RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 an...
Original description
The description as published by the source.
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2018-1000073 jruby Fixed in: 9.1.17.0-2.1
References
- advisory blog.rubygems.org
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory debian.org
- advisory debian.org
- patch github.com
- web lists.opensuse.org
- web lists.debian.org
- web usn.ubuntu.com