Directory Traversal Vulnerability in RubyGems and JRuby Packages
Summary
CVE-2018-1000073: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversa... Affects jruby across 2 version ranges.
< 1b931fc03b819b9a0214be3eaca844ef534175e2
< 9.1.17.0-2.1
Fixed in 9.1.17.0-2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RubyGems is a package manager for the Ruby programming language that facilitates the distribution and management of Ruby libraries. It allows developers to easily install, update, and manage dependencies for their Ruby applications. JRuby is an implementation of Ruby on the Java Virtual Machine (JVM), enabling Ruby applications to run on Java. Both packages are widely used in the Ruby ecosystem, making them critical for many applications. The vulnerability in question affects specific versions of RubyGems and JRuby, exposing them to potential security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1000073, is a Directory Traversal issue found in the install_location function of package.rb within RubyGems. This flaw allows an attacker to manipulate the installation path, potentially leading to unauthorized access to files outside the intended directory. The vulnerability affects RubyGems versions in the Ruby 2.2, 2.3, 2.4, and 2.5 series, as well as JRuby. If exploited, it could allow attackers to write files to arbitrary locations, compromising the integrity of the system. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
9.1.17.0-2.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jrubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using symlinked directories for installations until they can upgrade to the fixed versions. This can help mitigate the risk of exploitation while a permanent fix is being implemented.
Conclusion
The Directory Traversal vulnerability in RubyGems and JRuby poses significant risks to applications using these packages. It is crucial for developers to upgrade to the latest versions to mitigate potential exploitation. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for jruby →
FAQ
CVE-2018-1000073 is a Directory Traversal vulnerability affecting RubyGems and JRuby, allowing unauthorized file access through manipulated installation paths.
Affected versions include RubyGems in the Ruby 2.2 series (2.2.9 and earlier), 2.3 series (2.3.6 and earlier), 2.4 series (2.4.3 and earlier), and 2.5 series (2.5.0 and earlier).
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If an immediate upgrade is not possible, consider using a workaround by avoiding symlinked directories for installations until you can apply the fix.
Additional details can be found in the official CVE database or by visiting the RubyGems and JRuby project pages.
Related vulnerabilities
Recent vulnerabilities recorded for jruby.
