9.8

CVE-2018-1000076

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rubygems ≫ Rubygems Version <= 2.2.9
Rubygems ≫ Rubygems Version <= 2.3.6
Rubygems ≫ Rubygems Version <= 2.4.3
Rubygems ≫ Rubygems Version <= 2.5.0
Debian ≫ Debian Linux Version7.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.04% 0.858
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
https://www.debian.org/security/2018/dsa-4259
http://blog.rubygems.org/2018/02/15/2.7.6-released.html
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
https://access.redhat.com/errata/RHSA-2018:3729
https://access.redhat.com/errata/RHSA-2018:3730
https://access.redhat.com/errata/RHSA-2018:3731
https://access.redhat.com/errata/RHSA-2019:2028
https://access.redhat.com/errata/RHSA-2020:0542
https://access.redhat.com/errata/RHSA-2020:0591
https://access.redhat.com/errata/RHSA-2020:0663
https://usn.ubuntu.com/3621-1/
https://www.debian.org/security/2018/dsa-4219
https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html
https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693
Patch
Third Party Advisory