Infinite Loop Vulnerability in RubyGems and JRuby Packages
Summary
CVE-2018-1000075: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caus... Affects jruby across 2 version ranges.
< 9.1.17.0-1
< 92e98bf8f810bd812f919120d4832df51bc25d83
Fixed in 9.1.17.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RubyGems is a package manager for the Ruby programming language, facilitating the installation and management of Ruby libraries. JRuby is an implementation of Ruby on the Java Virtual Machine (JVM). Both packages are widely used in Ruby applications for dependency management. The vulnerability in question affects multiple versions of RubyGems and JRuby, potentially leading to severe performance issues due to an infinite loop caused by a negative size in the tar header.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1000075, arises from an infinite loop triggered by a negative size vulnerability in the tar header of the ruby gem package. This issue can lead to unresponsive applications and denial of service, as the affected software may enter an infinite loop without completing its operations. The vulnerability exists in RubyGems versions prior to 2.7.6 and various versions of JRuby, making it critical for users to upgrade to secure versions.
How To Fix
Minimum fixed version
9.1.17.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jrubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider temporarily avoiding the use of affected RubyGems and JRuby functionalities that rely on the vulnerable tar header processing until a fix can be applied.
Conclusion
The CVE-2018-1000075 vulnerability poses a significant risk to applications using RubyGems and JRuby, leading to potential infinite loops and service disruptions. It is crucial for users to upgrade to the latest versions to mitigate this risk effectively.
See every vulnerability recorded for jruby →
FAQ
CVE-2018-1000075 is a vulnerability in RubyGems and JRuby that can cause an infinite loop due to a negative size in the tar header.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to unresponsive applications and denial of service due to the infinite loop.
Affected versions include RubyGems 2.2.9 and earlier, 2.3.6 and earlier, 2.4.3 and earlier, and 2.5.0 and earlier, as well as various versions of JRuby.
You can upgrade RubyGems and JRuby using your package manager. For Debian-based systems, use: sudo apt-get install rubygems=3.2.0~rc.1-1 jruby=9.1.17.0-1.
Related vulnerabilities
Recent vulnerabilities recorded for jruby.
