Improper Verification of Cryptographic Signature in RubyGems and JRuby
Summary
CVE-2018-1000076: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verificat... Affects jruby across 2 version ranges.
< 9.1.17.0-1
< f5042b879259b1f1ce95a0c5082622c646376693
Fixed in 9.1.17.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RubyGems is a package manager for the Ruby programming language, facilitating the management of Ruby libraries and applications. JRuby is an implementation of Ruby on the Java Virtual Machine (JVM). Both packages are widely used in the Ruby ecosystem for dependency management. The vulnerability affects multiple versions of RubyGems and JRuby, allowing for the installation of mis-signed gems, which can compromise the integrity of the software.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1000076, arises from an improper verification of cryptographic signatures in the package.rb file of RubyGems. This flaw allows a malicious actor to create a tarball containing multiple gem signatures, leading to the installation of a mis-signed gem. The implications of this vulnerability are severe, as it can result in the execution of untrusted code, potentially leading to data breaches or system compromise. The affected versions include RubyGems in the Ruby 2.2, 2.3, 2.4, and 2.5 series, as well as JRuby versions prior to 9.1.17.0-1.
How To Fix
Minimum fixed version
9.1.17.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jrubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid installing gems from untrusted sources and verify the signatures of gems manually. However, this is not a complete solution and upgrading is strongly recommended.
Conclusion
CVE-2018-1000076 presents a significant risk to users of RubyGems and JRuby due to its potential to allow the installation of mis-signed gems. It is crucial for users to upgrade to the latest versions to mitigate this risk and ensure the integrity of their applications.
See every vulnerability recorded for jruby →
FAQ
CVE-2018-1000076 is a vulnerability in RubyGems and JRuby that allows for the installation of mis-signed gems due to improper verification of cryptographic signatures.
Affected versions include RubyGems in the Ruby 2.2 series (2.2.9 and earlier), Ruby 2.3 series (2.3.6 and earlier), Ruby 2.4 series (2.4.3 and earlier), and Ruby 2.5 series (2.5.0 and earlier), as well as JRuby versions prior to 9.1.17.0-1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application at the Vulert playground without signup.
If immediate upgrading is not possible, avoid installing gems from untrusted sources and manually verify gem signatures as a temporary measure.
The CVSS score of CVE-2018-1000076 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for jruby.
