RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 an...
Original description
The description as published by the source.
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2018-1000076 jruby Fixed in: 9.1.17.0-1
References
- advisory blog.rubygems.org
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory lists.debian.org
- advisory lists.debian.org
- advisory debian.org
- advisory debian.org
- patch github.com
- web lists.opensuse.org
- web lists.debian.org
- web lists.debian.org
- web lists.debian.org
- web usn.ubuntu.com