CVE-2019-8324 — Code injection in RubyGems

Description

An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	jruby	9.1.17.0-3	—
Debian 14	rubygems	3.2.0~rc.1-1	—
Debian 13	jruby	9.1.17.0-3	—
Debian 13	rubygems	3.2.0~rc.1-1	—
Debian 12	jruby	9.1.17.0-3	—
Debian 12	rubygems	3.2.0~rc.1-1	—
Debian 9	jruby	1.7.26-1+deb9u2	DLA-2330-1
Debian 9	ruby2.3	2.3.3-1+deb9u6	DSA-4433-1
Debian 8	jruby	1.5.6-9+deb8u1	DLA-1796-1
Debian 8	ruby2.1	2.1.5-2+deb8u7	DLA-1735-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	jruby	No fix yet	—
Ubuntu 18.04 LTS	ruby2.5	2.5.1-1ubuntu1.2	USN-3945-1
Ubuntu 16.04 LTS	ruby2.3	2.3.1-2~16.04.12	USN-3945-1
Ubuntu 14.04 LTS	ruby1.9.1	1.9.3.484-2ubuntu1.14	USN-3945-1
Ubuntu 14.04 LTS	ruby2.0	2.0.0.484-1ubuntu2.13	USN-3945-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 14.04 LTS	jruby	1.5.6-9+deb8u2build0.14.04.1~esm2	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 8	ruby +4	2.5.3-104.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-abrt +1	0.3.0-4.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-bigdecimal	1.3.4-104.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-bson +1	4.3.0-2.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-bundler +1	1.16.1-3.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-did_you_mean	1.2.0-104.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-io-console	0.4.6-104.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-json	2.1.0-104.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-minitest	5.10.3-104.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-mongo +1	2.5.1-2.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-mysql2 +1	0.4.10-4.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-net-telnet	0.1.1-104.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-openssl	2.1.2-104.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-pg +1	1.0.0-2.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-power_assert	1.1.1-104.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-psych	3.0.2-104.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-rake	12.3.0-104.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-rdoc	6.0.1-104.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-test-unit	3.2.7-104.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygem-xmlrpc	0.3.0-104.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 8	rubygems +1	2.7.6-104.module+el8.0.0+3250+4b7d6d43	RHSA-2019:1972
RHEL 7	ruby +5	2.0.0.648-35.el7_6	RHSA-2019:1235
RHEL 7	rubygem-bigdecimal	1.2.0-35.el7_6	RHSA-2019:1235
RHEL 7	rubygem-io-console	0.4.2-35.el7_6	RHSA-2019:1235
RHEL 7	rubygem-json	1.7.7-35.el7_6	RHSA-2019:1235
RHEL 7	rubygem-minitest	4.3.2-35.el7_6	RHSA-2019:1235
RHEL 7	rubygem-psych	2.0.0-35.el7_6	RHSA-2019:1235
RHEL 7	rubygem-rake	0.9.6-35.el7_6	RHSA-2019:1235
RHEL 7	rubygem-rdoc	4.0.0-35.el7_6	RHSA-2019:1235
RHEL 7	rubygems +1	2.0.14.1-35.el7_6	RHSA-2019:1235
RHEL 3	rh-ruby23-ruby +5	2.3.8-70.el6	RHSA-2019:1151
RHEL 3	rh-ruby23-rubygem-bigdecimal	1.2.8-70.el6	RHSA-2019:1151
RHEL 3	rh-ruby23-rubygem-did_you_mean	1.0.0-70.el6	RHSA-2019:1151
RHEL 3	rh-ruby23-rubygem-io-console	0.4.5-70.el6	RHSA-2019:1151
RHEL 3	rh-ruby23-rubygem-json	1.8.3.1-70.el6	RHSA-2019:1151
RHEL 3	rh-ruby23-rubygem-minitest	5.8.5-70.el6	RHSA-2019:1151
RHEL 3	rh-ruby23-rubygem-net-telnet	0.1.1-70.el6	RHSA-2019:1151
RHEL 3	rh-ruby23-rubygem-power_assert	0.2.6-70.el6	RHSA-2019:1151
RHEL 3	rh-ruby23-rubygem-psych	2.1.0.1-70.el6	RHSA-2019:1151
RHEL 3	rh-ruby23-rubygem-rake	10.4.2-70.el6	RHSA-2019:1151
RHEL 3	rh-ruby23-rubygem-rdoc	4.2.1-70.el6	RHSA-2019:1151
RHEL 3	rh-ruby23-rubygem-test-unit	3.1.5-70.el6	RHSA-2019:1151
RHEL 3	rh-ruby23-rubygems +1	2.5.2.3-70.el6	RHSA-2019:1151
RHEL 3	rh-ruby24-ruby +4	2.4.6-92.el6	RHSA-2019:1150
RHEL 3	rh-ruby24-rubygem-bigdecimal	1.3.2-92.el6	RHSA-2019:1150
RHEL 3	rh-ruby24-rubygem-did_you_mean	1.1.0-92.el6	RHSA-2019:1150
RHEL 3	rh-ruby24-rubygem-io-console	0.4.6-92.el6	RHSA-2019:1150
RHEL 3	rh-ruby24-rubygem-json	2.0.4-92.el6	RHSA-2019:1150
RHEL 3	rh-ruby24-rubygem-minitest	5.10.1-92.el6	RHSA-2019:1150
RHEL 3	rh-ruby24-rubygem-net-telnet	0.1.1-92.el6	RHSA-2019:1150
RHEL 3	rh-ruby24-rubygem-openssl	2.0.9-92.el6	RHSA-2019:1150
RHEL 3	rh-ruby24-rubygem-power_assert	0.4.1-92.el6	RHSA-2019:1150
RHEL 3	rh-ruby24-rubygem-psych	2.2.2-92.el6	RHSA-2019:1150
RHEL 3	rh-ruby24-rubygem-rake	12.0.0-92.el6	RHSA-2019:1150
RHEL 3	rh-ruby24-rubygem-rdoc	5.0.0-92.el6	RHSA-2019:1150
RHEL 3	rh-ruby24-rubygem-test-unit	3.2.3-92.el6	RHSA-2019:1150
RHEL 3	rh-ruby24-rubygem-xmlrpc	0.2.1-92.el6	RHSA-2019:1150
RHEL 3	rh-ruby24-rubygems +1	2.6.14.4-92.el6	RHSA-2019:1150
RHEL 3	rh-ruby25-ruby +4	2.5.5-7.el7	RHSA-2019:1148
RHEL 3	rh-ruby25-rubygem-bigdecimal	1.3.4-7.el7	RHSA-2019:1148
RHEL 3	rh-ruby25-rubygem-did_you_mean	1.2.0-7.el7	RHSA-2019:1148
RHEL 3	rh-ruby25-rubygem-io-console	0.4.6-7.el7	RHSA-2019:1148
RHEL 3	rh-ruby25-rubygem-json	2.1.0-7.el7	RHSA-2019:1148
RHEL 3	rh-ruby25-rubygem-minitest	5.10.3-7.el7	RHSA-2019:1148
RHEL 3	rh-ruby25-rubygem-net-telnet	0.1.1-7.el7	RHSA-2019:1148
RHEL 3	rh-ruby25-rubygem-openssl	2.1.2-7.el7	RHSA-2019:1148
RHEL 3	rh-ruby25-rubygem-power_assert	1.1.1-7.el7	RHSA-2019:1148
RHEL 3	rh-ruby25-rubygem-psych	3.0.2-7.el7	RHSA-2019:1148
RHEL 3	rh-ruby25-rubygem-rake	12.3.0-7.el7	RHSA-2019:1148
RHEL 3	rh-ruby25-rubygem-rdoc	6.0.1-7.el7	RHSA-2019:1148
RHEL 3	rh-ruby25-rubygem-test-unit	3.2.7-7.el7	RHSA-2019:1148
RHEL 3	rh-ruby25-rubygem-xmlrpc	0.3.0-7.el7	RHSA-2019:1148
RHEL 3	rh-ruby25-rubygems +1	2.7.6.2-7.el7	RHSA-2019:1148

Show 4 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 7.4 TUS	ruby +5	2.0.0.648-37.el7_4	RHSA-2020:2769
RHEL 7.4 TUS	rubygem-bigdecimal	1.2.0-37.el7_4	RHSA-2020:2769
RHEL 7.4 TUS	rubygem-io-console	0.4.2-37.el7_4	RHSA-2020:2769
RHEL 7.4 TUS	rubygem-json	1.7.7-37.el7_4	RHSA-2020:2769
RHEL 7.4 TUS	rubygem-minitest	4.3.2-37.el7_4	RHSA-2020:2769
RHEL 7.4 TUS	rubygem-psych	2.0.0-37.el7_4	RHSA-2020:2769
RHEL 7.4 TUS	rubygem-rake	0.9.6-37.el7_4	RHSA-2020:2769
RHEL 7.4 TUS	rubygem-rdoc	4.0.0-37.el7_4	RHSA-2020:2769
RHEL 7.4 TUS	rubygems +1	2.0.14.1-37.el7_4	RHSA-2020:2769
RHEL 7.4 E4S	ruby +5	2.0.0.648-37.el7_4	RHSA-2020:2769
RHEL 7.4 E4S	rubygem-bigdecimal	1.2.0-37.el7_4	RHSA-2020:2769
RHEL 7.4 E4S	rubygem-io-console	0.4.2-37.el7_4	RHSA-2020:2769
RHEL 7.4 E4S	rubygem-json	1.7.7-37.el7_4	RHSA-2020:2769
RHEL 7.4 E4S	rubygem-minitest	4.3.2-37.el7_4	RHSA-2020:2769
RHEL 7.4 E4S	rubygem-psych	2.0.0-37.el7_4	RHSA-2020:2769
RHEL 7.4 E4S	rubygem-rake	0.9.6-37.el7_4	RHSA-2020:2769
RHEL 7.4 E4S	rubygem-rdoc	4.0.0-37.el7_4	RHSA-2020:2769
RHEL 7.4 E4S	rubygems +1	2.0.14.1-37.el7_4	RHSA-2020:2769
RHEL 7.4 AUS	ruby +5	2.0.0.648-37.el7_4	RHSA-2020:2769
RHEL 7.4 AUS	rubygem-bigdecimal	1.2.0-37.el7_4	RHSA-2020:2769
RHEL 7.4 AUS	rubygem-io-console	0.4.2-37.el7_4	RHSA-2020:2769
RHEL 7.4 AUS	rubygem-json	1.7.7-37.el7_4	RHSA-2020:2769
RHEL 7.4 AUS	rubygem-minitest	4.3.2-37.el7_4	RHSA-2020:2769
RHEL 7.4 AUS	rubygem-psych	2.0.0-37.el7_4	RHSA-2020:2769
RHEL 7.4 AUS	rubygem-rake	0.9.6-37.el7_4	RHSA-2020:2769
RHEL 7.4 AUS	rubygem-rdoc	4.0.0-37.el7_4	RHSA-2020:2769
RHEL 7.4 AUS	rubygems +1	2.0.14.1-37.el7_4	RHSA-2020:2769
Red Hat CloudForms 5	cfme +5	5.10.5.1-1.el7cf	RHSA-2019:1429
Red Hat CloudForms 5	ruby +4	2.4.6-91.el7cf	RHSA-2019:1429
Red Hat CloudForms 5	rubygem-bigdecimal	1.3.2-91.el7cf	RHSA-2019:1429
Red Hat CloudForms 5	rubygem-did_you_mean	1.1.0-91.el7cf	RHSA-2019:1429
Red Hat CloudForms 5	rubygem-io-console	0.4.6-91.el7cf	RHSA-2019:1429
Red Hat CloudForms 5	rubygem-minitest	5.10.1-91.el7cf	RHSA-2019:1429
Red Hat CloudForms 5	rubygem-net-telnet	0.1.1-91.el7cf	RHSA-2019:1429
Red Hat CloudForms 5	rubygem-openssl	2.0.9-91.el7cf	RHSA-2019:1429
Red Hat CloudForms 5	rubygem-power_assert	0.4.1-91.el7cf	RHSA-2019:1429
Red Hat CloudForms 5	rubygem-psych	2.2.2-91.el7cf	RHSA-2019:1429
Red Hat CloudForms 5	rubygem-rake	12.0.0-91.el7cf	RHSA-2019:1429
Red Hat CloudForms 5	rubygem-rdoc	5.0.0-91.el7cf	RHSA-2019:1429
Red Hat CloudForms 5	rubygem-test-unit	3.2.3-91.el7cf	RHSA-2019:1429
Red Hat CloudForms 5	rubygem-xmlrpc	0.2.1-91.el7cf	RHSA-2019:1429
Red Hat CloudForms 5	rubygems +1	2.6.14.4-91.el7cf	RHSA-2019:1429

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 8	rubygem-abrt +1	0.3.0-4.module_el8.5.0+259+8cec6917	ALSA-2019:1972
AlmaLinux 8	rubygem-bson +1	4.3.0-2.module_el8.5.0+259+8cec6917	ALSA-2019:1972
AlmaLinux 8	rubygem-mongo +1	2.5.1-2.module_el8.5.0+259+8cec6917	ALSA-2019:1972
AlmaLinux 8	rubygem-mysql2 +1	0.4.10-4.module_el8.5.0+259+8cec6917	ALSA-2019:1972
AlmaLinux 8	rubygem-pg +1	1.0.0-2.module_el8.5.0+259+8cec6917	ALSA-2019:1972

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 8	rubygem-abrt	0.3.0-4.module+el8.3.0+167+5c390590	RLSA-2019:1972
Rocky Linux 8	rubygem-bson	4.3.0-2.module+el8.3.0+167+5c390590	RLSA-2019:1972
Rocky Linux 8	rubygem-bundler	1.16.1-3.module+el8.3.0+167+5c390590	RLSA-2019:1972
Rocky Linux 8	rubygem-mongo	2.5.1-2.module+el8.4.0+349+3470f258	RLSA-2019:1972
Rocky Linux 8	rubygem-mysql2	0.4.10-4.module+el8.3.0+167+5c390590	RLSA-2019:1972
Rocky Linux 8	rubygem-pg	1.0.0-2.module+el8.3.0+167+5c390590	RLSA-2019:1972

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP1	ruby2.5	2.5.5-4.3.1	SUSE-SU-2019:1804-1
SLES 15	ruby2.5	2.5.5-4.3.1	SUSE-SU-2019:1804-1
SLES 12 SP5	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SLES 12 SP4	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SLES 12 SP3	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1

Show 10 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP2	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SLES 12 SP2	yast2-ruby-bindings	3.1.53-9.8.1	SUSE-SU-2020:1570-1
SLES for SAP 12 SP5	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SLES for SAP 12 SP4	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SLES for SAP 12 SP3	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SLES for SAP 12 SP2	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SLES for SAP 12 SP2	yast2-ruby-bindings	3.1.53-9.8.1	SUSE-SU-2020:1570-1
SUSE OpenStack Cloud Crowbar 8	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SUSE OpenStack Cloud 8	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SUSE OpenStack Cloud 7	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SUSE OpenStack Cloud 7	yast2-ruby-bindings	3.1.53-9.8.1	SUSE-SU-2020:1570-1
SUSE HPE Helion OpenStack 8	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SUSE Enterprise Storage 5	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Leap 15.1	ruby-bundled-gems-rpmhelper	0.0.2-lp151.2.1	openSUSE-SU-2019:1771-1
openSUSE Leap 15.1	ruby2.5	2.5.5-lp151.4.3.1	openSUSE-SU-2019:1771-1
openSUSE Leap 15.0	ruby-bundled-gems-rpmhelper	0.0.2-lp151.2.1	openSUSE-SU-2019:1771-1
openSUSE Leap 15.0	ruby2.5	2.5.5-lp151.4.3.1	openSUSE-SU-2019:1771-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.9	ruby	2.5.5-r0	—
Alpine v3.8	ruby	2.5.5-r0	—
Alpine v3.7	ruby	2.4.6-r0	—
Alpine v3.6	ruby	2.4.6-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	ruby +5	2.0.0.648-35.amzn2.0.1	ALAS2-2019-1249
Amazon Linux 2	rubygem-bigdecimal	1.2.0-35.amzn2.0.1	ALAS2-2019-1249
Amazon Linux 2	rubygem-io-console	0.4.2-35.amzn2.0.1	ALAS2-2019-1249
Amazon Linux 2	rubygem-json	1.7.7-35.amzn2.0.1	ALAS2-2019-1249
Amazon Linux 2	rubygem-minitest	4.3.2-35.amzn2.0.1	ALAS2-2019-1249
Amazon Linux 2	rubygem-psych	2.0.0-35.amzn2.0.1	ALAS2-2019-1249
Amazon Linux 2	rubygem-rake	0.9.6-35.amzn2.0.1	ALAS2-2019-1249
Amazon Linux 2	rubygem-rdoc	4.0.0-35.amzn2.0.1	ALAS2-2019-1249
Amazon Linux 2	rubygems +1	2.0.14.1-35.amzn2.0.1	ALAS2-2019-1249

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 8	ruby +4	2.5.3-104.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-abrt +1	0.3.0-4.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-bigdecimal	1.3.4-104.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-bson +1	4.3.0-2.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-bundler +1	1.16.1-3.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-did_you_mean	1.2.0-104.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-io-console	0.4.6-104.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-json	2.1.0-104.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-minitest	5.10.3-104.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-mongo +1	2.5.1-2.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-mysql2 +1	0.4.10-4.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-net-telnet	0.1.1-104.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-openssl	2.1.2-104.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-pg +1	1.0.0-2.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-power_assert	1.1.1-104.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-psych	3.0.2-104.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-rake	12.3.0-104.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-rdoc	6.0.1-104.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-test-unit	3.2.7-104.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygem-xmlrpc	0.3.0-104.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 8	rubygems +1	2.7.6-104.module+el8.0.0+5238+4f9ac61b	ELSA-2019-1972
Oracle Linux 7	ruby +5	2.0.0.648-35.el7_6	ELSA-2019-1235
Oracle Linux 7	rubygem-bigdecimal	1.2.0-35.el7_6	ELSA-2019-1235
Oracle Linux 7	rubygem-io-console	0.4.2-35.el7_6	ELSA-2019-1235
Oracle Linux 7	rubygem-json	1.7.7-35.el7_6	ELSA-2019-1235
Oracle Linux 7	rubygem-minitest	4.3.2-35.el7_6	ELSA-2019-1235
Oracle Linux 7	rubygem-psych	2.0.0-35.el7_6	ELSA-2019-1235
Oracle Linux 7	rubygem-rake	0.9.6-35.el7_6	ELSA-2019-1235
Oracle Linux 7	rubygem-rdoc	4.0.0-35.el7_6	ELSA-2019-1235
Oracle Linux 7	rubygems +1	2.0.14.1-35.el7_6	ELSA-2019-1235

Affected packages

Ecosystem	Package	Affected	Fixed	Record
RubyGems	rubygems-update	>= 2.6.0, < 2.7.9	2.7.9	GHSA-76wm-422q-92mq
RubyGems	rubygems-update	>= 3.0.0, < 3.0.2	3.0.2	GHSA-76wm-422q-92mq

Advisories 20

ALSA-2019:1972 Important: ruby:2.5 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2020:2769 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHSA-2019:1972 Red Hat Security Advisory: ruby:2.5 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHSA-2019:1429 Red Hat Security Advisory: CloudForms 4.7.5 security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHSA-2019:1235 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHSA-2019:1151 Red Hat Security Advisory: rh-ruby23-ruby security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHSA-2019:1150 Red Hat Security Advisory: rh-ruby24-ruby security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHSA-2019:1148 Red Hat Security Advisory: rh-ruby25-ruby security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
USN-3945-1 ruby1.9.1, ruby2.0, ruby2.3, ruby2.5 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
DSA-4433-1 ruby2.3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-1796-1 jruby - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-1735-1 ruby2.1 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-2330-1 jruby - security update Debian Security (DSA / DLA) · Mar 9, 2026
RLSA-2019:1972 Important: ruby:2.5 security update Rocky Linux Security Advisories · Feb 4, 2026
openSUSE-SU-2019:1771-1 Security update for ruby-bundled-gems-rpmhelper, ruby2.5 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2019:1804-1 Security update for ruby-bundled-gems-rpmhelper, ruby2.5 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:1570-1 Security update for ruby2.1 SUSE / openSUSE Security Updates · Feb 4, 2026
ELSA-2019-1972 Important: ruby:2.5 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 5, 2019
ALAS2-2019-1249 Important: ruby security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 22, 2019
ELSA-2019-1235 Important: ruby security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · May 16, 2019

References

https://hackerone.com/reports/328571
openSUSE-SU-2019:1771 vendor-advisory
RHSA-2019:1972 vendor-advisory
[debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update mailing-list