5.3

CVE-2018-1000077

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rubygems ≫ Rubygems Version <= 2.2.9
Rubygems ≫ Rubygems Version <= 2.3.6
Rubygems ≫ Rubygems Version <= 2.4.3
Rubygems ≫ Rubygems Version <= 2.5.0
Debian ≫ Debian Linux Version7.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.83% 0.887
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
https://www.debian.org/security/2018/dsa-4259
http://blog.rubygems.org/2018/02/15/2.7.6-released.html
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
https://access.redhat.com/errata/RHSA-2018:3729
https://access.redhat.com/errata/RHSA-2018:3730
https://access.redhat.com/errata/RHSA-2018:3731
https://access.redhat.com/errata/RHSA-2019:2028
https://access.redhat.com/errata/RHSA-2020:0542
https://access.redhat.com/errata/RHSA-2020:0591
https://access.redhat.com/errata/RHSA-2020:0663
https://usn.ubuntu.com/3621-1/
https://www.debian.org/security/2018/dsa-4219
https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html
https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
https://github.com/rubygems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964
Patch
Third Party Advisory