CVE-2018-1000076 RubyGems Improper Verification of Cryptographic Signature vulnerability
Attackers can install malicious gems by exploiting improper cryptographic signature verification in RubyGems, leading to potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000076?
CVE-2018-1000076 is a critical vulnerability in Debian Debian Linux, published on 13 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.
Weakness: CWE-347
Which versions are affected by CVE-2018-1000076?
4 open source packages ship an affected version, including org.jruby:jruby-stdlib and rubygems-update. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.jruby:jruby-stdlib Maven | All versions | 9.1.16.0 |
org.jruby:jruby-stdlib Maven | All versions | 9.1.16.0 |
rubygems-update RubyGems | From 2.2.0 | 2.7.6 |
rubygems-update RubyGems | From 2.2.0 | 2.7.6 |
Products include Debian Debian Linux, Rubygems Rubygems.
How do I fix CVE-2018-1000076?
Upgrade org.jruby:jruby-stdlib to 9.1.16.0 or later.
Is CVE-2018-1000076 being exploited?
There is no known exploitation of CVE-2018-1000076 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-1000076, GHSA-mc6j-h948-v2p6, UBUNTU-CVE-2018-1000076.