Skip to content
OpenAdvisories

Package · Ubuntu

jruby

54 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

54 results · Feed

  • High 7.5
    CVE-2018-1000075

    RubyGems Infinite Loop vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ru…

    ruby2.3 jruby ruby2.0 ruby1.9.1 Debian Ubuntu Maven RubyGems
  • Critical 9.8
    CVE-2018-1000076

    RubyGems Improper Verification of Cryptographic Signature vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerab…

    ruby2.3 jruby ruby2.0 rubygems Debian Ubuntu Maven RubyGems
  • Medium 6.1
    CVE-2018-1000078

    RubyGems Cross-site Scripting vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server di…

    ruby2.3 jruby ruby2.0 ruby1.9.1 Debian Ubuntu Maven RubyGems
  • High 7.8
    CVE-2018-1000074

    RubyGems Deserialization of Untrusted Data vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner …

    ruby2.3 jruby ruby2.0 ruby1.9.1 Debian Ubuntu Maven RubyGems
  • High 7.5
    CVE-2018-1000073

    RubyGems Link Following vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location fun…

    ruby2.3 jruby ruby2.0 rubygems Debian Ubuntu Maven RubyGems
  • Medium 5.3
    CVE-2018-1000077

    RubyGems Improper Input Validation vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems spec…

    ruby2.3 jruby ruby2.0 ruby1.9.1 Debian Ubuntu Maven RubyGems
  • Medium 5.5
    CVE-2018-1000079

    RubyGems Path Traversal vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation tha…

    ruby2.3 jruby ruby2.0 rubygems Debian Ubuntu Maven RubyGems
  • Critical 9.8
    CVE-2017-0903 EPSS 16%

    RubyGems vulnerable to Deserialization of Untrusted Data

    RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remo…

    HackerOne RubyGems ruby2.3 jruby Debian Ubuntu RubyGems
  • High 7.5
    CVE-2017-0901 Public exploit EPSS 29%

    RubyGems may allow a maliciously crafted gem to overwrite files

    RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

    HackerOne RubyGems ruby2.3 ruby Debian Ubuntu Alpine RubyGems
  • High 8.1
    CVE-2017-0902

    RubyGems has Origin Validation Error vulnerability

    RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

    HackerOne RubyGems ruby2.3 ruby Debian Ubuntu Alpine RubyGems
  • Critical 9.8
    CVE-2017-0899 EPSS 11%

    RubyGems Code Injection vulnerability

    RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

    HackerOne RubyGems ruby2.3 ruby Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2017-0900

    RubyGems Improper Input Validation vulnerability

    RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.

    ruby2.3 ruby jruby ruby1.9.1 Debian Ubuntu Alpine RubyGems
  • Medium —
    CVE-2012-2126

    RubyGems does not verify SSL certificate

    RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.

    jruby rubygems rubygems-update Debian Ubuntu RubyGems
  • Medium —
    CVE-2012-2125

    RubyGems HTTPS to HTTP redirect

    RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.

    jruby rubygems rubygems-update Debian Ubuntu RubyGems