Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

rubygems-update

25 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
25
Registry
RubyGems

Advisories 25

  • An issue was discovered in RubyGems 2.6 and later through 3.0.2.

    Affected: from 2.6.0, fixed in 2.7.9; from 3.0.0, fixed in 3.0.2.

  • An issue was discovered in RubyGems 2.6 and later through 3.0.2.

    Affected: from 2.6.0, fixed in 2.7.9; from 3.0.0, fixed in 3.0.2.

  • An issue was discovered in RubyGems 2.6 and later through 3.0.2.

    Affected: from 2.6.0, fixed in 2.7.9; from 3.0.0, fixed in 3.0.2.

  • An issue was discovered in RubyGems 2.6 and later through 3.0.2.

    Affected: from 2.6.0, fixed in 2.7.9; from 3.0.0, fixed in 3.0.2.

  • An issue was discovered in RubyGems 2.6 and later through 3.0.2.

    Affected: from 2.6.0, fixed in 2.7.9; from 3.0.0, fixed in 3.0.2.

  • A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2.

    Affected: from 2.7.6, fixed in 2.7.9; from 3.0.0, fixed in 3.0.3.

  • RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5…

    Affected: fixed in 2.7.6.

  • RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5…

    Affected: fixed in 2.7.6.

  • RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5…

    Affected: fixed in 2.7.6.

  • RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5…

    Affected: from 2.2.0, fixed in 2.7.6.

  • RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5…

    Affected: fixed in 2.7.6.

  • RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5…

    Affected: fixed in 2.7.6.

  • RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5…

    Affected: fixed in 2.7.6.

  • RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability.

    Affected: from 2.0.0, fixed in 2.6.14.

  • RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems…

    Affected: fixed in 2.6.13.

Show all 25 advisoriesShow fewer advisories

  • RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any…

    Affected: fixed in 2.6.13.

  • RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against…

    Affected: fixed in 2.6.13.

  • RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters.

    Affected: fixed in 2.6.13.

  • RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API…

    Affected: fixed in 2.0.17; from 2.1.0.rc.1, fixed in 2.2.5; from 2.3.0, fixed in 2.4.8.

  • RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API…

    Affected: from 2.0.0, fixed in 2.0.16; from 2.2.0, fixed in 2.2.4; from 2.4.0, fixed in 2.4.7.

  • Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2…

    Affected: fixed in 1.8.23.2; from 1.8.24, fixed in 1.8.27; from 2.0.0, fixed in 2.0.10; from 2.1.0, fixed in 2.1.5.

  • Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24…

    Affected: fixed in 1.8.23.1; from 1.8.24, fixed in 1.8.26; from 2.0.0, fixed in 2.0.8; from 2.1.0.rc.1, fixed in 2.1.0.

  • RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a…

    Affected: fixed in 1.8.23.

  • RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem…

    Affected: fixed in 1.8.23.

  • The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which…

    Affected: fixed in 0.9.1.