or run malicious code.
    last seen2020-06-01
    modified2020-06-02
    plugin id111468
    published2018-08-02
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111468
    titleDebian DSA-4259-1 : ruby2.3 - security update
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1771.NASL
    descriptionThis update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues : Changes in ruby2.5 : Update to 2.5.5 and 2.5.4 : https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed : - CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627) - CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623) - CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622) - CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620) - CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617) - CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611) Ruby 2.5 was updated to 2.5.3 : This release includes some bug fixes and some security fixes. Security issues fixed : - CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532) - CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530) Ruby 2.5 was updated to 2.5.1 : This release includes some bug fixes and some security fixes. Security issues fixed : - CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434) - CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441) - CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436) - CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433) - CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440) - CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437) - Multiple vulnerabilities in RubyGems were fixed : - CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058) - CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014) - CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011) - CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010) - CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009) - CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008) - CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007) Other changes : - Fixed Net::POPMail methods modify frozen literal when using default arg - ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790) - build with PIE support (bsc#1130028) Changes in ruby-bundled-gems-rpmhelper : - Add a new helper for bundled ruby gems. This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id126904
    published2019-07-22
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126904
    titleopenSUSE Security Update : ruby-bundled-gems-rpmhelper / ruby2.5 (openSUSE-2019-1771)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-0663.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * ruby: DoS by large request in WEBrick (CVE-2018-8777) * ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) * rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) * rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) * rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) * rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) * rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) * rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) * rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-03-19
    modified2020-03-06
    plugin id134261
    published2020-03-06
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134261
    titleRHEL 7 : ruby (RHSA-2020:0663)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1443.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.(CVE-2019-8321) - An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition.(CVE-2017-9229) - An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.(CVE-2017-9227) - An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it
    last seen2020-04-30
    modified2020-04-16
    plugin id135605
    published2020-04-16
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135605
    titleEulerOS Virtualization 3.0.2.2 : ruby (EulerOS-SA-2020-1443)

Redhat

advisories
  • rhsa
    idRHSA-2018:3729
  • rhsa
    idRHSA-2018:3730
  • rhsa
    idRHSA-2018:3731
  • rhsa
    idRHSA-2019:2028
  • rhsa
    idRHSA-2020:0542
  • rhsa
    idRHSA-2020:0591
  • rhsa
    idRHSA-2020:0663
rpms
  • rh-ruby23-ruby-0:2.3.8-69.el6
  • rh-ruby23-ruby-0:2.3.8-69.el7
  • rh-ruby23-ruby-debuginfo-0:2.3.8-69.el6
  • rh-ruby23-ruby-debuginfo-0:2.3.8-69.el7
  • rh-ruby23-ruby-devel-0:2.3.8-69.el6
  • rh-ruby23-ruby-devel-0:2.3.8-69.el7
  • rh-ruby23-ruby-doc-0:2.3.8-69.el6
  • rh-ruby23-ruby-doc-0:2.3.8-69.el7
  • rh-ruby23-ruby-irb-0:2.3.8-69.el6
  • rh-ruby23-ruby-irb-0:2.3.8-69.el7
  • rh-ruby23-ruby-libs-0:2.3.8-69.el6
  • rh-ruby23-ruby-libs-0:2.3.8-69.el7
  • rh-ruby23-ruby-tcltk-0:2.3.8-69.el6
  • rh-ruby23-ruby-tcltk-0:2.3.8-69.el7
  • rh-ruby23-rubygem-bigdecimal-0:1.2.8-69.el6
  • rh-ruby23-rubygem-bigdecimal-0:1.2.8-69.el7
  • rh-ruby23-rubygem-did_you_mean-0:1.0.0-69.el6
  • rh-ruby23-rubygem-did_you_mean-0:1.0.0-69.el7
  • rh-ruby23-rubygem-io-console-0:0.4.5-69.el6
  • rh-ruby23-rubygem-io-console-0:0.4.5-69.el7
  • rh-ruby23-rubygem-json-0:1.8.3.1-69.el6
  • rh-ruby23-rubygem-json-0:1.8.3.1-69.el7
  • rh-ruby23-rubygem-minitest-0:5.8.5-69.el6
  • rh-ruby23-rubygem-minitest-0:5.8.5-69.el7
  • rh-ruby23-rubygem-net-telnet-0:0.1.1-69.el6
  • rh-ruby23-rubygem-net-telnet-0:0.1.1-69.el7
  • rh-ruby23-rubygem-power_assert-0:0.2.6-69.el6
  • rh-ruby23-rubygem-power_assert-0:0.2.6-69.el7
  • rh-ruby23-rubygem-psych-0:2.1.0.1-69.el6
  • rh-ruby23-rubygem-psych-0:2.1.0.1-69.el7
  • rh-ruby23-rubygem-rake-0:10.4.2-69.el6
  • rh-ruby23-rubygem-rake-0:10.4.2-69.el7
  • rh-ruby23-rubygem-rdoc-0:4.2.1-69.el6
  • rh-ruby23-rubygem-rdoc-0:4.2.1-69.el7
  • rh-ruby23-rubygem-test-unit-0:3.1.5-69.el6
  • rh-ruby23-rubygem-test-unit-0:3.1.5-69.el7
  • rh-ruby23-rubygems-0:2.5.2.3-69.el6
  • rh-ruby23-rubygems-0:2.5.2.3-69.el7
  • rh-ruby23-rubygems-devel-0:2.5.2.3-69.el6
  • rh-ruby23-rubygems-devel-0:2.5.2.3-69.el7
  • rh-ruby24-ruby-0:2.4.5-91.el6
  • rh-ruby24-ruby-0:2.4.5-91.el7
  • rh-ruby24-ruby-debuginfo-0:2.4.5-91.el6
  • rh-ruby24-ruby-debuginfo-0:2.4.5-91.el7
  • rh-ruby24-ruby-devel-0:2.4.5-91.el6
  • rh-ruby24-ruby-devel-0:2.4.5-91.el7
  • rh-ruby24-ruby-doc-0:2.4.5-91.el6
  • rh-ruby24-ruby-doc-0:2.4.5-91.el7
  • rh-ruby24-ruby-irb-0:2.4.5-91.el6
  • rh-ruby24-ruby-irb-0:2.4.5-91.el7
  • rh-ruby24-ruby-libs-0:2.4.5-91.el6
  • rh-ruby24-ruby-libs-0:2.4.5-91.el7
  • rh-ruby24-rubygem-bigdecimal-0:1.3.2-91.el6
  • rh-ruby24-rubygem-bigdecimal-0:1.3.2-91.el7
  • rh-ruby24-rubygem-did_you_mean-0:1.1.0-91.el6
  • rh-ruby24-rubygem-did_you_mean-0:1.1.0-91.el7
  • rh-ruby24-rubygem-io-console-0:0.4.6-91.el6
  • rh-ruby24-rubygem-io-console-0:0.4.6-91.el7
  • rh-ruby24-rubygem-json-0:2.0.4-91.el6
  • rh-ruby24-rubygem-json-0:2.0.4-91.el7
  • rh-ruby24-rubygem-minitest-0:5.10.1-91.el6
  • rh-ruby24-rubygem-minitest-0:5.10.1-91.el7
  • rh-ruby24-rubygem-net-telnet-0:0.1.1-91.el6
  • rh-ruby24-rubygem-net-telnet-0:0.1.1-91.el7
  • rh-ruby24-rubygem-openssl-0:2.0.9-91.el6
  • rh-ruby24-rubygem-openssl-0:2.0.9-91.el7
  • rh-ruby24-rubygem-power_assert-0:0.4.1-91.el6
  • rh-ruby24-rubygem-power_assert-0:0.4.1-91.el7
  • rh-ruby24-rubygem-psych-0:2.2.2-91.el6
  • rh-ruby24-rubygem-psych-0:2.2.2-91.el7
  • rh-ruby24-rubygem-rake-0:12.0.0-91.el6
  • rh-ruby24-rubygem-rake-0:12.0.0-91.el7
  • rh-ruby24-rubygem-rdoc-0:5.0.0-91.el6
  • rh-ruby24-rubygem-rdoc-0:5.0.0-91.el7
  • rh-ruby24-rubygem-test-unit-0:3.2.3-91.el6
  • rh-ruby24-rubygem-test-unit-0:3.2.3-91.el7
  • rh-ruby24-rubygem-xmlrpc-0:0.2.1-91.el6
  • rh-ruby24-rubygem-xmlrpc-0:0.2.1-91.el7
  • rh-ruby24-rubygems-0:2.6.14.3-91.el6
  • rh-ruby24-rubygems-0:2.6.14.3-91.el7
  • rh-ruby24-rubygems-devel-0:2.6.14.3-91.el6
  • rh-ruby24-rubygems-devel-0:2.6.14.3-91.el7
  • rh-ruby25-ruby-0:2.5.3-6.el7
  • rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7
  • rh-ruby25-ruby-devel-0:2.5.3-6.el7
  • rh-ruby25-ruby-doc-0:2.5.3-6.el7
  • rh-ruby25-ruby-irb-0:2.5.3-6.el7
  • rh-ruby25-ruby-libs-0:2.5.3-6.el7
  • rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7
  • rh-ruby25-rubygem-did_you_mean-0:1.2.0-6.el7
  • rh-ruby25-rubygem-io-console-0:0.4.6-6.el7
  • rh-ruby25-rubygem-json-0:2.1.0-6.el7
  • rh-ruby25-rubygem-minitest-0:5.10.3-6.el7
  • rh-ruby25-rubygem-net-telnet-0:0.1.1-6.el7
  • rh-ruby25-rubygem-openssl-0:2.1.2-6.el7
  • rh-ruby25-rubygem-power_assert-0:1.1.1-6.el7
  • rh-ruby25-rubygem-psych-0:3.0.2-6.el7
  • rh-ruby25-rubygem-rake-0:12.3.0-6.el7
  • rh-ruby25-rubygem-rdoc-0:6.0.1-6.el7
  • rh-ruby25-rubygem-test-unit-0:3.2.7-6.el7
  • rh-ruby25-rubygem-xmlrpc-0:0.3.0-6.el7
  • rh-ruby25-rubygems-0:2.7.6-6.el7
  • rh-ruby25-rubygems-devel-0:2.7.6-6.el7
  • ruby-0:2.0.0.648-36.el7
  • ruby-debuginfo-0:2.0.0.648-36.el7
  • ruby-devel-0:2.0.0.648-36.el7
  • ruby-doc-0:2.0.0.648-36.el7
  • ruby-irb-0:2.0.0.648-36.el7
  • ruby-libs-0:2.0.0.648-36.el7
  • ruby-tcltk-0:2.0.0.648-36.el7
  • rubygem-bigdecimal-0:1.2.0-36.el7
  • rubygem-io-console-0:0.4.2-36.el7
  • rubygem-json-0:1.7.7-36.el7
  • rubygem-minitest-0:4.3.2-36.el7
  • rubygem-psych-0:2.0.0-36.el7
  • rubygem-rake-0:0.9.6-36.el7
  • rubygem-rdoc-0:4.0.0-36.el7
  • rubygems-0:2.0.14.1-36.el7
  • rubygems-devel-0:2.0.14.1-36.el7
  • ruby-0:2.0.0.648-35.el7_5
  • ruby-debuginfo-0:2.0.0.648-35.el7_5
  • ruby-devel-0:2.0.0.648-35.el7_5
  • ruby-doc-0:2.0.0.648-35.el7_5
  • ruby-irb-0:2.0.0.648-35.el7_5
  • ruby-libs-0:2.0.0.648-35.el7_5
  • ruby-tcltk-0:2.0.0.648-35.el7_5
  • rubygem-bigdecimal-0:1.2.0-35.el7_5
  • rubygem-io-console-0:0.4.2-35.el7_5
  • rubygem-json-0:1.7.7-35.el7_5
  • rubygem-minitest-0:4.3.2-35.el7_5
  • rubygem-psych-0:2.0.0-35.el7_5
  • rubygem-rake-0:0.9.6-35.el7_5
  • rubygem-rdoc-0:4.0.0-35.el7_5
  • rubygems-0:2.0.14.1-35.el7_5
  • rubygems-devel-0:2.0.14.1-35.el7_5
  • ruby-0:2.0.0.648-35.el7_4
  • ruby-debuginfo-0:2.0.0.648-35.el7_4
  • ruby-devel-0:2.0.0.648-35.el7_4
  • ruby-doc-0:2.0.0.648-35.el7_4
  • ruby-irb-0:2.0.0.648-35.el7_4
  • ruby-libs-0:2.0.0.648-35.el7_4
  • ruby-tcltk-0:2.0.0.648-35.el7_4
  • rubygem-bigdecimal-0:1.2.0-35.el7_4
  • rubygem-io-console-0:0.4.2-35.el7_4
  • rubygem-json-0:1.7.7-35.el7_4
  • rubygem-minitest-0:4.3.2-35.el7_4
  • rubygem-psych-0:2.0.0-35.el7_4
  • rubygem-rake-0:0.9.6-35.el7_4
  • rubygem-rdoc-0:4.0.0-35.el7_4
  • rubygems-0:2.0.14.1-35.el7_4
  • rubygems-devel-0:2.0.14.1-35.el7_4
  • ruby-0:2.0.0.648-36.el7_6
  • ruby-debuginfo-0:2.0.0.648-36.el7_6
  • ruby-devel-0:2.0.0.648-36.el7_6
  • ruby-doc-0:2.0.0.648-36.el7_6
  • ruby-irb-0:2.0.0.648-36.el7_6
  • ruby-libs-0:2.0.0.648-36.el7_6
  • ruby-tcltk-0:2.0.0.648-36.el7_6
  • rubygem-bigdecimal-0:1.2.0-36.el7_6
  • rubygem-io-console-0:0.4.2-36.el7_6
  • rubygem-json-0:1.7.7-36.el7_6
  • rubygem-minitest-0:4.3.2-36.el7_6
  • rubygem-psych-0:2.0.0-36.el7_6
  • rubygem-rake-0:0.9.6-36.el7_6
  • rubygem-rdoc-0:4.0.0-36.el7_6
  • rubygems-0:2.0.14.1-36.el7_6
  • rubygems-devel-0:2.0.14.1-36.el7_6