Deserialization of Untrusted Data Vulnerability in RubyGems and JRuby
Summary
CVE-2018-1000074: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of... Affects jruby across 2 version ranges.
< 9.1.17.0-1
< 254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d
Fixed in 9.1.17.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RubyGems is a package manager for the Ruby programming language, facilitating the distribution and management of Ruby libraries (gems). It allows developers to easily install, update, and manage dependencies for their Ruby applications. JRuby is an implementation of Ruby that runs on the Java Virtual Machine (JVM). The vulnerability in question affects specific versions of RubyGems and JRuby, making them susceptible to code execution through the gem owner command when handling specially crafted YAML files.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1000074, arises from the deserialization of untrusted data within the gem owner command of RubyGems. This flaw can lead to arbitrary code execution if a user runs the command on a gem containing a maliciously crafted YAML file. The affected versions include RubyGems in the Ruby 2.2 series (2.2.9 and earlier), Ruby 2.3 series (2.3.6 and earlier), Ruby 2.4 series (2.4.3 and earlier), and Ruby 2.5 series (2.5.0 and earlier). The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
9.1.17.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jrubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the gem owner command on gems that you suspect may contain untrusted YAML files. Additionally, consider validating the contents of YAML files before executing commands that process them.
Conclusion
CVE-2018-1000074 is a significant vulnerability affecting RubyGems and JRuby, allowing for potential code execution through the gem owner command. Users are strongly advised to upgrade to the latest versions to mitigate this risk. For those unable to upgrade immediately, implementing workarounds can help reduce exposure.
See every vulnerability recorded for jruby →
FAQ
CVE-2018-1000074 is a vulnerability in RubyGems and JRuby that allows for code execution through the deserialization of untrusted data in the gem owner command.
Affected versions include RubyGems in the Ruby 2.2 series (2.2.9 and earlier), Ruby 2.3 series (2.3.6 and earlier), Ruby 2.4 series (2.4.3 and earlier), and Ruby 2.5 series (2.5.0 and earlier).
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without any installation.
If an immediate upgrade is not possible, refrain from using the gem owner command on potentially unsafe gems and validate YAML files before processing them.
The CVSS score for CVE-2018-1000074 is 7.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for jruby.
