{"resultsPerPage":47,"startIndex":0,"totalResults":47,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-11T00:35:04.618","vulnerabilities":[{"cve":{"id":"CVE-2007-0469","sourceIdentifier":"cve@mitre.org","published":"2007-01-24T01:28:00.000","lastModified":"2026-06-16T22:35:38.173","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages."},{"lang":"es","value":"La función extract_files en installer.rb de RubyGems before 0.9.1 no comprueba la existencia ficheros antes de sobrescribirlos, lo cual permite a atacantes remotos con la complicidad del usuario sobrescribir ficheros de su elección, provocar una denegación de servicio, o ejecutar código de su elección mediante paquetes GEM artesanales."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubyforge:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"0.9.0","matchCriteriaId":"CD242F0E-FA2C-4702-9482-0FA738C92F0D"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubyforge:rubygems:0.8.11:*:*:*:*:*:*:*","matchCriteriaId":"F8533BB9-84D9-4941-A569-E3103BD14114"}]}]}],"references":[{"url":"http://marc.info/?l=full-disclosure&m=116939816621060&w=2","source":"cve@mitre.org"},{"url":"http://rubyforge.org/frs/shownotes.php?release_id=9074","source":"cve@mitre.org","tags":["Patch","Vendor Advisory"]},{"url":"http://www.novell.com/linux/security/advisories/2007_4_sr.html","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/458128/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2007/0295","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31688","source":"cve@mitre.org"},{"url":"http://marc.info/?l=full-disclosure&m=116939816621060&w=2","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rubyforge.org/frs/shownotes.php?release_id=9074","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"http://www.novell.com/linux/security/advisories/2007_4_sr.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/458128/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2007/0295","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31688","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2012-2125","sourceIdentifier":"secalert@redhat.com","published":"2013-10-01T17:55:03.257","lastModified":"2026-06-16T23:41:02.467","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack."},{"lang":"es","value":"RubyGems anteriores a 1.8.23 pueden redirigir conexiones HTTPS a HTTP, lo cual facilita a atacantes remotos observar o modificar una gema durante la instalación a través de un ataque man-in-the-middle."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"1.8.22","matchCriteriaId":"129BE399-B405-4DF1-987B-6DA24172FC19"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.0:*:*:*:*:*:*:*","matchCriteriaId":"8D6A915B-43FF-4FFA-98FA-968403825D43"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.1:*:*:*:*:*:*:*","matchCriteriaId":"767790C2-2C72-45C0-A4EF-F21EAAAD1698"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.2:*:*:*:*:*:*:*","matchCriteriaId":"DBAB2571-F73A-4843-A494-1D10A214862D"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.3:*:*:*:*:*:*:*","matchCriteriaId":"57847827-F148-42C9-9180-3D5482249CB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.4:*:*:*:*:*:*:*","matchCriteriaId":"323AC584-E261-445D-9C84-DA34DFDE2D39"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.5:*:*:*:*:*:*:*","matchCriteriaId":"2A563E3D-2D87-4712-8C90-067ABB9D6810"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.6:*:*:*:*:*:*:*","matchCriteriaId":"7B540D22-0BDC-4727-B11E-9667F6E188BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.7:*:*:*:*:*:*:*","matchCriteriaId":"8D7D308E-2A6C-4DF7-94B1-C5BCC5C3FD24"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.8:*:*:*:*:*:*:*","matchCriteriaId":"741E979F-6AD5-4C15-8541-5D5F659E5ED3"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.9:*:*:*:*:*:*:*","matchCriteriaId":"81C93DD3-19B4-431D-A7BD-E86F90F91745"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.10:*:*:*:*:*:*:*","matchCriteriaId":"CA2C407B-2C0F-4C46-9F5B-6C63CC887941"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.11:*:*:*:*:*:*:*","matchCriteriaId":"7865522C-C5D0-4D4B-B090-7B756B36DF4F"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.12:*:*:*:*:*:*:*","matchCriteriaId":"CA1CDCDA-E1F2-4C23-8448-0EF1D61CE40B"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.13:*:*:*:*:*:*:*","matchCriteriaId":"95AE74A8-4A90-4372-8B88-81FF7E6E578B"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.14:*:*:*:*:*:*:*","matchCriteriaId":"3F6BED14-99EA-4F87-95BB-078D2CEED349"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.15:*:*:*:*:*:*:*","matchCriteriaId":"7EC8340E-D33E-4DB6-A08B-E56EA035C133"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.16:*:*:*:*:*:*:*","matchCriteriaId":"4BF3F97C-C396-4AFE-9EC6-4BBD840ED363"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.17:*:*:*:*:*:*:*","matchCriteriaId":"41E7E929-1144-438A-A55D-0B5CE6886C0E"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.18:*:*:*:*:*:*:*","matchCriteriaId":"F3EB522C-6EA5-4CF5-B610-CB9414DD4815"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.19:*:*:*:*:*:*:*","matchCriteriaId":"EF3220D1-DEFF-46A6-95B3-A40838D4E294"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.20:*:*:*:*:*:*:*","matchCriteriaId":"E8DA4D9E-B822-4254-856C-3176A948D718"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.21:*:*:*:*:*:*:*","matchCriteriaId":"0D3EAD7C-CB12-4897-B5FA-63D49CDABD35"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:1.2.2:-:enterprise:*:*:*:*:*","matchCriteriaId":"A7868189-C831-4E7D-9718-B2EFF16FCA3D"},{"vulnerable":false,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*","matchCriteriaId":"F5D324C4-97C7-49D3-A809-9EAD4B690C69"}]}]}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-1203.html","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1441.html","source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1852.html","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/55381","source":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2012/04/20/24","source":"secalert@redhat.com","tags":["Patch"]},{"url":"http://www.ubuntu.com/usn/USN-1582-1/","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=814718","source":"secalert@redhat.com","tags":["Patch"]},{"url":"https://github.com/rubygems/rubygems/blob/1.8/History.txt","source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1203.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1441.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1852.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/55381","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2012/04/20/24","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"http://www.ubuntu.com/usn/USN-1582-1/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=814718","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/rubygems/rubygems/blob/1.8/History.txt","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2012-2126","sourceIdentifier":"secalert@redhat.com","published":"2013-10-01T17:55:03.367","lastModified":"2026-06-16T23:41:02.613","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack."},{"lang":"es","value":"RubyGems anteriores a 1.8.23 no verifican un certificado SSL, lo cual permite a atacantes remotos modificar una gema durante la instalación a través de un ataque man-in-the-middle."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-310"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"1.8.22","matchCriteriaId":"129BE399-B405-4DF1-987B-6DA24172FC19"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.0:*:*:*:*:*:*:*","matchCriteriaId":"8D6A915B-43FF-4FFA-98FA-968403825D43"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.1:*:*:*:*:*:*:*","matchCriteriaId":"767790C2-2C72-45C0-A4EF-F21EAAAD1698"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.2:*:*:*:*:*:*:*","matchCriteriaId":"DBAB2571-F73A-4843-A494-1D10A214862D"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.3:*:*:*:*:*:*:*","matchCriteriaId":"57847827-F148-42C9-9180-3D5482249CB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.4:*:*:*:*:*:*:*","matchCriteriaId":"323AC584-E261-445D-9C84-DA34DFDE2D39"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.5:*:*:*:*:*:*:*","matchCriteriaId":"2A563E3D-2D87-4712-8C90-067ABB9D6810"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.6:*:*:*:*:*:*:*","matchCriteriaId":"7B540D22-0BDC-4727-B11E-9667F6E188BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.7:*:*:*:*:*:*:*","matchCriteriaId":"8D7D308E-2A6C-4DF7-94B1-C5BCC5C3FD24"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.8:*:*:*:*:*:*:*","matchCriteriaId":"741E979F-6AD5-4C15-8541-5D5F659E5ED3"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.9:*:*:*:*:*:*:*","matchCriteriaId":"81C93DD3-19B4-431D-A7BD-E86F90F91745"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.10:*:*:*:*:*:*:*","matchCriteriaId":"CA2C407B-2C0F-4C46-9F5B-6C63CC887941"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.11:*:*:*:*:*:*:*","matchCriteriaId":"7865522C-C5D0-4D4B-B090-7B756B36DF4F"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.12:*:*:*:*:*:*:*","matchCriteriaId":"CA1CDCDA-E1F2-4C23-8448-0EF1D61CE40B"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.13:*:*:*:*:*:*:*","matchCriteriaId":"95AE74A8-4A90-4372-8B88-81FF7E6E578B"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.14:*:*:*:*:*:*:*","matchCriteriaId":"3F6BED14-99EA-4F87-95BB-078D2CEED349"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.15:*:*:*:*:*:*:*","matchCriteriaId":"7EC8340E-D33E-4DB6-A08B-E56EA035C133"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.16:*:*:*:*:*:*:*","matchCriteriaId":"4BF3F97C-C396-4AFE-9EC6-4BBD840ED363"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.17:*:*:*:*:*:*:*","matchCriteriaId":"41E7E929-1144-438A-A55D-0B5CE6886C0E"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.18:*:*:*:*:*:*:*","matchCriteriaId":"F3EB522C-6EA5-4CF5-B610-CB9414DD4815"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.19:*:*:*:*:*:*:*","matchCriteriaId":"EF3220D1-DEFF-46A6-95B3-A40838D4E294"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.20:*:*:*:*:*:*:*","matchCriteriaId":"E8DA4D9E-B822-4254-856C-3176A948D718"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.21:*:*:*:*:*:*:*","matchCriteriaId":"0D3EAD7C-CB12-4897-B5FA-63D49CDABD35"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:1.2.2:*:*:*:enterprise:*:*:*","matchCriteriaId":"09EC6448-BC55-49B3-A224-B650764B3A1A"},{"vulnerable":false,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*","matchCriteriaId":"F5D324C4-97C7-49D3-A809-9EAD4B690C69"}]}]}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-1203.html","source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1441.html","source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1852.html","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/55381","source":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2012/04/20/24","source":"secalert@redhat.com"},{"url":"http://www.ubuntu.com/usn/USN-1582-1/","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=814718","source":"secalert@redhat.com"},{"url":"https://github.com/rubygems/rubygems/blob/1.8/History.txt","source":"secalert@redhat.com","tags":["Patch","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1203.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1441.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1852.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/55381","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2012/04/20/24","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-1582-1/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=814718","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/rubygems/rubygems/blob/1.8/History.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2013-4287","sourceIdentifier":"secalert@redhat.com","published":"2013-10-17T23:55:04.407","lastModified":"2026-06-16T23:56:57.593","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression."},{"lang":"es","value":"Vulnerabilidad en la complejidad algorítmicade  Gem :: Versión :: VERSION_PATTERN en lib / rubygems / version.rb de  RubyGems antes 1.8.23.1, 1.8.24 hasta 1.8.25, 2.0.x antes de 2.0.8, y 2.1.x anterior a  2.1.0  , como se usa en Ruby 1.9.0 hasta  2.0.0p247, permite a atacantes remotos provocar una denegación de servicio (consumo de CPU) a través de una versión de una gem manipulada que provoca una gran cantidad de retroceso en una expresión regular."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:N/A:P","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-310"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*","matchCriteriaId":"2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"1.8.23","matchCriteriaId":"EBD0BCCE-898F-4859-A1D8-5D15894BA539"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.0:*:*:*:*:*:*:*","matchCriteriaId":"8D6A915B-43FF-4FFA-98FA-968403825D43"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.1:*:*:*:*:*:*:*","matchCriteriaId":"767790C2-2C72-45C0-A4EF-F21EAAAD1698"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.2:*:*:*:*:*:*:*","matchCriteriaId":"DBAB2571-F73A-4843-A494-1D10A214862D"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.3:*:*:*:*:*:*:*","matchCriteriaId":"57847827-F148-42C9-9180-3D5482249CB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.4:*:*:*:*:*:*:*","matchCriteriaId":"323AC584-E261-445D-9C84-DA34DFDE2D39"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.5:*:*:*:*:*:*:*","matchCriteriaId":"2A563E3D-2D87-4712-8C90-067ABB9D6810"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.6:*:*:*:*:*:*:*","matchCriteriaId":"7B540D22-0BDC-4727-B11E-9667F6E188BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.7:*:*:*:*:*:*:*","matchCriteriaId":"8D7D308E-2A6C-4DF7-94B1-C5BCC5C3FD24"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.8:*:*:*:*:*:*:*","matchCriteriaId":"741E979F-6AD5-4C15-8541-5D5F659E5ED3"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.9:*:*:*:*:*:*:*","matchCriteriaId":"81C93DD3-19B4-431D-A7BD-E86F90F91745"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.10:*:*:*:*:*:*:*","matchCriteriaId":"CA2C407B-2C0F-4C46-9F5B-6C63CC887941"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.11:*:*:*:*:*:*:*","matchCriteriaId":"7865522C-C5D0-4D4B-B090-7B756B36DF4F"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.12:*:*:*:*:*:*:*","matchCriteriaId":"CA1CDCDA-E1F2-4C23-8448-0EF1D61CE40B"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.13:*:*:*:*:*:*:*","matchCriteriaId":"95AE74A8-4A90-4372-8B88-81FF7E6E578B"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.14:*:*:*:*:*:*:*","matchCriteriaId":"3F6BED14-99EA-4F87-95BB-078D2CEED349"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.15:*:*:*:*:*:*:*","matchCriteriaId":"7EC8340E-D33E-4DB6-A08B-E56EA035C133"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.16:*:*:*:*:*:*:*","matchCriteriaId":"4BF3F97C-C396-4AFE-9EC6-4BBD840ED363"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.17:*:*:*:*:*:*:*","matchCriteriaId":"41E7E929-1144-438A-A55D-0B5CE6886C0E"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.18:*:*:*:*:*:*:*","matchCriteriaId":"F3EB522C-6EA5-4CF5-B610-CB9414DD4815"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.19:*:*:*:*:*:*:*","matchCriteriaId":"EF3220D1-DEFF-46A6-95B3-A40838D4E294"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.20:*:*:*:*:*:*:*","matchCriteriaId":"E8DA4D9E-B822-4254-856C-3176A948D718"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.21:*:*:*:*:*:*:*","matchCriteriaId":"0D3EAD7C-CB12-4897-B5FA-63D49CDABD35"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.22:*:*:*:*:*:*:*","matchCriteriaId":"03AC5DA5-AD7F-4C7F-8437-568B7AAAEB17"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.24:*:*:*:*:*:*:*","matchCriteriaId":"B549DE72-CB99-4E37-9B0A-CDDBF1AC7B27"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.25:*:*:*:*:*:*:*","matchCriteriaId":"CBA0773B-1409-4407-AF8C-ED4212FE8DB0"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"F2D82506-3FB5-41BA-8704-CC324C0B0DB2"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*","matchCriteriaId":"260A155C-ED09-44E7-8279-5B94A4AC8CA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*","matchCriteriaId":"C4E0506F-F2E6-45A2-B637-576C341A71B7"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*","matchCriteriaId":"C2EC4513-B653-438A-A1E4-406D055FC160"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*","matchCriteriaId":"F5FDF363-24FA-45D2-879B-B1CF9B667AE2"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*","matchCriteriaId":"03A81F55-2B6B-467C-9281-AA11ED31220F"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*","matchCriteriaId":"A8143D88-890D-4C87-9120-46B33D7D63C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*","matchCriteriaId":"3E5608F5-AC8A-4368-9323-A2CC09F18AAD"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.0:rc1:*:*:*:*:*:*","matchCriteriaId":"EBB4E82A-B1A2-4B35-B961-830FE00F1F7D"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.0:rc2:*:*:*:*:*:*","matchCriteriaId":"CCAD8F26-21A8-42D8-8B12-487F59EB10CD"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:*","matchCriteriaId":"D9237145-35F8-4E05-B730-77C0F386E5B2"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:*","matchCriteriaId":"C78BB1D8-0505-484D-B824-1AA219F8B247"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:*","matchCriteriaId":"5178D04D-1C29-4353-8987-559AA07443EC"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*","matchCriteriaId":"D0535DC9-EB0E-4745-80AC-4A020DF26E38"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:*","matchCriteriaId":"94F5AA37-B466-4E2E-B217-5119BADDD87B"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:*","matchCriteriaId":"6DF0F0F5-4022-4837-9B40-4B1127732CC9"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:*","matchCriteriaId":"B3848B08-85C2-4AAD-AA33-CCEB80EF5B32"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:*","matchCriteriaId":"B7927D40-2A3A-43AD-99F6-CE61882A1FF4"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:*","matchCriteriaId":"AA406EC6-6CA5-40A6-A879-AA8940CBEF07"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p385:*:*:*:*:*:*","matchCriteriaId":"1D041884-3921-4466-9A48-F644FDDA9D50"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p392:*:*:*:*:*:*","matchCriteriaId":"397A2EA7-6F83-427B-8578-3794EBF04849"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p426:*:*:*:*:*:*","matchCriteriaId":"298A5681-F756-4952-A9F8-E4C76736DF8F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p429:*:*:*:*:*:*","matchCriteriaId":"BC5A12F7-47E2-4AC7-A41B-F4B01319002D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:*","matchCriteriaId":"90E0471D-1323-4E67-B66C-DEBF3BBAEEAA"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"B03B7561-A854-4EFA-9E4E-CFC4EEAE4EE1"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:*","matchCriteriaId":"D2423B85-0971-42AC-8B64-819008BC5778"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:p195:*:*:*:*:*:*","matchCriteriaId":"1C663278-3B2A-4B7C-959A-2AA804467F21"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:p247:*:*:*:*:*:*","matchCriteriaId":"B7927149-A76A-48BC-8405-7375FC7D7486"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:preview1:*:*:*:*:*:*","matchCriteriaId":"CB116A84-1652-4F5D-98AC-81F0349EEDC0"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:preview2:*:*:*:*:*:*","matchCriteriaId":"259C21E7-6084-4710-9BB3-C232942A451E"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:*","matchCriteriaId":"285A3431-BDFE-40C5-92CD-B18217757C23"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:*","matchCriteriaId":"D66B32CB-AC49-4A1C-85ED-6389F27CB319"}]}]}],"references":[{"url":"http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html","source":"secalert@redhat.com","tags":["Patch","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1427.html","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1441.html","source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1523.html","source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1852.html","source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0207.html","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/55381","source":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2013/09/10/1","source":"secalert@redhat.com","tags":["Patch"]},{"url":"https://puppet.com/security/cve/cve-2013-4287","source":"secalert@redhat.com"},{"url":"http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1427.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1441.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1523.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1852.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0207.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/55381","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2013/09/10/1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://puppet.com/security/cve/cve-2013-4287","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2013-4363","sourceIdentifier":"secalert@redhat.com","published":"2013-10-17T23:55:04.440","lastModified":"2026-06-16T23:57:05.937","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.  NOTE: this issue is due to an incomplete fix for CVE-2013-4287."},{"lang":"es","value":"Vulnerabilidad en la complejidad algorítmica en Gem :: Versión :: ANCHORED_VERSION_PATTERN en lib / rubygems / version.rb en RubyGems anterior a 1.8.23.2, 1.8.24 hasta 1.8.26, 2.0.x anterior a 2.0.10, 2.1.5 y 2.1.x anterior a , como se usa en Ruby 1.9.0 hasta 2.0.0p247, permite a atacantes remotos provocar una denegación de servicio (consumo de CPU) a través de una versión gem manipulada que provoca una gran cantidad de retroceso en una expresión regular. NOTA: este problema se debe a una corrección incompleta de CVE-2013-4287."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:N/A:P","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-310"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"1.8.23","matchCriteriaId":"EBD0BCCE-898F-4859-A1D8-5D15894BA539"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.0:*:*:*:*:*:*:*","matchCriteriaId":"8D6A915B-43FF-4FFA-98FA-968403825D43"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.1:*:*:*:*:*:*:*","matchCriteriaId":"767790C2-2C72-45C0-A4EF-F21EAAAD1698"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.2:*:*:*:*:*:*:*","matchCriteriaId":"DBAB2571-F73A-4843-A494-1D10A214862D"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.3:*:*:*:*:*:*:*","matchCriteriaId":"57847827-F148-42C9-9180-3D5482249CB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.4:*:*:*:*:*:*:*","matchCriteriaId":"323AC584-E261-445D-9C84-DA34DFDE2D39"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.5:*:*:*:*:*:*:*","matchCriteriaId":"2A563E3D-2D87-4712-8C90-067ABB9D6810"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.6:*:*:*:*:*:*:*","matchCriteriaId":"7B540D22-0BDC-4727-B11E-9667F6E188BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.7:*:*:*:*:*:*:*","matchCriteriaId":"8D7D308E-2A6C-4DF7-94B1-C5BCC5C3FD24"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.8:*:*:*:*:*:*:*","matchCriteriaId":"741E979F-6AD5-4C15-8541-5D5F659E5ED3"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.9:*:*:*:*:*:*:*","matchCriteriaId":"81C93DD3-19B4-431D-A7BD-E86F90F91745"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.10:*:*:*:*:*:*:*","matchCriteriaId":"CA2C407B-2C0F-4C46-9F5B-6C63CC887941"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.11:*:*:*:*:*:*:*","matchCriteriaId":"7865522C-C5D0-4D4B-B090-7B756B36DF4F"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.12:*:*:*:*:*:*:*","matchCriteriaId":"CA1CDCDA-E1F2-4C23-8448-0EF1D61CE40B"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.13:*:*:*:*:*:*:*","matchCriteriaId":"95AE74A8-4A90-4372-8B88-81FF7E6E578B"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.14:*:*:*:*:*:*:*","matchCriteriaId":"3F6BED14-99EA-4F87-95BB-078D2CEED349"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.15:*:*:*:*:*:*:*","matchCriteriaId":"7EC8340E-D33E-4DB6-A08B-E56EA035C133"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.16:*:*:*:*:*:*:*","matchCriteriaId":"4BF3F97C-C396-4AFE-9EC6-4BBD840ED363"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.17:*:*:*:*:*:*:*","matchCriteriaId":"41E7E929-1144-438A-A55D-0B5CE6886C0E"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.18:*:*:*:*:*:*:*","matchCriteriaId":"F3EB522C-6EA5-4CF5-B610-CB9414DD4815"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.19:*:*:*:*:*:*:*","matchCriteriaId":"EF3220D1-DEFF-46A6-95B3-A40838D4E294"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.20:*:*:*:*:*:*:*","matchCriteriaId":"E8DA4D9E-B822-4254-856C-3176A948D718"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.21:*:*:*:*:*:*:*","matchCriteriaId":"0D3EAD7C-CB12-4897-B5FA-63D49CDABD35"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.22:*:*:*:*:*:*:*","matchCriteriaId":"03AC5DA5-AD7F-4C7F-8437-568B7AAAEB17"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.24:*:*:*:*:*:*:*","matchCriteriaId":"B549DE72-CB99-4E37-9B0A-CDDBF1AC7B27"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.25:*:*:*:*:*:*:*","matchCriteriaId":"CBA0773B-1409-4407-AF8C-ED4212FE8DB0"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:1.8.26:*:*:*:*:*:*:*","matchCriteriaId":"1D53F5C8-B881-46ED-8041-26C0B736C9F5"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"F2D82506-3FB5-41BA-8704-CC324C0B0DB2"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:*","matchCriteriaId":"28EF4773-AA97-4209-951F-942286A92413"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:*","matchCriteriaId":"2A3D3005-679A-4761-AC38-CAE1C1CB20AC"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:*","matchCriteriaId":"344FF6A4-8041-4652-A0EA-F18BB0FCFB26"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:*","matchCriteriaId":"E6CC620F-8E83-4256-9872-CCCDF5A4ED35"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:*","matchCriteriaId":"F22B79F6-5CA1-4E5C-9223-345A39EDD507"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*","matchCriteriaId":"260A155C-ED09-44E7-8279-5B94A4AC8CA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*","matchCriteriaId":"C4E0506F-F2E6-45A2-B637-576C341A71B7"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*","matchCriteriaId":"C2EC4513-B653-438A-A1E4-406D055FC160"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*","matchCriteriaId":"F5FDF363-24FA-45D2-879B-B1CF9B667AE2"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*","matchCriteriaId":"03A81F55-2B6B-467C-9281-AA11ED31220F"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*","matchCriteriaId":"A8143D88-890D-4C87-9120-46B33D7D63C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*","matchCriteriaId":"3E5608F5-AC8A-4368-9323-A2CC09F18AAD"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*","matchCriteriaId":"0ACEEB4D-D21D-4D89-881A-9FC33121F69C"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*","matchCriteriaId":"BE3D1495-E577-492F-ADE1-B8E8FB7F241A"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.0:*:*:*:*:*:*:*","matchCriteriaId":"31B50C72-C84A-4B4B-9E62-EB78E50DD19A"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.0:rc1:*:*:*:*:*:*","matchCriteriaId":"EBB4E82A-B1A2-4B35-B961-830FE00F1F7D"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.0:rc2:*:*:*:*:*:*","matchCriteriaId":"CCAD8F26-21A8-42D8-8B12-487F59EB10CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.1:*:*:*:*:*:*:*","matchCriteriaId":"360BB3DB-FC9E-4791-AF2F-D331267E1603"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.2:*:*:*:*:*:*:*","matchCriteriaId":"23FE3A27-39D4-4D73-9E04-81AB02736435"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.3:*:*:*:*:*:*:*","matchCriteriaId":"4F3FFBBD-D379-4C00-B8B7-2B21B7E8C6C5"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.4:*:*:*:*:*:*:*","matchCriteriaId":"5987FA3A-4C1B-45DC-909A-2B475917CC32"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:*","matchCriteriaId":"D9237145-35F8-4E05-B730-77C0F386E5B2"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:*","matchCriteriaId":"C78BB1D8-0505-484D-B824-1AA219F8B247"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:*","matchCriteriaId":"5178D04D-1C29-4353-8987-559AA07443EC"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*","matchCriteriaId":"D0535DC9-EB0E-4745-80AC-4A020DF26E38"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:*","matchCriteriaId":"94F5AA37-B466-4E2E-B217-5119BADDD87B"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:*","matchCriteriaId":"6DF0F0F5-4022-4837-9B40-4B1127732CC9"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:*","matchCriteriaId":"B3848B08-85C2-4AAD-AA33-CCEB80EF5B32"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:*","matchCriteriaId":"B7927D40-2A3A-43AD-99F6-CE61882A1FF4"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:*","matchCriteriaId":"AA406EC6-6CA5-40A6-A879-AA8940CBEF07"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p385:*:*:*:*:*:*","matchCriteriaId":"1D041884-3921-4466-9A48-F644FDDA9D50"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p392:*:*:*:*:*:*","matchCriteriaId":"397A2EA7-6F83-427B-8578-3794EBF04849"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p426:*:*:*:*:*:*","matchCriteriaId":"298A5681-F756-4952-A9F8-E4C76736DF8F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:p429:*:*:*:*:*:*","matchCriteriaId":"BC5A12F7-47E2-4AC7-A41B-F4B01319002D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:*","matchCriteriaId":"90E0471D-1323-4E67-B66C-DEBF3BBAEEAA"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"B03B7561-A854-4EFA-9E4E-CFC4EEAE4EE1"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:*","matchCriteriaId":"D2423B85-0971-42AC-8B64-819008BC5778"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:p195:*:*:*:*:*:*","matchCriteriaId":"1C663278-3B2A-4B7C-959A-2AA804467F21"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:p247:*:*:*:*:*:*","matchCriteriaId":"B7927149-A76A-48BC-8405-7375FC7D7486"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:preview1:*:*:*:*:*:*","matchCriteriaId":"CB116A84-1652-4F5D-98AC-81F0349EEDC0"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:preview2:*:*:*:*:*:*","matchCriteriaId":"259C21E7-6084-4710-9BB3-C232942A451E"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:*","matchCriteriaId":"285A3431-BDFE-40C5-92CD-B18217757C23"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:*","matchCriteriaId":"D66B32CB-AC49-4A1C-85ED-6389F27CB319"}]}]}],"references":[{"url":"http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html","source":"secalert@redhat.com","tags":["Patch","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/09/14/3","source":"secalert@redhat.com","tags":["Patch"]},{"url":"http://www.openwall.com/lists/oss-security/2013/09/18/8","source":"secalert@redhat.com","tags":["Patch"]},{"url":"http://www.openwall.com/lists/oss-security/2013/09/20/1","source":"secalert@redhat.com","tags":["Patch"]},{"url":"https://puppet.com/security/cve/cve-2013-4363","source":"secalert@redhat.com"},{"url":"http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/09/14/3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"http://www.openwall.com/lists/oss-security/2013/09/18/8","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"http://www.openwall.com/lists/oss-security/2013/09/20/1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://puppet.com/security/cve/cve-2013-4363","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2014-3248","sourceIdentifier":"cve@mitre.org","published":"2014-11-16T17:59:03.113","lastModified":"2026-06-17T00:07:50.750","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine."},{"lang":"es","value":"Vulnerabilidad de ruta de búsqueda no confiable en Puppet Enterprise 2.8 anterior a 2.8.7, Puppet anterior a 2.7.26 y 3.x anterior a 3.6.2, Facter 1.6.x y 2.x anterior a 2.0.2, Hiera anterior a 1.3.4, y Mcollective anterior a 2.5.2 o anteriores, permite a usuarios locales ganar privilegios ubicando un troyano en el directorio actual a través de un troyano en un archivo, se demostró usando (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, o (6) safe_yaml/deep.so; o (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, o (10) osfamily.so en puppet/confine."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:H/Au:N/C:C/I:C/A:C","baseScore":6.2,"accessVector":"LOCAL","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"MEDIUM","exploitabilityScore":1.9,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-17"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:facter:2.0.0:rc1:*:*:*:*:*:*","matchCriteriaId":"1880B374-9898-4F94-A79A-EC3FC6417C78"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:facter:2.0.0:rc2:*:*:*:*:*:*","matchCriteriaId":"8731DD0A-1765-4D01-B84A-B11B2C3D3C8D"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:facter:2.0.0:rc3:*:*:*:*:*:*","matchCriteriaId":"8C2C4B26-82E1-414C-8908-8C0B67933D3A"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:facter:2.0.0:rc4:*:*:*:*:*:*","matchCriteriaId":"5F6D393E-C815-435A-AD62-C50FB8221852"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:facter:2.0.1:-:*:*:*:*:*:*","matchCriteriaId":"163FF08E-1931-4A51-B309-FDF7518BF1AC"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:facter:2.0.1:rc1:*:*:*:*:*:*","matchCriteriaId":"789555F6-BAFE-4468-BDEC-9575F9C3B348"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:facter:2.0.1:rc2:*:*:*:*:*:*","matchCriteriaId":"601F4999-5841-4C0B-92C9-20D6276A43FB"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:facter:2.0.1:rc3:*:*:*:*:*:*","matchCriteriaId":"06432280-17CC-4219-9D02-81370F3D97BF"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:facter:2.0.1:rc4:*:*:*:*:*:*","matchCriteriaId":"2F103639-4964-426B-9D23-7DE777ECD388"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppetlabs:facter:*:*:*:*:*:*:*:*","versionStartIncluding":"1.6.0","versionEndIncluding":"1.6.18","matchCriteriaId":"EBD66B12-AEF4-4AB6-BD19-860139A1318F"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:marionette_collective:*:*:*:*:*:*:*:*","versionEndExcluding":"2.5.2","matchCriteriaId":"3B9AFF67-3EE5-4C7A-8344-B5CEEA140B80"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:hiera:*:*:*:*:*:*:*:*","versionEndExcluding":"1.3.4","matchCriteriaId":"6C8C556F-51B7-492B-B9DD-FFCF2C47AC8A"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*","versionEndExcluding":"2.7.26","matchCriteriaId":"9CD170C7-36AF-4316-8E69-8B8C2794DF76"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6.0","versionEndExcluding":"3.6.2","matchCriteriaId":"FF59DB1B-A958-42D3-BE68-71FA5CB32EF4"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*","versionStartIncluding":"2.8.0","versionEndExcluding":"2.8.7","matchCriteriaId":"C30CB38D-C799-4CA8-AB51-8A8A1DEEA1E9"}]}]}],"references":[{"url":"http://puppetlabs.com/security/cve/cve-2014-3248","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet/","source":"cve@mitre.org","tags":["Exploit","Technical Description"]},{"url":"http://secunia.com/advisories/59197","source":"cve@mitre.org","tags":["Technical Description"]},{"url":"http://secunia.com/advisories/59200","source":"cve@mitre.org","tags":["Technical Description"]},{"url":"http://www.securityfocus.com/bid/68035","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://puppetlabs.com/security/cve/cve-2014-3248","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Technical Description"]},{"url":"http://secunia.com/advisories/59197","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Technical Description"]},{"url":"http://secunia.com/advisories/59200","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Technical Description"]},{"url":"http://www.securityfocus.com/bid/68035","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]}]}},{"cve":{"id":"CVE-2015-3900","sourceIdentifier":"cve@mitre.org","published":"2015-06-24T14:59:01.190","lastModified":"2026-06-17T00:26:28.260","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a \"DNS hijack attack.\""},{"lang":"es","value":"RubyGems 2.0.x en versiones anteriores a 2.0.16, 2.2.x en versiones anteriores a 2.2.4 y 2.4.x en versiones anteriores a 2.4.7 no valida el nombre de host al recuperar gemas o hacer solicitudes de API, lo que permite a atacantes remotos redireccionar peticiones a dominios arbitrarios a través del registro DNS SRV manipulado, también conocido como un \"ataque de secuestro de DNS\"."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-254"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:*","matchCriteriaId":"D9237145-35F8-4E05-B730-77C0F386E5B2"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:*","matchCriteriaId":"C78BB1D8-0505-484D-B824-1AA219F8B247"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:*","matchCriteriaId":"5178D04D-1C29-4353-8987-559AA07443EC"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*","matchCriteriaId":"D0535DC9-EB0E-4745-80AC-4A020DF26E38"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"B03B7561-A854-4EFA-9E4E-CFC4EEAE4EE1"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.1:-:*:*:*:*:*:*","matchCriteriaId":"77020036-DC99-461B-9A36-E8C0BE44E6B8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.1.1:*:*:*:*:*:*:*","matchCriteriaId":"8DF046E4-503B-4A10-BEAB-3144BD86EA49"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.1.2:*:*:*:*:*:*:*","matchCriteriaId":"9FCA45F1-3038-413A-B8C3-EE366A4E6248"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.1.3:*:*:*:*:*:*:*","matchCriteriaId":"FF6AF5E3-4EB8-48A3-B8E9-C79C08C38994"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.1.4:*:*:*:*:*:*:*","matchCriteriaId":"6AE2B154-8126-4A38-BAB6-915207764FC0"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.1.5:*:*:*:*:*:*:*","matchCriteriaId":"808FA8BE-71FC-4ADD-BDEA-637E8DF4E899"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:2.2.0:*:*:*:*:*:*:*","matchCriteriaId":"B8F103B7-0E70-4490-9802-2CD6034E240B"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"F2D82506-3FB5-41BA-8704-CC324C0B0DB2"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*","matchCriteriaId":"260A155C-ED09-44E7-8279-5B94A4AC8CA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*","matchCriteriaId":"C4E0506F-F2E6-45A2-B637-576C341A71B7"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*","matchCriteriaId":"C2EC4513-B653-438A-A1E4-406D055FC160"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*","matchCriteriaId":"F5FDF363-24FA-45D2-879B-B1CF9B667AE2"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*","matchCriteriaId":"03A81F55-2B6B-467C-9281-AA11ED31220F"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*","matchCriteriaId":"A8143D88-890D-4C87-9120-46B33D7D63C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*","matchCriteriaId":"3E5608F5-AC8A-4368-9323-A2CC09F18AAD"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*","matchCriteriaId":"0ACEEB4D-D21D-4D89-881A-9FC33121F69C"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*","matchCriteriaId":"BE3D1495-E577-492F-ADE1-B8E8FB7F241A"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.10:*:*:*:*:*:*:*","matchCriteriaId":"BCD623FF-E72B-4C63-B9E6-AFCDEFDD760A"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.11:*:*:*:*:*:*:*","matchCriteriaId":"EAA1E4C2-29CA-48C2-AFFA-5357B36655FB"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.12:*:*:*:*:*:*:*","matchCriteriaId":"EB358B7A-D258-4B86-BBD9-09388109653A"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.13:*:*:*:*:*:*:*","matchCriteriaId":"5C608597-03F7-4F01-803F-0E2B1E9E1D30"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.14:*:*:*:*:*:*:*","matchCriteriaId":"67C95ABA-1949-4B56-B9E3-44B4AF90274D"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.15:*:*:*:*:*:*:*","matchCriteriaId":"DD319AE0-3D8C-40DF-857D-C38EAFA88C68"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.0:*:*:*:*:*:*:*","matchCriteriaId":"672CC7FA-188C-4F34-B10D-7E0C4E7857F4"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.1:*:*:*:*:*:*:*","matchCriteriaId":"FFCFF897-E65B-4D58-BA4D-B08FEF1201B6"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.2:*:*:*:*:*:*:*","matchCriteriaId":"1B6D0730-F774-4E29-9871-3FF4BA89981E"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.3:*:*:*:*:*:*:*","matchCriteriaId":"2D692C10-A24E-48EA-887C-7333C772744C"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.0:*:*:*:*:*:*:*","matchCriteriaId":"5AFD153C-B0C3-4A91-8B09-839341FA4434"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.1:*:*:*:*:*:*:*","matchCriteriaId":"04D0BF47-C818-4834-BFA2-23DD25386CCC"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.2:*:*:*:*:*:*:*","matchCriteriaId":"7F54C49A-12CE-4AC5-A94A-9C5921414AC6"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.3:*:*:*:*:*:*:*","matchCriteriaId":"9CFF3F39-EF40-4D73-965F-98A51C39C02F"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.4:*:*:*:*:*:*:*","matchCriteriaId":"35BCB8FC-EE9C-4AA4-A4A0-E20A3E557129"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.5:*:*:*:*:*:*:*","matchCriteriaId":"A5B90365-2172-43E3-870B-A16F9FB45FD8"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.6:*:*:*:*:*:*:*","matchCriteriaId":"D4932202-9EEA-4B95-A24A-637678837179"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*","matchCriteriaId":"79A602C5-61FE-47BA-9786-F045B6C6DBA8"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*","matchCriteriaId":"2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"142AD0DD-4CF3-4D74-9442-459CE3347E3A"}]}]}],"references":[{"url":"http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html","source":"cve@mitre.org","tags":["Patch","Vendor Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163502.html","source":"cve@mitre.org"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163600.html","source":"cve@mitre.org"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164236.html","source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1657.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/06/26/2","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/75482","source":"cve@mitre.org"},{"url":"https://puppet.com/security/cve/CVE-2015-3900","source":"cve@mitre.org"},{"url":"https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007/?fid=6356","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163502.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163600.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164236.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1657.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/06/26/2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/75482","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://puppet.com/security/cve/CVE-2015-3900","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007/?fid=6356","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2015-4020","sourceIdentifier":"cve@mitre.org","published":"2015-08-25T17:59:01.760","lastModified":"2026-06-17T00:26:38.357","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a \"DNS hijack attack.\" NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900."},{"lang":"es","value":"RubyGems 2.0.x en versiones anteriores a 2.0.17, 2.2.x en versiones anteriores a 2.2.5 y 2.4.x en versiones anteriores a 2.4.8 no valida el nombre del host cuando recupera gemas o hace peticiones API, lo que permite a atacantes remotos redirigir peticiones a dominios arbitrarios mediante un registro DNS SRV con un dominio que está seguido del nombre del dominio original, también conocido como un \"atacque de secuestro DNS\". NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2015-3900."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*","matchCriteriaId":"79A602C5-61FE-47BA-9786-F045B6C6DBA8"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"F2D82506-3FB5-41BA-8704-CC324C0B0DB2"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:*","matchCriteriaId":"28EF4773-AA97-4209-951F-942286A92413"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:*","matchCriteriaId":"2A3D3005-679A-4761-AC38-CAE1C1CB20AC"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:*","matchCriteriaId":"344FF6A4-8041-4652-A0EA-F18BB0FCFB26"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:*","matchCriteriaId":"E6CC620F-8E83-4256-9872-CCCDF5A4ED35"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:*","matchCriteriaId":"F22B79F6-5CA1-4E5C-9223-345A39EDD507"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*","matchCriteriaId":"260A155C-ED09-44E7-8279-5B94A4AC8CA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*","matchCriteriaId":"C4E0506F-F2E6-45A2-B637-576C341A71B7"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*","matchCriteriaId":"C2EC4513-B653-438A-A1E4-406D055FC160"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*","matchCriteriaId":"F5FDF363-24FA-45D2-879B-B1CF9B667AE2"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*","matchCriteriaId":"03A81F55-2B6B-467C-9281-AA11ED31220F"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*","matchCriteriaId":"A8143D88-890D-4C87-9120-46B33D7D63C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*","matchCriteriaId":"3E5608F5-AC8A-4368-9323-A2CC09F18AAD"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*","matchCriteriaId":"0ACEEB4D-D21D-4D89-881A-9FC33121F69C"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*","matchCriteriaId":"BE3D1495-E577-492F-ADE1-B8E8FB7F241A"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.10:*:*:*:*:*:*:*","matchCriteriaId":"BCD623FF-E72B-4C63-B9E6-AFCDEFDD760A"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.11:*:*:*:*:*:*:*","matchCriteriaId":"EAA1E4C2-29CA-48C2-AFFA-5357B36655FB"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.12:*:*:*:*:*:*:*","matchCriteriaId":"EB358B7A-D258-4B86-BBD9-09388109653A"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.13:*:*:*:*:*:*:*","matchCriteriaId":"5C608597-03F7-4F01-803F-0E2B1E9E1D30"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.14:*:*:*:*:*:*:*","matchCriteriaId":"67C95ABA-1949-4B56-B9E3-44B4AF90274D"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.15:*:*:*:*:*:*:*","matchCriteriaId":"DD319AE0-3D8C-40DF-857D-C38EAFA88C68"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.16:*:*:*:*:*:*:*","matchCriteriaId":"34709EF4-D695-4184-816A-F51FD9DF8AE6"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.0:*:*:*:*:*:*:*","matchCriteriaId":"672CC7FA-188C-4F34-B10D-7E0C4E7857F4"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.1:*:*:*:*:*:*:*","matchCriteriaId":"FFCFF897-E65B-4D58-BA4D-B08FEF1201B6"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.2:*:*:*:*:*:*:*","matchCriteriaId":"1B6D0730-F774-4E29-9871-3FF4BA89981E"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.3:*:*:*:*:*:*:*","matchCriteriaId":"2D692C10-A24E-48EA-887C-7333C772744C"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.4:*:*:*:*:*:*:*","matchCriteriaId":"DCDB36D4-FB34-4FAB-8549-AF7D5244CCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.0:*:*:*:*:*:*:*","matchCriteriaId":"5AFD153C-B0C3-4A91-8B09-839341FA4434"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.1:*:*:*:*:*:*:*","matchCriteriaId":"04D0BF47-C818-4834-BFA2-23DD25386CCC"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.2:*:*:*:*:*:*:*","matchCriteriaId":"7F54C49A-12CE-4AC5-A94A-9C5921414AC6"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.3:*:*:*:*:*:*:*","matchCriteriaId":"9CFF3F39-EF40-4D73-965F-98A51C39C02F"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.4:*:*:*:*:*:*:*","matchCriteriaId":"35BCB8FC-EE9C-4AA4-A4A0-E20A3E557129"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.5:*:*:*:*:*:*:*","matchCriteriaId":"A5B90365-2172-43E3-870B-A16F9FB45FD8"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.6:*:*:*:*:*:*:*","matchCriteriaId":"D4932202-9EEA-4B95-A24A-637678837179"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.7:*:*:*:*:*:*:*","matchCriteriaId":"EE86B4DE-776B-460F-B5C3-02C691243820"}]}]}],"references":[{"url":"http://blog.rubygems.org/2015/06/08/2.2.5-released.html","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://blog.rubygems.org/2015/06/08/2.4.8-released.html","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/75431","source":"cve@mitre.org"},{"url":"https://github.com/rubygems/rubygems/commit/5c7bfb5","source":"cve@mitre.org"},{"url":"https://puppet.com/security/cve/CVE-2015-3900","source":"cve@mitre.org"},{"url":"https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://blog.rubygems.org/2015/06/08/2.2.5-released.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://blog.rubygems.org/2015/06/08/2.4.8-released.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/75431","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/rubygems/rubygems/commit/5c7bfb5","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://puppet.com/security/cve/CVE-2015-3900","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2017-0899","sourceIdentifier":"support@hackerone.com","published":"2017-08-31T20:29:00.417","lastModified":"2026-06-17T00:58:29.313","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences."},{"lang":"es","value":"RubyGems 2.6.12 y anteriores es vulnerable a especificaciones de gemas manipuladas maliciosamente que incluyen caracteres de escapada de terminal. Imprimir la especificación de las gemas ejecutaría secuencias de escapada de terminal."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"HackerOne","product":"RubyGems","versions":[{"version":"Versions before 2.6.13","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-150"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.6.12","matchCriteriaId":"1161B0D8-43B3-4123-BD4F-87F260AB8947"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*","matchCriteriaId":"33C068A4-3780-4EAB-A937-6082DF847564"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*","matchCriteriaId":"51EF4996-72F4-4FA4-814F-F5991E7A8318"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*","matchCriteriaId":"D99A687E-EAE6-417E-A88E-D0082BC194CD"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"B353CE99-D57C-465B-AAB0-73EF581127D1"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*","matchCriteriaId":"9EC0D196-F7B8-4BDD-9050-779F7A7FBEE4"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*","matchCriteriaId":"A4E9DD8A-A68B-4A69-8B01-BFF92A2020A8"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"BF77CDCF-B9C9-427D-B2BF-36650FB2148C"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*","matchCriteriaId":"D5F7E11E-FB34-4467-8919-2B6BEAABF665"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"B76AA310-FEC7-497F-AF04-C3EC1E76C4CC"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*","matchCriteriaId":"825ECE2D-E232-46E0-A047-074B34DB1E97"}]}]}],"references":[{"url":"http://blog.rubygems.org/2017/08/27/2.6.13-released.html","source":"support@hackerone.com","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/100576","source":"support@hackerone.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039249","source":"support@hackerone.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3485","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0378","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0583","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0585","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1","source":"support@hackerone.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491","source":"support@hackerone.com","tags":["Patch","Third Party Advisory"]},{"url":"https://hackerone.com/reports/226335","source":"support@hackerone.com","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"support@hackerone.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201710-01","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3966","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"http://blog.rubygems.org/2017/08/27/2.6.13-released.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/100576","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039249","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3485","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0378","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0583","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0585","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://hackerone.com/reports/226335","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201710-01","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3966","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2017-0900","sourceIdentifier":"support@hackerone.com","published":"2017-08-31T20:29:00.510","lastModified":"2026-06-17T00:58:29.463","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command."},{"lang":"es","value":"RubyGems 2.6.12 y anteriores es vulnerable a especificaciones de gemas manipuladas maliciosamente para provocar ataques de denegación de servicio contra clientes RubyGems que hayan enviado un comando query."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.6.12","matchCriteriaId":"1161B0D8-43B3-4123-BD4F-87F260AB8947"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*","matchCriteriaId":"33C068A4-3780-4EAB-A937-6082DF847564"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*","matchCriteriaId":"51EF4996-72F4-4FA4-814F-F5991E7A8318"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*","matchCriteriaId":"D99A687E-EAE6-417E-A88E-D0082BC194CD"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"B353CE99-D57C-465B-AAB0-73EF581127D1"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*","matchCriteriaId":"9EC0D196-F7B8-4BDD-9050-779F7A7FBEE4"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*","matchCriteriaId":"A4E9DD8A-A68B-4A69-8B01-BFF92A2020A8"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"BF77CDCF-B9C9-427D-B2BF-36650FB2148C"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*","matchCriteriaId":"D5F7E11E-FB34-4467-8919-2B6BEAABF665"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"B76AA310-FEC7-497F-AF04-C3EC1E76C4CC"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*","matchCriteriaId":"825ECE2D-E232-46E0-A047-074B34DB1E97"}]}]}],"references":[{"url":"http://blog.rubygems.org/2017/08/27/2.6.13-released.html","source":"support@hackerone.com","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/100579","source":"support@hackerone.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039249","source":"support@hackerone.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3485","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0378","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0583","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0585","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems/commit/8a38a4fc24c6591e6c8f43d1fadab6efeb4d6251","source":"support@hackerone.com","tags":["Patch","Third Party Advisory"]},{"url":"https://hackerone.com/reports/243003","source":"support@hackerone.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"support@hackerone.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201710-01","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3966","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"http://blog.rubygems.org/2017/08/27/2.6.13-released.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/100579","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039249","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3485","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0378","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0583","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0585","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems/commit/8a38a4fc24c6591e6c8f43d1fadab6efeb4d6251","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://hackerone.com/reports/243003","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201710-01","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3966","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2017-0901","sourceIdentifier":"support@hackerone.com","published":"2017-08-31T20:29:00.557","lastModified":"2026-06-17T00:58:29.607","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem."},{"lang":"es","value":"RubyGems 2.6.12 y anteriores no valida con éxito los nombres de las especificaciones, permitiendo que una gema manipulada maliciosamente sobrescriba cualquier archivo en el sistema de archivos."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"HackerOne","product":"RubyGems","versions":[{"version":"Versions before 2.6.13","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.6.12","matchCriteriaId":"1161B0D8-43B3-4123-BD4F-87F260AB8947"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","matchCriteriaId":"B5A6F2F3-4894-4392-8296-3B8DD2679084"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","matchCriteriaId":"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*","matchCriteriaId":"9070C9D8-A14A-467F-8253-33B966C16886"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*","matchCriteriaId":"33C068A4-3780-4EAB-A937-6082DF847564"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*","matchCriteriaId":"51EF4996-72F4-4FA4-814F-F5991E7A8318"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*","matchCriteriaId":"D99A687E-EAE6-417E-A88E-D0082BC194CD"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"B353CE99-D57C-465B-AAB0-73EF581127D1"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*","matchCriteriaId":"9EC0D196-F7B8-4BDD-9050-779F7A7FBEE4"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*","matchCriteriaId":"A4E9DD8A-A68B-4A69-8B01-BFF92A2020A8"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"BF77CDCF-B9C9-427D-B2BF-36650FB2148C"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*","matchCriteriaId":"D5F7E11E-FB34-4467-8919-2B6BEAABF665"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"B76AA310-FEC7-497F-AF04-C3EC1E76C4CC"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*","matchCriteriaId":"825ECE2D-E232-46E0-A047-074B34DB1E97"}]}]}],"references":[{"url":"http://blog.rubygems.org/2017/08/27/2.6.13-released.html","source":"support@hackerone.com","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/100580","source":"support@hackerone.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039249","source":"support@hackerone.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3485","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0378","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0583","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0585","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems/commit/ad5c0a53a86ca5b218c7976765c0365b91d22cb2","source":"support@hackerone.com","tags":["Patch","Third Party Advisory"]},{"url":"https://hackerone.com/reports/243156","source":"support@hackerone.com","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"support@hackerone.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201710-01","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3553-1/","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3685-1/","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3966","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/42611/","source":"support@hackerone.com","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://blog.rubygems.org/2017/08/27/2.6.13-released.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/100580","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039249","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3485","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0378","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0583","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0585","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems/commit/ad5c0a53a86ca5b218c7976765c0365b91d22cb2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://hackerone.com/reports/243156","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201710-01","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3553-1/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3685-1/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3966","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/42611/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]}]}},{"cve":{"id":"CVE-2017-0902","sourceIdentifier":"support@hackerone.com","published":"2017-08-31T20:29:00.603","lastModified":"2026-06-17T00:58:29.760","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls."},{"lang":"es","value":"RubyGems 2.6.12 y anteriores es vulnerable a secuestro de DNS, lo que permite a un atacante Man-in-the-Middle (MitM) forzar el cliente RubyGems a que descargue e instale gemas desde un servidor que está bajo el control del atacante."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"HackerOne","product":"RubyGems","versions":[{"version":"Versions before 2.6.13","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-350"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-346"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.6.12","matchCriteriaId":"1161B0D8-43B3-4123-BD4F-87F260AB8947"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","matchCriteriaId":"B5A6F2F3-4894-4392-8296-3B8DD2679084"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","matchCriteriaId":"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*","matchCriteriaId":"9070C9D8-A14A-467F-8253-33B966C16886"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*","matchCriteriaId":"33C068A4-3780-4EAB-A937-6082DF847564"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*","matchCriteriaId":"51EF4996-72F4-4FA4-814F-F5991E7A8318"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*","matchCriteriaId":"D99A687E-EAE6-417E-A88E-D0082BC194CD"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"B353CE99-D57C-465B-AAB0-73EF581127D1"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*","matchCriteriaId":"9EC0D196-F7B8-4BDD-9050-779F7A7FBEE4"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*","matchCriteriaId":"A4E9DD8A-A68B-4A69-8B01-BFF92A2020A8"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"BF77CDCF-B9C9-427D-B2BF-36650FB2148C"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*","matchCriteriaId":"D5F7E11E-FB34-4467-8919-2B6BEAABF665"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"B76AA310-FEC7-497F-AF04-C3EC1E76C4CC"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*","matchCriteriaId":"825ECE2D-E232-46E0-A047-074B34DB1E97"}]}]}],"references":[{"url":"http://blog.rubygems.org/2017/08/27/2.6.13-released.html","source":"support@hackerone.com","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/100586","source":"support@hackerone.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039249","source":"support@hackerone.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3485","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0378","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0583","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0585","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems/commit/8d91516fb7037ecfb27622f605dc40245e0f8d32","source":"support@hackerone.com","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://hackerone.com/reports/218088","source":"support@hackerone.com","tags":["Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"support@hackerone.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201710-01","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3553-1/","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3685-1/","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3966","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"http://blog.rubygems.org/2017/08/27/2.6.13-released.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/100586","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039249","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3485","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0378","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0583","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0585","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems/commit/8d91516fb7037ecfb27622f605dc40245e0f8d32","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://hackerone.com/reports/218088","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201710-01","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3553-1/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3685-1/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3966","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2017-0903","sourceIdentifier":"support@hackerone.com","published":"2017-10-11T18:29:00.583","lastModified":"2026-06-17T00:58:29.913","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution."},{"lang":"es","value":"Las versiones de RubyGems entre la 2.0.0 y la 2.6.13 son vulnerables a una posible vulnerabilidad de ejecución remota de código. La deserialización YAML de especificaciones de gemas puede omitir listas blancas de clases. Es posible que se utilicen objetos serializados especialmente manipulados para escalar a ejecución remota de código."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"HackerOne","product":"RubyGems","versions":[{"version":"Versions >= 2.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"F2D82506-3FB5-41BA-8704-CC324C0B0DB2"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:*","matchCriteriaId":"28EF4773-AA97-4209-951F-942286A92413"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:*","matchCriteriaId":"2A3D3005-679A-4761-AC38-CAE1C1CB20AC"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:*","matchCriteriaId":"344FF6A4-8041-4652-A0EA-F18BB0FCFB26"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:*","matchCriteriaId":"E6CC620F-8E83-4256-9872-CCCDF5A4ED35"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:*","matchCriteriaId":"F22B79F6-5CA1-4E5C-9223-345A39EDD507"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*","matchCriteriaId":"260A155C-ED09-44E7-8279-5B94A4AC8CA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*","matchCriteriaId":"C4E0506F-F2E6-45A2-B637-576C341A71B7"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*","matchCriteriaId":"C2EC4513-B653-438A-A1E4-406D055FC160"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*","matchCriteriaId":"F5FDF363-24FA-45D2-879B-B1CF9B667AE2"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*","matchCriteriaId":"03A81F55-2B6B-467C-9281-AA11ED31220F"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*","matchCriteriaId":"A8143D88-890D-4C87-9120-46B33D7D63C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*","matchCriteriaId":"3E5608F5-AC8A-4368-9323-A2CC09F18AAD"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*","matchCriteriaId":"0ACEEB4D-D21D-4D89-881A-9FC33121F69C"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*","matchCriteriaId":"BE3D1495-E577-492F-ADE1-B8E8FB7F241A"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.10:*:*:*:*:*:*:*","matchCriteriaId":"BCD623FF-E72B-4C63-B9E6-AFCDEFDD760A"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.11:*:*:*:*:*:*:*","matchCriteriaId":"EAA1E4C2-29CA-48C2-AFFA-5357B36655FB"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.12:*:*:*:*:*:*:*","matchCriteriaId":"EB358B7A-D258-4B86-BBD9-09388109653A"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.13:*:*:*:*:*:*:*","matchCriteriaId":"5C608597-03F7-4F01-803F-0E2B1E9E1D30"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.14:*:*:*:*:*:*:*","matchCriteriaId":"67C95ABA-1949-4B56-B9E3-44B4AF90274D"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.15:*:*:*:*:*:*:*","matchCriteriaId":"DD319AE0-3D8C-40DF-857D-C38EAFA88C68"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.16:*:*:*:*:*:*:*","matchCriteriaId":"34709EF4-D695-4184-816A-F51FD9DF8AE6"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.0.17:*:*:*:*:*:*:*","matchCriteriaId":"5722DC3C-A813-4F02-AC78-47292BAC5A24"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.0:*:*:*:*:*:*:*","matchCriteriaId":"31B50C72-C84A-4B4B-9E62-EB78E50DD19A"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.0.rc.1:*:*:*:*:*:*:*","matchCriteriaId":"42A1FFCC-3966-4ADD-AF87-7128814ED326"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.0.rc.2:*:*:*:*:*:*:*","matchCriteriaId":"94BA31E0-D32D-41B4-B663-7747BABC826B"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.1:*:*:*:*:*:*:*","matchCriteriaId":"360BB3DB-FC9E-4791-AF2F-D331267E1603"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.2:*:*:*:*:*:*:*","matchCriteriaId":"23FE3A27-39D4-4D73-9E04-81AB02736435"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.3:*:*:*:*:*:*:*","matchCriteriaId":"4F3FFBBD-D379-4C00-B8B7-2B21B7E8C6C5"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.4:*:*:*:*:*:*:*","matchCriteriaId":"5987FA3A-4C1B-45DC-909A-2B475917CC32"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.5:*:*:*:*:*:*:*","matchCriteriaId":"E5FA3A47-708F-4CE1-99A8-886C93A2E29B"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.6:*:*:*:*:*:*:*","matchCriteriaId":"D707C58B-7AD8-4590-863D-858612AC93C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.7:*:*:*:*:*:*:*","matchCriteriaId":"A34F8D8D-8D29-4EB8-94F5-702017BB41E6"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.8:*:*:*:*:*:*:*","matchCriteriaId":"C5D9F639-3F53-4ED5-A0EF-19955D253D88"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.9:*:*:*:*:*:*:*","matchCriteriaId":"5E18301D-C1A2-45CD-9136-8995E0477592"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.10:*:*:*:*:*:*:*","matchCriteriaId":"AAFCB861-5386-48B8-B644-7029FEAD2030"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.1.11:*:*:*:*:*:*:*","matchCriteriaId":"7D70F6E5-EAF2-4C0E-9E20-5FCC30310862"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.0:*:*:*:*:*:*:*","matchCriteriaId":"672CC7FA-188C-4F34-B10D-7E0C4E7857F4"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.0.preiew.1:*:*:*:*:*:*:*","matchCriteriaId":"5E52DC21-4720-4271-80CD-0E5AB75E69C9"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.0.rc.1:*:*:*:*:*:*:*","matchCriteriaId":"20E453C7-9EBC-4A5F-A37D-2D53F81F7095"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.1:*:*:*:*:*:*:*","matchCriteriaId":"FFCFF897-E65B-4D58-BA4D-B08FEF1201B6"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.2:*:*:*:*:*:*:*","matchCriteriaId":"1B6D0730-F774-4E29-9871-3FF4BA89981E"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.3:*:*:*:*:*:*:*","matchCriteriaId":"2D692C10-A24E-48EA-887C-7333C772744C"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.4:*:*:*:*:*:*:*","matchCriteriaId":"DCDB36D4-FB34-4FAB-8549-AF7D5244CCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.2.5:*:*:*:*:*:*:*","matchCriteriaId":"79EFBBB5-2A80-4BF0-BF5F-67219AB41046"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.3.0:*:*:*:*:*:*:*","matchCriteriaId":"29225B01-225B-47A1-B48B-67FEACCA99CC"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.0:*:*:*:*:*:*:*","matchCriteriaId":"5AFD153C-B0C3-4A91-8B09-839341FA4434"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.1:*:*:*:*:*:*:*","matchCriteriaId":"04D0BF47-C818-4834-BFA2-23DD25386CCC"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.2:*:*:*:*:*:*:*","matchCriteriaId":"7F54C49A-12CE-4AC5-A94A-9C5921414AC6"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.3:*:*:*:*:*:*:*","matchCriteriaId":"9CFF3F39-EF40-4D73-965F-98A51C39C02F"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.4:*:*:*:*:*:*:*","matchCriteriaId":"35BCB8FC-EE9C-4AA4-A4A0-E20A3E557129"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.5:*:*:*:*:*:*:*","matchCriteriaId":"A5B90365-2172-43E3-870B-A16F9FB45FD8"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.6:*:*:*:*:*:*:*","matchCriteriaId":"D4932202-9EEA-4B95-A24A-637678837179"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.7:*:*:*:*:*:*:*","matchCriteriaId":"EE86B4DE-776B-460F-B5C3-02C691243820"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.4.8:*:*:*:*:*:*:*","matchCriteriaId":"C3EAA024-49AB-4EDB-8578-72F802F39409"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.5.0:*:*:*:*:*:*:*","matchCriteriaId":"21B81760-1F5F-4E0B-9B98-1C1E646F2DBD"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.5.1:*:*:*:*:*:*:*","matchCriteriaId":"B9639274-4E24-47D2-B94C-EDEF5C855C0C"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.5.2:*:*:*:*:*:*:*","matchCriteriaId":"964790F3-B248-4F0C-85F3-1B4DC82FC41B"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.6.0:*:*:*:*:*:*:*","matchCriteriaId":"6DEF4340-5BD1-4230-858A-3CE781DD7967"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.6.1:*:*:*:*:*:*:*","matchCriteriaId":"4A3C972A-88C7-46A3-81AF-6D49D3622068"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.6.2:*:*:*:*:*:*:*","matchCriteriaId":"3B2E59F5-D72A-4027-9F1D-D4A986C5B442"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.6.3:*:*:*:*:*:*:*","matchCriteriaId":"51870568-D16C-4367-855D-CB5C41173109"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.6.4:*:*:*:*:*:*:*","matchCriteriaId":"4CCFBE7B-2445-499D-8A16-72E3DA07C7CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.6.5:*:*:*:*:*:*:*","matchCriteriaId":"378AD8DD-C912-42CC-BB3B-6955A08B0893"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.6.6:*:*:*:*:*:*:*","matchCriteriaId":"0E22C451-6EEA-4104-99DB-3741F57AFE6B"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.6.7:*:*:*:*:*:*:*","matchCriteriaId":"CA0EE70C-9AFE-4DB0-8257-24D2B44C9D04"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.6.8:*:*:*:*:*:*:*","matchCriteriaId":"560B7561-53C5-4796-8EFF-1A666BB3155B"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.6.9:*:*:*:*:*:*:*","matchCriteriaId":"975D930C-13A8-4A9D-9EA7-55A17B9A3955"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.6.10:*:*:*:*:*:*:*","matchCriteriaId":"CAE10321-B685-4688-AB4E-6D3C7DCC8C86"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.6.11:*:*:*:*:*:*:*","matchCriteriaId":"B2660E82-55D1-4C5D-AC9C-B914E482B718"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.6.12:*:*:*:*:*:*:*","matchCriteriaId":"0119E0AA-F472-49EE-9130-6EE83229B4CE"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:2.6.13:*:*:*:*:*:*:*","matchCriteriaId":"5AF07EBF-4FAF-4DF5-8C74-CB33CC1BDBD3"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","matchCriteriaId":"B5A6F2F3-4894-4392-8296-3B8DD2679084"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","matchCriteriaId":"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*","matchCriteriaId":"9070C9D8-A14A-467F-8253-33B966C16886"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*","matchCriteriaId":"33C068A4-3780-4EAB-A937-6082DF847564"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*","matchCriteriaId":"51EF4996-72F4-4FA4-814F-F5991E7A8318"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*","matchCriteriaId":"D99A687E-EAE6-417E-A88E-D0082BC194CD"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"B353CE99-D57C-465B-AAB0-73EF581127D1"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*","matchCriteriaId":"9EC0D196-F7B8-4BDD-9050-779F7A7FBEE4"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*","matchCriteriaId":"A4E9DD8A-A68B-4A69-8B01-BFF92A2020A8"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"BF77CDCF-B9C9-427D-B2BF-36650FB2148C"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*","matchCriteriaId":"D5F7E11E-FB34-4467-8919-2B6BEAABF665"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"B76AA310-FEC7-497F-AF04-C3EC1E76C4CC"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*","matchCriteriaId":"825ECE2D-E232-46E0-A047-074B34DB1E97"}]}]}],"references":[{"url":"http://blog.rubygems.org/2017/10/09/2.6.14-released.html","source":"support@hackerone.com","tags":["Vendor Advisory"]},{"url":"http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html","source":"support@hackerone.com","tags":["Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/101275","source":"support@hackerone.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3485","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0378","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0583","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0585","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49","source":"support@hackerone.com","tags":["Patch","Third Party Advisory"]},{"url":"https://hackerone.com/reports/274990","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"support@hackerone.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3553-1/","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3685-1/","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2017/dsa-4031","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"http://blog.rubygems.org/2017/10/09/2.6.14-released.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/101275","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3485","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0378","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0583","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0585","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://hackerone.com/reports/274990","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3553-1/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3685-1/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2017/dsa-4031","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-1000073","sourceIdentifier":"cve@mitre.org","published":"2018-03-13T15:29:00.427","lastModified":"2026-06-17T01:32:21.660","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6."},{"lang":"es","value":"Las versiones de RubyGems de la serie Ruby 2.2: 2.2.9 y anteriores, de la serie Ruby 2.3: 2.3.6 y anteriores, de la serie Ruby 2.4: 2.4.3 y anteriores, y de la serie Ruby 2.5: 2.5.0 y anteriores, anteriores a la revisión del trunk 62422 contiene una vulnerabilidad de salto de directorio en la función install_location de package.rb que puede resultar en un salto de directorio al escribir en un basedir vinculado simbólicamente fuera del root. La vulnerabilidad parece haber sido solucionada en la versión 2.7.6."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-59"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.2.9","matchCriteriaId":"BEE89FF0-0079-4DF5-ACFC-E1B5415E54F4"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.3.6","matchCriteriaId":"8080FB82-5445-4A17-9ECB-806991906E80"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.4.3","matchCriteriaId":"CCBC38C5-781E-4998-877D-42265F1DBD05"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.5.0","matchCriteriaId":"6ACE6376-2E27-4F56-9315-03367963DB09"}]}]}],"references":[{"url":"http://blog.rubygems.org/2018/02/15/2.7.6-released.html","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3729","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3730","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3731","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:2028","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0542","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0591","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0663","source":"cve@mitre.org"},{"url":"https://github.com/rubygems/rubygems/commit/1b931fc03b819b9a0214be3eaca844ef534175e2","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html","source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3621-1/","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2018/dsa-4219","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2018/dsa-4259","source":"cve@mitre.org"},{"url":"http://blog.rubygems.org/2018/02/15/2.7.6-released.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3729","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3730","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3731","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:2028","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0542","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0591","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0663","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/rubygems/rubygems/commit/1b931fc03b819b9a0214be3eaca844ef534175e2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3621-1/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4219","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4259","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2018-1000074","sourceIdentifier":"cve@mitre.org","published":"2018-03-13T15:29:00.487","lastModified":"2026-06-17T01:32:21.843","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6."},{"lang":"es","value":"Las versiones de RubyGems de la serie Ruby 2.2: 2.2.9 y anteriores, de la serie Ruby 2.3: 2.3.6 y anteriores, de la serie Ruby 2.4: 2.4.3 y anteriores, y de la serie Ruby 2.5: versiones 2.5.0 y anteriores, anteriores a la revisión del trunk 62422 contiene una vulnerabilidad de deserialización de datos no fiables en el comando owner que puede resultar en la ejecución de código. Este ataque parece ser explotable si la víctima ejecuta el comando \"gem owner\" con un archivo YAML especialmente manipulado. La vulnerabilidad parece haber sido solucionada en la versión 2.7.6."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.2.9","matchCriteriaId":"BEE89FF0-0079-4DF5-ACFC-E1B5415E54F4"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.3.6","matchCriteriaId":"8080FB82-5445-4A17-9ECB-806991906E80"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.4.3","matchCriteriaId":"CCBC38C5-781E-4998-877D-42265F1DBD05"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.5.0","matchCriteriaId":"6ACE6376-2E27-4F56-9315-03367963DB09"}]}]}],"references":[{"url":"http://blog.rubygems.org/2018/02/15/2.7.6-released.html","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3729","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3730","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3731","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:2028","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0542","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0591","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0663","source":"cve@mitre.org"},{"url":"https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00017.html","source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html","source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html","source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3621-1/","source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3621-2/","source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3685-1/","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2018/dsa-4219","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2018/dsa-4259","source":"cve@mitre.org"},{"url":"http://blog.rubygems.org/2018/02/15/2.7.6-released.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3729","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3730","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3731","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:2028","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0542","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0591","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0663","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00017.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3621-1/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3621-2/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3685-1/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4219","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4259","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2018-1000075","sourceIdentifier":"cve@mitre.org","published":"2018-03-13T15:29:00.550","lastModified":"2026-06-17T01:32:22.040","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6."},{"lang":"es","value":"Las versiones de RubyGems de la serie Ruby 2.2: 2.2.9 y anteriores, de la serie Ruby 2.3: 2.3.6 y anteriores, de la serie Ruby 2.4: 2.4.3 y anteriores, y de la serie Ruby 2.5: versiones 2.5.0 y anteriores, anteriores a la revisión del trunk 62422 contiene un bucle infinito provocado por una vulnerabilidad de tamaño negativo en la cabecera tar del paquete de ruby gem que puede resultar en un tamaño negativo que desemboque en un bucle infinito. La vulnerabilidad parece haber sido solucionada en la versión 2.7.6."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.2.9","matchCriteriaId":"BEE89FF0-0079-4DF5-ACFC-E1B5415E54F4"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.3.6","matchCriteriaId":"8080FB82-5445-4A17-9ECB-806991906E80"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.4.3","matchCriteriaId":"CCBC38C5-781E-4998-877D-42265F1DBD05"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.5.0","matchCriteriaId":"6ACE6376-2E27-4F56-9315-03367963DB09"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"16F59A04-14CF-49E2-9973-645477EA09DA"}]}]}],"references":[{"url":"http://blog.rubygems.org/2018/02/15/2.7.6-released.html","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3729","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3730","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3731","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:2028","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0542","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0591","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0663","source":"cve@mitre.org"},{"url":"https://github.com/rubygems/rubygems/commit/92e98bf8f810bd812f919120d4832df51bc25d83","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html","source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html","source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3621-1/","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2018/dsa-4219","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2018/dsa-4259","source":"cve@mitre.org"},{"url":"http://blog.rubygems.org/2018/02/15/2.7.6-released.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3729","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3730","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3731","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:2028","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0542","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0591","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0663","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/rubygems/rubygems/commit/92e98bf8f810bd812f919120d4832df51bc25d83","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3621-1/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4219","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4259","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2018-1000076","sourceIdentifier":"cve@mitre.org","published":"2018-03-13T15:29:00.613","lastModified":"2026-06-17T01:32:22.247","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6."},{"lang":"es","value":"Las versiones de RubyGems de la serie Ruby 2.2: 2.2.9 y anteriores, de la serie Ruby 2.3: 2.3.6 y anteriores, de la serie Ruby 2.4: 2.4.3 y anteriores, y de la serie Ruby 2.5: versiones 2.5.0 y anteriores, anteriores a la revisión del trunk 62422 contiene una vulnerabilidad de verificación incorrecta de firma criptográfica en package.rb que puede resultar en la instalación de una gema mal firmada, ya que tarball contendría múltiples firmas de gema. La vulnerabilidad parece haber sido solucionada en la versión 2.7.6."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-347"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.2.9","matchCriteriaId":"BEE89FF0-0079-4DF5-ACFC-E1B5415E54F4"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.3.6","matchCriteriaId":"8080FB82-5445-4A17-9ECB-806991906E80"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.4.3","matchCriteriaId":"CCBC38C5-781E-4998-877D-42265F1DBD05"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.5.0","matchCriteriaId":"6ACE6376-2E27-4F56-9315-03367963DB09"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"16F59A04-14CF-49E2-9973-645477EA09DA"}]}]}],"references":[{"url":"http://blog.rubygems.org/2018/02/15/2.7.6-released.html","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3729","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3730","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3731","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:2028","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0542","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0591","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0663","source":"cve@mitre.org"},{"url":"https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html","source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html","source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3621-1/","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2018/dsa-4219","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2018/dsa-4259","source":"cve@mitre.org"},{"url":"http://blog.rubygems.org/2018/02/15/2.7.6-released.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3729","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3730","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3731","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:2028","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0542","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0591","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0663","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3621-1/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4219","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4259","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2018-1000077","sourceIdentifier":"cve@mitre.org","published":"2018-03-13T15:29:00.677","lastModified":"2026-06-17T01:32:22.447","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6."},{"lang":"es","value":"Las versiones de RubyGems de la serie Ruby 2.2: 2.2.9 y anteriores, de la serie Ruby 2.3: 2.3.6 y anteriores, de la serie Ruby 2.4: 2.4.3 y anteriores, y de la serie Ruby 2.5: versiones 2.5.0 y anteriores, anteriores a la revisión del trunk 62422 contiene una vulnerabilidad de validación de entradas incorrecta en el atributo specification homepage de ruby gems que puede resultar en que una gema maliciosa podría establecer una URL de página de inicio no válida. La vulnerabilidad parece haber sido solucionada en la versión 2.7.6."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.2.9","matchCriteriaId":"BEE89FF0-0079-4DF5-ACFC-E1B5415E54F4"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.3.6","matchCriteriaId":"8080FB82-5445-4A17-9ECB-806991906E80"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.4.3","matchCriteriaId":"CCBC38C5-781E-4998-877D-42265F1DBD05"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.5.0","matchCriteriaId":"6ACE6376-2E27-4F56-9315-03367963DB09"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"16F59A04-14CF-49E2-9973-645477EA09DA"}]}]}],"references":[{"url":"http://blog.rubygems.org/2018/02/15/2.7.6-released.html","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3729","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3730","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3731","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:2028","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0542","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0591","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0663","source":"cve@mitre.org"},{"url":"https://github.com/rubygems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html","source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html","source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3621-1/","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2018/dsa-4219","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2018/dsa-4259","source":"cve@mitre.org"},{"url":"http://blog.rubygems.org/2018/02/15/2.7.6-released.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3729","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3730","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3731","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:2028","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0542","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0591","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0663","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/rubygems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3621-1/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4219","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4259","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2018-1000078","sourceIdentifier":"cve@mitre.org","published":"2018-03-13T15:29:00.723","lastModified":"2026-06-17T01:32:22.657","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6."},{"lang":"es","value":"Las versiones de RubyGems de la serie Ruby 2.2: 2.2.9 y anteriores, de la serie Ruby 2.3: 2.3.6 y anteriores, de la serie Ruby 2.4: 2.4.3 y anteriores, y de la serie Ruby 2.5: versiones 2.5.0 y anteriores, anteriores a la revisión del trunk 62422 contiene una vulnerabilidad de Cross-Site Scripting (XSS) en la visualización del servidor gem del atributo homepage que podría resultar en XSS. El ataque parece ser explotable mediante una víctima que navegue hasta una gema maliciosa en un servidor gem vulnerable. La vulnerabilidad parece haber sido solucionada en la versión 2.7.6."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.2.9","matchCriteriaId":"BEE89FF0-0079-4DF5-ACFC-E1B5415E54F4"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.3.6","matchCriteriaId":"8080FB82-5445-4A17-9ECB-806991906E80"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.4.3","matchCriteriaId":"CCBC38C5-781E-4998-877D-42265F1DBD05"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.5.0","matchCriteriaId":"6ACE6376-2E27-4F56-9315-03367963DB09"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"16F59A04-14CF-49E2-9973-645477EA09DA"}]}]}],"references":[{"url":"http://blog.rubygems.org/2018/02/15/2.7.6-released.html","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3729","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3730","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3731","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:2028","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0542","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0591","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0663","source":"cve@mitre.org"},{"url":"https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html","source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html","source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3621-1/","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2018/dsa-4219","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2018/dsa-4259","source":"cve@mitre.org"},{"url":"http://blog.rubygems.org/2018/02/15/2.7.6-released.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3729","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3730","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3731","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:2028","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0542","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0591","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0663","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3621-1/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4219","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4259","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2018-1000079","sourceIdentifier":"cve@mitre.org","published":"2018-03-13T15:29:00.783","lastModified":"2026-06-17T01:32:22.863","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6."},{"lang":"es","value":"Las versiones de RubyGems de la serie Ruby 2.2: 2.2.9 y anteriores, de la serie Ruby 2.3: 2.3.6 y anteriores, de la serie Ruby 2.4: 2.4.3 y anteriores, y de la serie Ruby 2.5: versiones 2.5.0 y anteriores, anteriores a la revisión del trunk 62422 contiene una vulnerabilidad de salto de directorio en la instalación de gemas que puede resultar en que la gema podría escribir en ubicaciones arbitrarias del sistema de archivos durante la instalación. El ataque parece ser explotable mediante una víctima que instale una gema maliciosa. La vulnerabilidad parece haber sido solucionada en la versión 2.7.6."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.2.9","matchCriteriaId":"BEE89FF0-0079-4DF5-ACFC-E1B5415E54F4"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.3.6","matchCriteriaId":"8080FB82-5445-4A17-9ECB-806991906E80"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.4.3","matchCriteriaId":"CCBC38C5-781E-4998-877D-42265F1DBD05"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndIncluding":"2.5.0","matchCriteriaId":"6ACE6376-2E27-4F56-9315-03367963DB09"}]}]}],"references":[{"url":"http://blog.rubygems.org/2018/02/15/2.7.6-released.html","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3729","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3730","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3731","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:2028","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0542","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0591","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0663","source":"cve@mitre.org"},{"url":"https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3621-1/","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2018/dsa-4219","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2018/dsa-4259","source":"cve@mitre.org"},{"url":"http://blog.rubygems.org/2018/02/15/2.7.6-released.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3729","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3730","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3731","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:2028","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0542","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0591","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0663","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3621-1/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4219","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4259","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2019-10842","sourceIdentifier":"cve@mitre.org","published":"2019-04-04T04:29:00.823","lastModified":"2026-06-17T02:11:42.907","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An unauthenticated attacker can craft the ___cfduid cookie value with base64 arbitrary code to be executed via eval(), which can be leveraged to execute arbitrary code on the target system. Note that there are three underscore characters in the cookie name. This is unrelated to the __cfduid cookie that is legitimately used by Cloudflare."},{"lang":"es","value":"Se ha descubierto una ejecución de código arbitrario (mediante código de puerta trasera) en bootstrap-sass 3.2.0.3, cuando se descarga desde rubygems.org. Un atacante no autenticado puede manipular el valor de la cookie ___cfduid con código arbitrario base64 para que se ejecute mediante eval(). Esto puede explotarse para ejecutar código arbitrario en el sistema objetivo. Nótese que hay tres guiones bajos en el nombre de la cookie. Esto no está relacionado con la cookie __cfduid que Cloudflare usa de manera legítima."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:getbootstrap:bootstrap-sass:3.2.0.3:*:*:*:*:ruby:*:*","matchCriteriaId":"564484C8-1AA9-48D3-A713-B08C65B11FDC"}]}]}],"references":[{"url":"http://dgb.github.io/2019/04/05/bootstrap-sass-backdoor.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/twbs/bootstrap-sass/issues/1195","source":"cve@mitre.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://snyk.io/blog/malicious-remote-code-execution-backdoor-discovered-in-the-popular-bootstrap-sass-ruby-gem/","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-RUBY-BOOTSTRAPSASS-174093","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"http://dgb.github.io/2019/04/05/bootstrap-sass-backdoor.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/twbs/bootstrap-sass/issues/1195","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://snyk.io/blog/malicious-remote-code-execution-backdoor-discovered-in-the-popular-bootstrap-sass-ruby-gem/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-RUBY-BOOTSTRAPSASS-174093","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-8320","sourceIdentifier":"cve@mitre.org","published":"2019-06-06T15:29:01.420","lastModified":"2026-06-17T02:41:50.463","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system."},{"lang":"es","value":"Fue encontrado un problema de salto de directorio (Directory Traversal) en RubyGems versión 2.7.6 y posterior hasta la versión 3.0.2. Antes de crear nuevos directorios o tocar archivos (que ahora incluyen el código path-checking para symlinks), se suprimiría el destino apuntado. Si ese destino estaba oculto detrás de un symlink, una gema maliciosa podría suprimir archivos arbitrarios en la máquina del usuario, presumiendo que el atacante podría adivinar las paths. Dada la frecuencia con que la gema se ejecuta como sudo, y cómo son las paths predecibles en los sistemas modernos (/tmp, /usr, etc.), esto podría probablemente conducir a la pérdida de datos o a un sistema inutilizable."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:C/A:C","baseScore":8.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":9.2,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionStartIncluding":"2.7.6","versionEndIncluding":"3.0.2","matchCriteriaId":"1F19DA38-964A-4AE9-9BB5-1359F1BF1F0B"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:1429","source":"cve@mitre.org"},{"url":"https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"https://hackerone.com/reports/317321","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:1429","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://hackerone.com/reports/317321","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2019-8324","sourceIdentifier":"cve@mitre.org","published":"2019-06-17T19:15:11.843","lastModified":"2026-06-17T02:41:50.917","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check."},{"lang":"es","value":"Se descubrió un error en RubyGems 2.6 y posteriormente hasta 3.0.2 Una gema hecha a mano con un nombre de varias líneas no se maneja correctamente. Por lo tanto, un atacante podría inyectar un código arbitrario a la línea de código auxiliar de gemspec, que se evalúa mediante un código en asegurar_loadable_spec durante la verificación de preinstalación."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.0","versionEndIncluding":"3.0.2","matchCriteriaId":"AA6AD511-0C15-4FC9-B28D-7FD3471A4B26"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*","matchCriteriaId":"F1E78106-58E6-4D59-990F-75DA575BFAD9"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*","matchCriteriaId":"B620311B-34A3-48A6-82DF-6F078D7A4493"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"F4CFF558-3C47-480D-A2F0-BABF26042943"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1972","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://hackerone.com/reports/328571","source":"cve@mitre.org","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1972","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://hackerone.com/reports/328571","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-8325","sourceIdentifier":"cve@mitre.org","published":"2019-06-17T19:15:11.890","lastModified":"2026-06-17T02:41:51.030","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)"},{"lang":"es","value":"Se descubrió un error en RubyGems 2.6 y posteriormente 3.0.2 Gem :: CommandManager # ejecuta llamadas alert_error sin escapar, la inyección de secuencia de escape es posible. (Hay muchas maneras de causar un error.)"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-74"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.0","versionEndIncluding":"3.0.2","matchCriteriaId":"AA6AD511-0C15-4FC9-B28D-7FD3471A4B26"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*","matchCriteriaId":"F1E78106-58E6-4D59-990F-75DA575BFAD9"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*","matchCriteriaId":"B620311B-34A3-48A6-82DF-6F078D7A4493"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://hackerone.com/reports/317353","source":"cve@mitre.org","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://hackerone.com/reports/317353","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-8321","sourceIdentifier":"cve@mitre.org","published":"2019-06-17T20:15:10.307","lastModified":"2026-06-17T02:41:50.583","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible."},{"lang":"es","value":"Se descubrió un error en RubyGems 2.6 y más tarde  hasta 3.0.2. hasta Gem::UserInteraction#verbose Dado que las llamadas verbales Gem :: UserInteraction # verbose dicen que sin escape, la inyección de secuencia de escape es posible"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-88"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.0","versionEndIncluding":"3.0.2","matchCriteriaId":"AA6AD511-0C15-4FC9-B28D-7FD3471A4B26"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*","matchCriteriaId":"F1E78106-58E6-4D59-990F-75DA575BFAD9"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*","matchCriteriaId":"B620311B-34A3-48A6-82DF-6F078D7A4493"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://hackerone.com/reports/317330","source":"cve@mitre.org","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://hackerone.com/reports/317330","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-8322","sourceIdentifier":"cve@mitre.org","published":"2019-06-17T20:15:10.353","lastModified":"2026-06-17T02:41:50.693","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur."},{"lang":"es","value":"Se descubrió un error en RubyGems 2.6 y mucho más tarde hasta 3.0.2 El comando de propietario de gemas envía el contenido de la respuesta de la API directamente a la salida estándar. Por lo tanto, si la respuesta es elaborada, puede ocurrir una inyección de secuencia de escape."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-74"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.0","versionEndIncluding":"3.0.2","matchCriteriaId":"AA6AD511-0C15-4FC9-B28D-7FD3471A4B26"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*","matchCriteriaId":"F1E78106-58E6-4D59-990F-75DA575BFAD9"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*","matchCriteriaId":"B620311B-34A3-48A6-82DF-6F078D7A4493"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://hackerone.com/reports/315087","source":"cve@mitre.org","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://hackerone.com/reports/315087","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-8323","sourceIdentifier":"cve@mitre.org","published":"2019-06-17T20:15:10.400","lastModified":"2026-06-17T02:41:50.807","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur."},{"lang":"es","value":"Se descubrió un error in RubyGems 2.6 y posteriormente hasta 3.0.2 Gem::GemcutterUtilities#with La respuesta puede generar la respuesta de la API a stdout tal como está. Por lo tanto, si el lado de la API modifica la respuesta, puede ocurrir una inyección de secuencia de escape."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-74"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.0","versionEndIncluding":"3.0.2","matchCriteriaId":"AA6AD511-0C15-4FC9-B28D-7FD3471A4B26"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*","matchCriteriaId":"F1E78106-58E6-4D59-990F-75DA575BFAD9"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*","matchCriteriaId":"B620311B-34A3-48A6-82DF-6F078D7A4493"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://hackerone.com/reports/315081","source":"cve@mitre.org","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://hackerone.com/reports/315081","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-13354","sourceIdentifier":"cve@mitre.org","published":"2019-07-08T14:15:10.350","lastModified":"2026-06-17T02:16:37.803","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 0.0.6."},{"lang":"es","value":"La gema strong_password versión 0.0.7 de Ruby, tal y como es distribuida en RubyGems.org, incluye una puerta trasera (backdoor) de ejecución de código insertada por un tercero. La versión actual, sin esta puerta trasera, es versión 0.0.6."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:strong_password_project:strong_password:0.0.7:*:*:*:*:ruby:*:*","matchCriteriaId":"32364E02-361E-439A-A648-3DD5C0A205B5"}]}]}],"references":[{"url":"https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-strong_password-0-0-7/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/bdmac/strong_password/releases","source":"cve@mitre.org","tags":["Release Notes","Third Party Advisory"]},{"url":"https://rubygems.org/gems/strong_password/versions","source":"cve@mitre.org","tags":["Release Notes","Third Party Advisory"]},{"url":"https://withatwist.dev/strong-password-rubygem-hijacked.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-strong_password-0-0-7/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/bdmac/strong_password/releases","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://rubygems.org/gems/strong_password/versions","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://withatwist.dev/strong-password-rubygem-hijacked.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-13589","sourceIdentifier":"cve@mitre.org","published":"2019-07-14T16:15:10.417","lastModified":"2026-06-17T02:17:02.190","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5."},{"lang":"es","value":"La gema paranoid2 versión 1.1.6 para Ruby, tal y como es distribuida en RubyGems.org, incluye una puerta trasera (backdoor) de ejecución de código insertada por un tercero.  La versión actual, sin esta puerta trasera, es versión 1.1.5."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-829"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:anjlab:paranoid2:1.1.6:*:*:*:*:ruby:*:*","matchCriteriaId":"F14CD5FC-5366-409B-A926-711C074EA6A3"}]}]}],"references":[{"url":"http://www.securityfocus.com/bid/109281","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://github.com/rubygems/rubygems.org/issues/2051","source":"cve@mitre.org","tags":["Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://rubygems.org/gems/paranoid2/versions","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"https://snyk.io/vuln/SNYK-RUBY-PARANOID2-451600","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/109281","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://github.com/rubygems/rubygems.org/issues/2051","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://rubygems.org/gems/paranoid2/versions","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://snyk.io/vuln/SNYK-RUBY-PARANOID2-451600","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-14281","sourceIdentifier":"cve@mitre.org","published":"2019-07-26T05:15:10.610","lastModified":"2026-06-17T02:18:06.400","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party."},{"lang":"es","value":"La gema datagrid versión 1.0.6 para Ruby, tal y como es distribuida en RubyGems.org, incluye una puerta trasera (backdoor) de ejecución de código insertada por un tercero."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:datagrid_project:datagrid:1.0.6:*:*:*:*:ruby:*:*","matchCriteriaId":"72BED362-B950-4F0A-A323-34C8DAC359C4"}]}]}],"references":[{"url":"https://github.com/rubygems/rubygems.org/issues/2072","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://rubygems.org/gems/datagrid/versions","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-RUBY-DATAGRID-455500","source":"cve@mitre.org"},{"url":"https://github.com/rubygems/rubygems.org/issues/2072","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://rubygems.org/gems/datagrid/versions","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-RUBY-DATAGRID-455500","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2019-14282","sourceIdentifier":"cve@mitre.org","published":"2019-07-26T05:15:10.673","lastModified":"2026-06-17T02:18:06.537","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party."},{"lang":"es","value":"La gema simple_captcha2 versión 0.2.3 para Ruby, tal y como es distribuida en RubyGems.org, incluye una puerta trasera (backdoor) de ejecución de código insertada por un tercero."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:simple_captcha2_project:simple_captcha2:0.2.3:*:*:*:*:ruby:*:*","matchCriteriaId":"3FF50951-958A-4A59-8BB2-6CEA355A426B"}]}]}],"references":[{"url":"https://github.com/rubygems/rubygems.org/issues/2073","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://rubygems.org/gems/simple_captcha2/versions/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-RUBY-SIMPLECAPTCHA2-455501","source":"cve@mitre.org"},{"url":"https://github.com/rubygems/rubygems.org/issues/2073","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://rubygems.org/gems/simple_captcha2/versions/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-RUBY-SIMPLECAPTCHA2-455501","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2019-15224","sourceIdentifier":"cve@mitre.org","published":"2019-08-19T23:15:10.570","lastModified":"2026-06-17T02:19:53.200","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected."},{"lang":"es","value":"La gema rest-client  versión 1.6.10 a 1.6.13 para Ruby, distribuida en RubyGems.org, incluía una puerta trasera de ejecución de código insertada por un tercero. Las versiones <-1.6.9 y >-1.6.14 no se ven afectadas."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rest-client_project:rest-client:*:*:*:*:*:ruby:*:*","versionStartIncluding":"1.6.10","versionEndIncluding":"1.6.13","matchCriteriaId":"183D93A3-8258-41C2-87CA-8F94BD77734B"}]}]}],"references":[{"url":"https://github.com/rest-client/rest-client/issues/713","source":"cve@mitre.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://rubygems.org/gems/rest-client/versions/","source":"cve@mitre.org","tags":["Product"]},{"url":"https://github.com/rest-client/rest-client/issues/713","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://rubygems.org/gems/rest-client/versions/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"]}]}},{"cve":{"id":"CVE-2012-6135","sourceIdentifier":"secalert@redhat.com","published":"2019-11-19T17:15:11.237","lastModified":"2026-06-16T23:47:53.297","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process."},{"lang":"es","value":"RubyGems passenger versión 4.0.0 betas 1 y 2, permite a atacantes remotos eliminar archivos arbitrarios durante el proceso de inicio."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"ruby-passenger","product":"ruby-passenger","versions":[{"version":"4.0.53-1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:4.0.0:beta1:*:*:*:ruby:*:*","matchCriteriaId":"B8D22A17-F554-44FE-82EF-408BC8940C18"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:4.0.0:beta2:*:*:*:ruby:*:*","matchCriteriaId":"0F2D0D37-F5E6-43A9-8D8C-2A8B8224C9C9"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:openshift:1.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"19D8D9FF-51A8-4A81-B855-DB480ABEA300"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2013/03/02/1","source":"secalert@redhat.com","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-6135","source":"secalert@redhat.com","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/82533","source":"secalert@redhat.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-6135","source":"secalert@redhat.com","tags":["Third Party Advisory"]},{"url":"https://www.securityfocus.com/bid/58259","source":"secalert@redhat.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2013/03/02/1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-6135","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/82533","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-6135","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.securityfocus.com/bid/58259","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]}]}},{"cve":{"id":"CVE-2019-17268","sourceIdentifier":"cve@mitre.org","published":"2020-02-07T14:15:11.343","lastModified":"2026-06-17T02:23:36.647","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected."},{"lang":"es","value":"La gema omniauth-weibo-oauth2 versión 0.4.6 para Ruby, como es distribuida en RubyGems.org, incluía una backdoor de ejecución de código insertada por un tercero. Las versiones hasta 0.4.5, y versiones 0.5.1 y posteriores, no están afectadas."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:omniauth-weibo-oauth2_project:omniauth-weibo-oauth2:0.4.6:*:*:*:*:ruby:*:*","matchCriteriaId":"10A1A9B2-0128-4CA3-99C3-817C91267631"}]}]}],"references":[{"url":"https://diff.coditsu.io/diffs/09a05c37-1b34-49e1-ac94-d4dda40d1ad1#d2h-971595","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/beenhero/omniauth-weibo-oauth2/issues/36","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://diff.coditsu.io/diffs/09a05c37-1b34-49e1-ac94-d4dda40d1ad1#d2h-971595","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/beenhero/omniauth-weibo-oauth2/issues/36","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-29435","sourceIdentifier":"security-advisories@github.com","published":"2021-04-13T20:15:21.907","lastModified":"2026-06-17T03:47:38.177","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials. The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems."},{"lang":"es","value":"trestle-auth es un plugin de autenticación para el framework de administración de Trestle.&#xa0;Una vulnerabilidad en trestle-auth versiones 0.4.0 y 0.4.1, permite a un atacante crear un formulario que omitirá la protección CSRF incorporada de Rails cuando lo envíe una víctima con una sesión de administración de trestle-auth.&#xa0;Esto potencialmente permite a un atacante alterar los datos protegidos, incluyendo las credenciales de la cuenta de administrador.&#xa0;La vulnerabilidad ha sido corregida en trestle-auth versión 0.4.2,  publicada en RubyGems"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TrestleAdmin","product":"trestle-auth","versions":[{"version":">= 0.4.0, < 0.4.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:trestle-auth_project:trestle-auth:0.4.0:*:*:*:*:ruby:*:*","matchCriteriaId":"03D0B300-CDE9-4E0D-BFD2-E9EDD5C533B5"},{"vulnerable":true,"criteria":"cpe:2.3:a:trestle-auth_project:trestle-auth:0.4.1:*:*:*:*:ruby:*:*","matchCriteriaId":"0991DB53-B830-45AF-AAA2-320C578924F6"}]}]}],"references":[{"url":"https://github.com/TrestleAdmin/trestle-auth/commit/cb95b05cdb2609052207af07b4b8dfe3a23c11dc","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/TrestleAdmin/trestle-auth/security/advisories/GHSA-h8hx-2c5r-32cf","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://rubygems.org/gems/trestle-auth","source":"security-advisories@github.com","tags":["Product","Third Party Advisory"]},{"url":"https://github.com/TrestleAdmin/trestle-auth/commit/cb95b05cdb2609052207af07b4b8dfe3a23c11dc","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/TrestleAdmin/trestle-auth/security/advisories/GHSA-h8hx-2c5r-32cf","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://rubygems.org/gems/trestle-auth","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-29176","sourceIdentifier":"security-advisories@github.com","published":"2022-05-05T22:15:08.127","lastModified":"2026-06-17T04:39:44.870","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Rubygems is a package registry used to supply software for the Ruby language ecosystem. Due to a bug in the yank action, it was possible for any RubyGems.org user to remove and replace certain gems even if that user was not authorized to do so. To be vulnerable, a gem needed: one or more dashes in its name creation within 30 days OR no updates for over 100 days At present, we believe this vulnerability has not been exploited. RubyGems.org sends an email to all gem owners when a gem version is published or yanked. We have not received any support emails from gem owners indicating that their gem has been yanked without authorization. An audit of gem changes for the last 18 months did not find any examples of this vulnerability being used in a malicious way. A deeper audit for any possible use of this exploit is ongoing, and we will update this advisory once it is complete. Using Bundler in --frozen or --deployment mode in CI and during deploys, as the Bundler team has always recommended, will guarantee that your application does not silently switch to versions created using this exploit. To audit your application history for possible past exploits, review your Gemfile.lock and look for gems whose platform changed when the version number did not change. For example, gemname-3.1.2 updating to gemname-3.1.2-java could indicate a possible abuse of this vulnerability. RubyGems.org has been patched and is no longer vulnerable to this issue as of the 5th of May 2022."},{"lang":"es","value":"Rubygems es un registro de paquetes usado para suministrar software para el ecosistema del lenguaje Ruby. Debido a un bug en la acción de yank, era posible que cualquier usuario de RubyGems.org eliminara y sustituyera determinadas gemas incluso si ese usuario no estaba autorizado a hacerlo. Para ser vulnerable, una gema necesitaba: la creación de uno o más guiones en su nombre en un plazo de 30 días O no haber sido actualizada durante más de 100 días En la actualidad, creemos que esta vulnerabilidad no ha sido explotada. RubyGems.org envía un correo electrónico a todos los propietarios de gemas cuando es publicada o es retirada la versión de una gema. No hemos recibido ningún correo electrónico de soporte de los propietarios de gemas indicando que su gema ha sido retirada sin autorización. Una auditoría de los cambios de gemas de los últimos 18 meses no encontró ningún ejemplo de esta vulnerabilidad usada de forma maliciosa. Está siendo llevando a cabo una auditoría más profunda para detectar cualquier posible uso de esta explotación, y actualizaremos este aviso una vez que haya sido completado. El uso de Bundler en modo --frozen o --deployment en CI y durante los despliegues, como el equipo de Bundler siempre ha recomendado, garantizará que su aplicación no cambie silenciosamente a versiones creadas con esta explotación. Para auditar el historial de tu aplicación en busca de posibles explotaciones pasadas, revisa tu Gemfile.lock y busca gemas cuya plataforma haya cambiado cuando el número de versión no haya cambiado. Por ejemplo, la actualización de gemname-3.1.2 a gemname-3.1.2-java podría indicar un posible abuso de esta vulnerabilidad. RubyGems.org ha sido parcheado y ya no es vulnerable a este problema desde el 5 de mayo de 2022"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rubygems","product":"rubygems.org","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:P/I:P/A:P","baseScore":6.0,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-23T15:53:37.593220Z","id":"CVE-2022-29176","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems.org:-:*:*:*:*:*:*:*","matchCriteriaId":"C6A7FF13-77FB-4F1F-87D3-A92C46D056BB"}]}]}],"references":[{"url":"https://github.com/rubygems/rubygems.org/security/advisories/GHSA-hccv-rwq6-vh79","source":"security-advisories@github.com","tags":["Mitigation","Third Party Advisory"]},{"url":"https://hackerone.com/bugs?subject=rubygems&report_id=1559856","source":"security-advisories@github.com","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220616-0002/","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems.org/security/advisories/GHSA-hccv-rwq6-vh79","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Third Party Advisory"]},{"url":"https://hackerone.com/bugs?subject=rubygems&report_id=1559856","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220616-0002/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-29218","sourceIdentifier":"security-advisories@github.com","published":"2022-05-13T01:15:07.453","lastModified":"2026-06-17T04:39:51.113","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some gems (with platforms ending in numbers, like `arm64-darwin-21`) to be temporarily replaced in the CDN cache by a malicious package. The bug has been patched, and is believed to have never been exploited, based on an extensive review of logs and existing gems by rubygems. The easiest way to ensure that an application has not been exploited by this vulnerability is to verify all downloaded .gems checksums match the checksum recorded in the RubyGems.org database. RubyGems.org has been patched and is no longer vulnerable to this issue."},{"lang":"es","value":"RubyGems es un registro de paquetes usado para suministrar software para el ecosistema del lenguaje Ruby. Un error de ordenación en el código que acepta la subida de gemas permitía que algunas gemas (con plataformas terminadas en números, como \"arm64-darwin-21\") fueran sustituidas temporalmente en la caché de la CDN por un paquete malicioso. El bug ha sido parcheado, y se cree que nunca ha sido explotado, basándose en una extensa revisión de registros y gemas existentes por parte de rubygems. La forma más fácil de asegurarse de que una aplicación no ha sido explotada por esta vulnerabilidad es verificar que todas las sumas de comprobación de los archivos .gems descargados coinciden con la suma de comprobación registrada en la base de datos de RubyGems.org. RubyGems.org ha sido parcheado y ya no es vulnerable a este problema"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rubygems","product":"rubygems.org","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-22T15:48:07.827308Z","id":"CVE-2022-29218","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-290"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems.org:-:*:*:*:*:*:*:*","matchCriteriaId":"C6A7FF13-77FB-4F1F-87D3-A92C46D056BB"}]}]}],"references":[{"url":"https://github.com/rubygems/rubygems.org/security/advisories/GHSA-2jmx-8mh8-pm8w","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220629-0010/","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems.org/security/advisories/GHSA-2jmx-8mh8-pm8w","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220629-0010/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-36073","sourceIdentifier":"security-advisories@github.com","published":"2022-09-07T20:15:11.223","lastModified":"2026-06-17T04:52:51.617","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. Having access to an account whose email has been changed could enable an attacker to save API keys for that account, and when a legitimate user attempts to create an account with their email (and has to reset password to gain access) and is granted access to other gems, the attacker would then be able to publish and yank versions of those gems. Commit number 90c9e6aac2d91518b479c51d48275c57de492d4d contains a patch for this issue."},{"lang":"es","value":"RubyGems.org es el host de gemas de la comunidad Ruby. Un error en el código de confirmación de cambio de contraseña y correo electrónico permitía a un atacante cambiar el correo electrónico de su cuenta de RubyGems.org a una dirección de correo electrónico no propia. Tener acceso a una cuenta cuyo correo electrónico ha sido cambiado podría permitir a un atacante guardar las claves de la API para esa cuenta, y cuando un usuario legítimo intente crear una cuenta con su correo electrónico (y tenga que restablecer la contraseña para acceder) y le sea concedido acceso a otras gemas, el atacante podría entonces publicar y arrancar versiones de esas gemas. El commit número 90c9e6aac2d91518b479c51d48275c57de492d4d contiene un parche para este problema"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rubygems","product":"rubygems.org","versions":[{"version":"< 90c9e6aac2d91518b479c51d48275c57de492d4d","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":5.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-23T15:49:39.312175Z","id":"CVE-2022-36073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-08-31","matchCriteriaId":"336CC931-B42D-442B-AC29-7A89975F8176"}]}]}],"references":[{"url":"https://github.com/rubygems/rubygems.org/commit/90c9e6aac2d91518b479c51d48275c57de492d4d","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems.org/security/advisories/GHSA-8qpf-wf2p-25vg","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems.org/commit/90c9e6aac2d91518b479c51d48275c57de492d4d","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/rubygems/rubygems.org/security/advisories/GHSA-8qpf-wf2p-25vg","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2023-28102","sourceIdentifier":"security-advisories@github.com","published":"2023-03-27T22:15:22.027","lastModified":"2026-06-17T05:46:52.553","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"discordrb is an implementation of the Discord API using Ruby. In discordrb before commit `91e13043ffa` the `encoder.rb` file unsafely constructs a shell string using the file parameter, which can potentially leave clients of discordrb vulnerable to command injection. The library is not directly exploitable: the exploit requires that some client of the library calls the vulnerable method with user input. However, if unsafe input reaches the library method, then an attacker can execute arbitrary shell commands on the host machine. Full impact will depend on the permissions of the process running the `discordrb` library and will likely not be total system access. This issue has been addressed in code, but a new release of the `discordrb` gem has not been uploaded to rubygems. This issue is also tracked as `GHSL-2022-094`."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"shardlab","product":"discordrb","versions":[{"version":"<= 3.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-19T15:51:55.831991Z","id":"CVE-2023-28102","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:discordrb_project:discordrb:*:*:*:*:*:ruby:*:*","versionEndExcluding":"2023-03-08","matchCriteriaId":"B00BD68A-B86C-47E5-8272-47C8237BA601"}]}]}],"references":[{"url":"https://github.com/shardlab/discordrb/commit/91e13043ffa89227c3fcdc3408f06da237d28c95","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://securitylab.github.com/advisories/GHSL-2022-094_discordrb/","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/shardlab/discordrb/commit/91e13043ffa89227c3fcdc3408f06da237d28c95","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://securitylab.github.com/advisories/GHSL-2022-094_discordrb/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2023-28846","sourceIdentifier":"security-advisories@github.com","published":"2023-03-30T20:15:07.780","lastModified":"2026-06-17T05:48:54.227","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Unpoly is a JavaScript framework for server-side web applications. There is a possible Denial of Service (DoS) vulnerability in the `unpoly-rails` gem that implements the Unpoly server protocol for Rails applications. This issues affects Rails applications that operate as an upstream of a load balancer's that uses passive health checks. The `unpoly-rails` gem echoes the request URL as an `X-Up-Location` response header. By making a request with exceedingly long URLs (paths or query string), an attacker can cause unpoly-rails to write a exceedingly large response header.  If the response header is too large to be parsed by a load balancer downstream of the Rails application, it may cause the load balancer to remove the upstream from a load balancing group. This causes that application instance to become unavailable until a configured timeout is reached or until an active healthcheck succeeds. This issue has been fixed and released as version 2.7.2.2 which is available via RubyGems and GitHub. Users unable to upgrade may: Configure your load balancer to use active health checks, e.g. by periodically requesting a route with a known response that indicates healthiness; Configure your load balancer so the maximum size of response headers is at least twice the maximum size of a URL; or instead of changing your server configuration you may also configure your Rails application to delete redundant `X-Up-Location` headers set by unpoly-rails.\n"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"unpoly","product":"unpoly-rails","versions":[{"version":"< 2.7.2.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-11T18:46:12.608525Z","id":"CVE-2023-28846","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:unpoly:unpoly-rails:*:*:*:*:*:*:*:*","versionEndExcluding":"2.7.2.2","matchCriteriaId":"5C96F0D3-A1B4-496C-802A-F86FDCFC8B7D"}]}]}],"references":[{"url":"https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#passive-health-checks","source":"security-advisories@github.com","tags":["Technical Description"]},{"url":"https://github.com/unpoly/unpoly-rails/","source":"security-advisories@github.com","tags":["Product"]},{"url":"https://github.com/unpoly/unpoly-rails/commit/cd9ad0007daceeb3b2354fdcab4f88350427bf16","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/unpoly/unpoly-rails/security/advisories/GHSA-m875-3xf6-mf78","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://makandracards.com/operations/537537-nginx-proxy-buffer-tuning","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://tryhexadecimal.com/guides/http/414-request-uri-too-long","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://unpoly.com/up.protocol","source":"security-advisories@github.com","tags":["Product"]},{"url":"https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#passive-health-checks","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Technical Description"]},{"url":"https://github.com/unpoly/unpoly-rails/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"]},{"url":"https://github.com/unpoly/unpoly-rails/commit/cd9ad0007daceeb3b2354fdcab4f88350427bf16","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/unpoly/unpoly-rails/security/advisories/GHSA-m875-3xf6-mf78","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://makandracards.com/operations/537537-nginx-proxy-buffer-tuning","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://tryhexadecimal.com/guides/http/414-request-uri-too-long","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://unpoly.com/up.protocol","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"]}]}},{"cve":{"id":"CVE-2023-40165","sourceIdentifier":"security-advisories@github.com","published":"2023-08-17T18:15:17.100","lastModified":"2026-06-17T06:16:30.283","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"rubygems.org is the Ruby community's primary gem (library) hosting service. Insufficient input validation allowed malicious actors to replace any uploaded gem version that had a platform, version number, or gem name matching `/-\\d/`, permanently replacing the legitimate upload in the canonical gem storage bucket, and triggering an immediate CDN purge so that the malicious gem would be served immediately. The maintainers have checked all gems matching the `/-\\d/` pattern and can confirm that no unexpected `.gem`s were found. As a result, we believe this vulnerability was _not_ exploited. The easiest way to ensure that a user's applications were not exploited by this vulnerability is to check that all of your downloaded .gems have a checksum that matches the checksum recorded in the RubyGems.org database. RubyGems contributor Maciej Mensfeld wrote a tool to automatically check that all downloaded .gem files match the checksums recorded in the RubyGems.org database. You can use it by running: `bundle add bundler-integrity` followed by `bundle exec bundler-integrity`. Neither this tool nor anything else can prove you were not exploited, but the can assist your investigation by quickly comparing RubyGems API-provided checksums with the checksums of files on your disk. The issue has been patched with improved input validation and the changes are live. No action is required on the part of the user. Users are advised to validate their local gems."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rubygems","product":"rubygems.org","versions":[{"version":"< 2023-08-14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-10-01T17:47:18.945871Z","id":"CVE-2023-40165","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems.org:*:*:*:*:*:*:*:*","versionEndExcluding":"2023-08-14","matchCriteriaId":"CE5111B4-8476-41CE-A096-4A64003A05F9"}]}]}],"references":[{"url":"https://github.com/rubygems/rubygems.org/commit/7e19c19247ddf5885a915710afc60ec6663d8502","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rubygems/rubygems.org/security/advisories/GHSA-rxcq-2m4f-94wm","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/rubygems/rubygems.org/commit/7e19c19247ddf5885a915710afc60ec6663d8502","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/rubygems/rubygems.org/security/advisories/GHSA-rxcq-2m4f-94wm","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2024-21654","sourceIdentifier":"security-advisories@github.com","published":"2024-01-12T21:15:11.287","lastModified":"2026-06-17T07:09:56.163","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a."},{"lang":"es","value":"Rubygems.org es el servicio de alojamiento de gemas de la comunidad Ruby. Los usuarios de Rubygems.org con MFA habilitado normalmente estarían protegidos contra la apropiación de cuentas en el caso de la apropiación de cuentas de correo electrónico. Sin embargo, un workaround al formulario de contraseña olvidada permite a un atacante omitir el requisito de MFA y apoderarse de la cuenta. Esta vulnerabilidad ha sido parcheada en el commit 0b3272a."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rubygems","product":"rubygems.org","versions":[{"version":"< commit 0b3272a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-10-24T15:25:50.298055Z","id":"CVE-2024-21654","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubygems:rubygems.org:*:*:*:*:*:*:*:*","versionEndExcluding":"2024-01-08","matchCriteriaId":"556FCBC0-E749-4BA7-AAF7-94AB12A30E1F"}]}]}],"references":[{"url":"https://github.com/rubygems/rubygems.org/commit/0b3272ac17b45748ee0d1867c49867c7deb26565","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rubygems/rubygems.org/security/advisories/GHSA-4v23-vj8h-7jp2","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/rubygems/rubygems.org/commit/0b3272ac17b45748ee0d1867c49867c7deb26565","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/rubygems/rubygems.org/security/advisories/GHSA-4v23-vj8h-7jp2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2024-28199","sourceIdentifier":"security-advisories@github.com","published":"2024-03-11T23:15:47.333","lastModified":"2026-06-17T07:21:11.490","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. This was due to improper case-sensitivity in the code that was meant to prevent these attacks. If you render an `<a>` tag with an `href` attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user. If you splat user-provided attributes when rendering any HTML tag, malicious event attributes could be included in the output, executing JavaScript when the events are triggered by another user. Patches are available on RubyGems for all 1.x minor versions. Users are advised to upgrade. Users unable to upgrade should consider configuring a content security policy that does not allow `unsafe-inline`."},{"lang":"es","value":"Phlex es un framework de código abierto para crear vistas orientadas a objetos en Ruby. Existe una posible vulnerabilidad de secuencias de comandos entre sitios (XSS) que puede explotarse mediante datos de usuario creados con fines malintencionados. Esto se debió a una distinción inadecuada entre mayúsculas y minúsculas en el código destinado a prevenir estos ataques. Si representa una etiqueta `<a rel=\"nofollow\">` con un atributo `href` establecido en un enlace proporcionado por el usuario, ese enlace podría potencialmente ejecutar JavaScript cuando otro usuario haga clic en él. Si agrega atributos proporcionados por el usuario al representar cualquier etiqueta HTML, se podrían incluir atributos de eventos maliciosos en la salida, ejecutando JavaScript cuando los eventos sean activados por otro usuario. Los parches están disponibles en RubyGems para todas las versiones menores 1.x. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben considerar configurar una política de seguridad de contenido que no permita \"inseguro en línea\".</a>"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"phlex-ruby","product":"phlex","versions":[{"version":"= 1.9.0","status":"affected"},{"version":">= 1.8.0, < 1.8.2","status":"affected"},{"version":"= 1.7.0","status":"affected"},{"version":">= 1.6.0, < 1.6.2","status":"affected"},{"version":">= 1.5.0, < 1.5.2","status":"affected"},{"version":"= 1.4.0","status":"affected"},{"version":">= 1.3.0, < 1.3.3","status":"affected"},{"version":">= 1.2.0, < 1.2.2","status":"affected"},{"version":"= 1.1.0","status":"affected"},{"version":"< 1.0.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-03-12T15:49:25.218232Z","id":"CVE-2024-28199","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:phlex:phlex:*:*:*:*:*:ruby:*:*","versionEndExcluding":"1.0.1","matchCriteriaId":"B2BF28C1-9D36-460D-9030-2ECDB054ADB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:phlex:phlex:*:*:*:*:*:ruby:*:*","versionStartIncluding":"1.2.0","versionEndExcluding":"1.2.2","matchCriteriaId":"8A30CE8F-C58A-4851-8DB2-0724D67A0E58"},{"vulnerable":true,"criteria":"cpe:2.3:a:phlex:phlex:*:*:*:*:*:ruby:*:*","versionStartIncluding":"1.3.0","versionEndExcluding":"1.3.3","matchCriteriaId":"91BCB672-57E6-47E2-9174-011BB8B9D08E"},{"vulnerable":true,"criteria":"cpe:2.3:a:phlex:phlex:1.1.0:*:*:*:*:ruby:*:*","matchCriteriaId":"A1724DBB-7DC6-43F3-BA3D-C05FCECD1D3C"},{"vulnerable":true,"criteria":"cpe:2.3:a:phlex:phlex:1.4.0:*:*:*:*:ruby:*:*","matchCriteriaId":"8E46CC01-3CD3-491D-8046-B5C5B740B7C9"},{"vulnerable":true,"criteria":"cpe:2.3:a:phlex:phlex:1.7.0:*:*:*:*:ruby:*:*","matchCriteriaId":"10E33F7C-8D3F-4182-A3A4-48940C967D31"},{"vulnerable":true,"criteria":"cpe:2.3:a:phlex:phlex:1.9.0:*:*:*:*:ruby:*:*","matchCriteriaId":"1D4EB24C-96B0-4C2B-990F-848DF9CDEE86"}]}]}],"references":[{"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy","source":"security-advisories@github.com","tags":["Technical Description"]},{"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline","source":"security-advisories@github.com","tags":["Technical Description"]},{"url":"https://github.com/phlex-ruby/phlex/commit/aa50c604cdee1d0ce7ef068a4c66cbd5d43f96a1","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/phlex-ruby/phlex/security/advisories/GHSA-242p-4v39-2v8g","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]},{"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Technical Description"]},{"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Technical Description"]},{"url":"https://github.com/phlex-ruby/phlex/commit/aa50c604cdee1d0ce7ef068a4c66cbd5d43f96a1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/phlex-ruby/phlex/security/advisories/GHSA-242p-4v39-2v8g","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2024-32970","sourceIdentifier":"security-advisories@github.com","published":"2024-04-30T23:15:06.483","lastModified":"2026-06-17T07:30:47.617","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Phlex is a framework for building object-oriented views in Ruby. In affected versions there is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. Since the last two vulnerabilities https://github.com/phlex-ruby/phlex/security/advisories/GHSA-242p-4v39-2v8g and https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c, we have invested in extensive browser tests. It was these new tests that helped us uncover these issues. As of now the project exercises every possible attack vector the developers can think of — including enumerating every ASCII character, and we run these tests in Chrome, Firefox and Safari. Additionally, we test against a list of 6613 known XSS payloads (see: payloadbox/xss-payload-list). The reason these issues were not detected before is the escapes were working as designed. However, their design didn't take into account just how recklessly permissive browsers are when it comes to executing unsafe JavaScript via HTML attributes. If you render an `<a>` tag with an `href` attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user. If you splat user-provided attributes when rendering any HTML or SVG tag, malicious event attributes could be included in the output, executing JavaScript when the events are triggered by another user. Patches are available on RubyGems for all minor versions released in the last year. Users are advised to upgrade. Users unable to upgrade should configure a Content Security Policy that does not allow `unsafe-inline` which would effectively prevent this vulnerability from being exploited. Users who upgrade are also advised to configure a Content Security Policy header that does not allow `unsafe-inline`."},{"lang":"es","value":"Phlex es un framework para crear vistas orientadas a objetos en Ruby. En las versiones afectadas existe una posible vulnerabilidad de Cross Site Scripting (XSS) que puede explotarse a través de datos de usuario creados con fines malintencionados. Desde las dos últimas vulnerabilidades https://github.com/phlex-ruby/phlex/security/advisories/GHSA-242p-4v39-2v8g y https://github.com/phlex-ruby/phlex/security/advisories/GHSA -g7xq-xv8c-h98c, hemos invertido en pruebas exhaustivas del navegador. Fueron estas nuevas pruebas las que nos ayudaron a descubrir estos problemas. A partir de ahora, el proyecto practica todos los posibles vectores de ataque que los desarrolladores puedan imaginar, incluida la enumeración de cada carácter ASCII, y ejecutamos estas pruebas en Chrome, Firefox y Safari. Además, realizamos pruebas con una lista de 6613 cargas útiles XSS conocidas (consulte: payloadbox/xss-payload-list). La razón por la que estos problemas no se detectaron antes es que los escapes funcionaban según lo manipulado. Sin embargo, su diseño no tuvo en cuenta cuán imprudentemente permisivos son los navegadores cuando se trata de ejecutar JavaScript inseguro a través de atributos HTML. Si representa una etiqueta `<a rel=\"nofollow\">` con un atributo `href` establecido en un enlace proporcionado por el usuario, ese enlace podría ejecutar JavaScript cuando otro usuario haga clic en él. Si agrega atributos proporcionados por el usuario al representar cualquier etiqueta HTML o SVG, se podrían incluir atributos de eventos maliciosos en la salida, ejecutando JavaScript cuando los eventos sean activados por otro usuario. Los parches están disponibles en RubyGems para todas las versiones menores lanzadas el año pasado. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben configurar una Política de seguridad de contenido que no permita \"inseguro en línea\", lo que evitaría efectivamente que se aproveche esta vulnerabilidad. También se recomienda a los usuarios que actualicen que configuren un encabezado de Política de seguridad de contenido que no permita \"inseguro en línea\".</a>"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"phlex-ruby","product":"phlex","versions":[{"version":"< 1.9.3","status":"affected"},{"version":">= 1.10.0, < 1.10.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-06-18T15:29:00.814254Z","id":"CVE-2024-32970","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy","source":"security-advisories@github.com"},{"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline","source":"security-advisories@github.com"},{"url":"https://github.com/payloadbox/xss-payload-list","source":"security-advisories@github.com"},{"url":"https://github.com/phlex-ruby/phlex/commit/da8f94342a84cff9d78c98bcc3b3604ee2e577d2","source":"security-advisories@github.com"},{"url":"https://github.com/phlex-ruby/phlex/security/advisories/GHSA-9p57-h987-4vgx","source":"security-advisories@github.com"},{"url":"https://rubygems.org/gems/phlex","source":"security-advisories@github.com"},{"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/payloadbox/xss-payload-list","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/phlex-ruby/phlex/commit/da8f94342a84cff9d78c98bcc3b3604ee2e577d2","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/phlex-ruby/phlex/security/advisories/GHSA-9p57-h987-4vgx","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://rubygems.org/gems/phlex","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2024-35221","sourceIdentifier":"security-advisories@github.com","published":"2024-05-29T21:15:49.017","lastModified":"2026-06-17T07:34:34.257","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-based metadata of a gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks). This was patched. There is is no action required by users. This issue is also tracked as GHSL-2024-001 and was discovered by the GitHub security lab."},{"lang":"es","value":"Rubygems.org es el servicio de alojamiento de gemas de la comunidad Ruby. Un editor de gemas puede provocar un DoS remoto al publicar una gema. Esto se debe a cómo Ruby lee los archivos Manifiesto de Gem cuando usa Gem::Specification.from_yaml. from_yaml utiliza SafeYAML.load, que permite alias YAML dentro de los metadatos basados en YAML de una gema. Los alias YAML permiten ataques de denegación de servicio con las llamadas \"bombas YAML\" (comparables a los ataques de mil millones de risas). Esto fue parcheado. No se requiere ninguna acción por parte de los usuarios. Este problema también se rastrea como GHSL-2024-001 y fue descubierto por el laboratorio de seguridad de GitHub."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rubygems","product":"rubygems.org","versions":[{"version":"< 2024-04-12","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-06-06T18:59:20.588645Z","id":"CVE-2024-35221","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://en.wikipedia.org/wiki/Billion_laughs_attack","source":"security-advisories@github.com"},{"url":"https://github.com/ruby/ruby/blob/7cf74a2ff28b1b4c26e367d0d67521f7e1fed239/lib/rubygems/safe_yaml.rb#L28","source":"security-advisories@github.com"},{"url":"https://github.com/rubygems/rubygems.org/security/advisories/GHSA-4vc5-whwr-7hh2","source":"security-advisories@github.com"},{"url":"https://en.wikipedia.org/wiki/Billion_laughs_attack","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/ruby/ruby/blob/7cf74a2ff28b1b4c26e367d0d67521f7e1fed239/lib/rubygems/safe_yaml.rb#L28","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/rubygems/rubygems.org/security/advisories/GHSA-4vc5-whwr-7hh2","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-41316","sourceIdentifier":"security-advisories@github.com","published":"2026-04-24T03:16:11.897","lastModified":"2026-08-24T13:18:33.597","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"ruby","product":"erb","versions":[{"version":"< 4.0.3.1","status":"affected"},{"version":"= 4.0.4","status":"affected"},{"version":">= 5.0.0, < 6.0.1.1","status":"affected"},{"version":">= 6.0.2, < 6.0.4","status":"affected"}]}]},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby","cpes":["cpe:/o:redhat:enterprise_linux:10.1"],"versions":[{"version":"0:3.3.10-12.el10_1","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby4.0","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"versions":[{"version":"0:4.0.3-34.el10_2","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"versions":[{"version":"0:3.3.10-11.el10_0.1","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ruby:3.3","cpes":["cpe:/a:redhat:enterprise_linux:8"],"versions":[{"version":"8100020260428163940.489197e6","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby:3.3","cpes":["cpe:/a:redhat:enterprise_linux:9"],"versions":[{"version":"9070020260428163621.9","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby","cpes":["cpe:/a:redhat:enterprise_linux:9"],"versions":[{"version":"0:3.0.7-166.el9_7","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby:4.0","cpes":["cpe:/a:redhat:enterprise_linux:9"],"versions":[{"version":"9080020260513131334.9","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby","cpes":["cpe:/a:redhat:rhel_e4s:9.0"],"versions":[{"version":"0:3.0.4-160.2.el9_0","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"versions":[{"version":"0:3.0.4-161.el9_2.3","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"versions":[{"version":"0:3.0.7-162.el9_4.2","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby:3.3","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"versions":[{"version":"9040020260520083544.9","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"versions":[{"version":"0:3.0.7-165.el9_6.1","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby:3.3","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"versions":[{"version":"9060020260630075016.9","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby:2.5/ruby","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby3.3","cpes":["cpe:/a:redhat:hummingbird:1"]},{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby3.4","cpes":["cpe:/a:redhat:hummingbird:1"]},{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby4.0","cpes":["cpe:/a:redhat:hummingbird:1"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-25T01:45:02.467085Z","id":"CVE-2026-41316","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-693"}]},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv","source":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:18030","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:18039","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:18065","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20596","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20606","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20614","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20670","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26312","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26655","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33462","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33478","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:35834","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37238","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-41316","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461369","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41316.json","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}]}},{"cve":{"id":"CVE-2026-82455","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-29T14:16:38.623","lastModified":"2026-09-11T12:16:52.270","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe."}],"metrics":{},"references":[]}}]}