Critical Vulnerability in RubyGems: Arbitrary Code Injection Risk in Ruby Packages
Summary
UBUNTU-CVE-2019-8324: An issue was discovered in RubyGems 2.6 and later through 3.0.2. Affects ruby1.9.1 versions < 1.9.3.484-2ubuntu1.14. Fixed in 1.9.3.484-2ubuntu1.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RubyGems is a package manager for the Ruby programming language, facilitating the distribution and management of Ruby libraries (gems). It allows developers to easily install, update, and manage dependencies in their Ruby applications. The vulnerability in question affects RubyGems versions 2.6 and later, up to 3.0.2, where a crafted gem with a multi-line name can lead to arbitrary code execution during the preinstall check.
Vulnerability Detail
An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly, allowing an attacker to inject arbitrary code into the stub line of the gem specification (gemspec). This code is then evaluated by the ensure_loadable_spec method during the preinstall check, potentially leading to unauthorized actions within the system. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
1.9.3.484-2ubuntu1.14
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby1.9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid installing gems from untrusted sources or those with suspicious multi-line names until the RubyGems package is updated. Additionally, you can implement strict validation checks on gem names before installation.
Conclusion
The vulnerability in RubyGems poses a significant risk due to the potential for arbitrary code execution during gem installations. It is crucial for developers to update their RubyGems installations to the latest patched versions and to exercise caution when handling gem packages.
See every vulnerability recorded for ruby1.9.1 →
FAQ
The vulnerability allows attackers to execute arbitrary code on the system during the gem installation process, which can lead to severe security breaches.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
RubyGems versions 2.6 and later, up to 3.0.2, are affected by this vulnerability.
Yes, avoid installing gems from untrusted sources and implement validation checks on gem names as a temporary measure.
You can find detailed information about this vulnerability on the official Ubuntu security notices page and other security advisory platforms.
Related vulnerabilities
Recent vulnerabilities recorded for ruby1.9.1.
