Skip to content
OpenAdvisories
Critical DSA-4219-1 7 CVEs

jruby - security update

Published Jun 8, 2018 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 jruby 1.7.26-1+deb9u1

Vulnerabilities 7

  • Critical 9.8
    CVE-2018-1000076

    RubyGems Improper Verification of Cryptographic Signature vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerab…

    ruby2.3 jruby ruby2.0 rubygems Debian Ubuntu Maven RubyGems
  • High 7.8
    CVE-2018-1000074

    RubyGems Deserialization of Untrusted Data vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner …

    ruby2.3 jruby ruby2.0 ruby1.9.1 Debian Ubuntu Maven RubyGems
  • High 7.5
    CVE-2018-1000073

    RubyGems Link Following vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location fun…

    ruby2.3 jruby ruby2.0 rubygems Debian Ubuntu Maven RubyGems
  • High 7.5
    CVE-2018-1000075

    RubyGems Infinite Loop vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ru…

    ruby2.3 jruby ruby2.0 ruby1.9.1 Debian Ubuntu Maven RubyGems
  • Medium 6.1
    CVE-2018-1000078

    RubyGems Cross-site Scripting vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server di…

    ruby2.3 jruby ruby2.0 ruby1.9.1 Debian Ubuntu Maven RubyGems
  • Medium 5.5
    CVE-2018-1000079

    RubyGems Path Traversal vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation tha…

    ruby2.3 jruby ruby2.0 rubygems Debian Ubuntu Maven RubyGems
  • Medium 5.3
    CVE-2018-1000077

    RubyGems Improper Input Validation vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems spec…

    ruby2.3 jruby ruby2.0 ruby1.9.1 Debian Ubuntu Maven RubyGems