Skip to content
OpenAdvisories
High USN-3621-2 1 CVE

ruby1.9.1, ruby2.0 regression

Published Apr 13, 2018 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

USN-3621-1 fixed vulnerabilities in Ruby. The update caused an issue due
to an incomplete patch for CVE-2018-1000074. This update reverts the
problematic patch pending further investigation.

We apologize for the inconvenience.

Original advisory details:

It was discovered that Ruby incorrectly handled certain inputs. An attacker
could possibly use this to access sensitive information. (CVE-2018-1000073)

It was discovered that Ruby incorrectly handled certain files. An attacker
could possibly use this to execute arbitrary code. (CVE-2018-1000074)

It was discovered that Ruby incorrectly handled certain files. An attacker
could possibly use this to cause a denial of service. (CVE-2018-1000075)

It was discovered that Ruby incorrectly handled certain crypto signatures.
An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000076)

It was discovered that Ruby incorrectly handled certain inputs. An attacker
could possibly use this to execute arbitrary code. (CVE-2018-1000077,
CVE-2018-1000078, CVE-2018-1000079)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS ruby1.9.1 1.9.3.484-2ubuntu1.10
Ubuntu · 14.04 LTS 14.04:LTS ruby2.0 2.0.0.484-1ubuntu2.8

Vulnerabilities 1

  • High 7.8
    CVE-2018-1000074

    RubyGems Deserialization of Untrusted Data vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner …

    ruby2.3 jruby ruby2.0 ruby1.9.1 Debian Ubuntu Maven RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2018-1000074