CVE-2018-1000079

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-03-13 · updated 2026-06-17
Weakness: CWE-22

Description

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.

Affected products

rubygems: through 2.2.9; through 2.3.6; through 2.4.3; through 2.5.0

References

http://blog.rubygems.org/2018/02/15/2.7.6-released.html
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
https://access.redhat.com/errata/RHSA-2018:3729
https://access.redhat.com/errata/RHSA-2018:3730
https://access.redhat.com/errata/RHSA-2018:3731
https://access.redhat.com/errata/RHSA-2019:2028
https://access.redhat.com/errata/RHSA-2020:0542
https://access.redhat.com/errata/RHSA-2020:0591
https://access.redhat.com/errata/RHSA-2020:0663
https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099
https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html

Get alerted when CVE-2018-1000079 or the next vulnerability affects your stack