# rubygems-update (RubyGems) vulnerabilities 25 known vulnerabilities, with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://rubygems.org/gems/rubygems-update ## Advisories (25) ### [CVE-2019-8321](https://cve.now/CVE-2019-8321): An issue was discovered in RubyGems 2.6 and later through 3.0.2. - Severity: Unrated - Published: Jun 17, 2019 - Affected: from 2.6.0, fixed in 2.7.9; from 3.0.0, fixed in 3.0.2. ### [CVE-2019-8322](https://cve.now/CVE-2019-8322): An issue was discovered in RubyGems 2.6 and later through 3.0.2. - Severity: Unrated - Published: Jun 17, 2019 - Affected: from 2.6.0, fixed in 2.7.9; from 3.0.0, fixed in 3.0.2. ### [CVE-2019-8323](https://cve.now/CVE-2019-8323): An issue was discovered in RubyGems 2.6 and later through 3.0.2. - Severity: Unrated - Published: Jun 17, 2019 - Affected: from 2.6.0, fixed in 2.7.9; from 3.0.0, fixed in 3.0.2. ### [CVE-2019-8325](https://cve.now/CVE-2019-8325): An issue was discovered in RubyGems 2.6 and later through 3.0.2. - Severity: Unrated - Published: Jun 17, 2019 - Affected: from 2.6.0, fixed in 2.7.9; from 3.0.0, fixed in 3.0.2. ### [CVE-2019-8324](https://cve.now/CVE-2019-8324): An issue was discovered in RubyGems 2.6 and later through 3.0.2. - Severity: Unrated - Published: Jun 17, 2019 - Affected: from 2.6.0, fixed in 2.7.9; from 3.0.0, fixed in 3.0.2. ### [CVE-2019-8320](https://cve.now/CVE-2019-8320): A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. - Severity: Unrated - Published: Jun 6, 2019 - Affected: from 2.7.6, fixed in 2.7.9; from 3.0.0, fixed in 3.0.3. ### [CVE-2018-1000079](https://cve.now/CVE-2018-1000079): RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5… - Severity: Unrated - Published: Mar 13, 2018 - Affected: fixed in 2.7.6. ### [CVE-2018-1000078](https://cve.now/CVE-2018-1000078): RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5… - Severity: Unrated - Published: Mar 13, 2018 - Affected: fixed in 2.7.6. ### [CVE-2018-1000077](https://cve.now/CVE-2018-1000077): RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5… - Severity: Unrated - Published: Mar 13, 2018 - Affected: fixed in 2.7.6. ### [CVE-2018-1000076](https://cve.now/CVE-2018-1000076): RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5… - Severity: Unrated - Published: Mar 13, 2018 - Affected: from 2.2.0, fixed in 2.7.6. ### [CVE-2018-1000075](https://cve.now/CVE-2018-1000075): RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5… - Severity: Unrated - Published: Mar 13, 2018 - Affected: fixed in 2.7.6. ### [CVE-2018-1000074](https://cve.now/CVE-2018-1000074): RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5… - Severity: Unrated - Published: Mar 13, 2018 - Affected: fixed in 2.7.6. ### [CVE-2018-1000073](https://cve.now/CVE-2018-1000073): RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5… - Severity: Unrated - Published: Mar 13, 2018 - Affected: fixed in 2.7.6. ### [CVE-2017-0903](https://cve.now/CVE-2017-0903): RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. - Severity: Unrated - Published: Oct 11, 2017 - Affected: from 2.0.0, fixed in 2.6.14. ### [CVE-2017-0902](https://cve.now/CVE-2017-0902): RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems… - Severity: Unrated - Published: Aug 31, 2017 - Affected: fixed in 2.6.13. ### [CVE-2017-0901](https://cve.now/CVE-2017-0901): RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any… - Severity: Unrated - Published: Aug 31, 2017 - Affected: fixed in 2.6.13. ### [CVE-2017-0900](https://cve.now/CVE-2017-0900): RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against… - Severity: Unrated - Published: Aug 31, 2017 - Affected: fixed in 2.6.13. ### [CVE-2017-0899](https://cve.now/CVE-2017-0899): RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. - Severity: Unrated - Published: Aug 31, 2017 - Affected: fixed in 2.6.13. ### [CVE-2015-4020](https://cve.now/CVE-2015-4020): RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API… - Severity: Unrated - Published: Aug 25, 2015 - Affected: fixed in 2.0.17; from 2.1.0.rc.1, fixed in 2.2.5; from 2.3.0, fixed in 2.4.8. ### [CVE-2015-3900](https://cve.now/CVE-2015-3900): RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API… - Severity: Unrated - Published: Jun 24, 2015 - Affected: from 2.0.0, fixed in 2.0.16; from 2.2.0, fixed in 2.2.4; from 2.4.0, fixed in 2.4.7. ### [CVE-2013-4363](https://cve.now/CVE-2013-4363): Algorithmic complexity vulnerability in Gem::Version::ANCHORED\_VERSION\_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2… - Severity: Unrated - Published: Oct 17, 2013 - Affected: fixed in 1.8.23.2; from 1.8.24, fixed in 1.8.27; from 2.0.0, fixed in 2.0.10; from 2.1.0, fixed in 2.1.5. ### [CVE-2013-4287](https://cve.now/CVE-2013-4287): Algorithmic complexity vulnerability in Gem::Version::VERSION\_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24… - Severity: Unrated - Published: Oct 17, 2013 - Affected: fixed in 1.8.23.1; from 1.8.24, fixed in 1.8.26; from 2.0.0, fixed in 2.0.8; from 2.1.0.rc.1, fixed in 2.1.0. ### [CVE-2012-2126](https://cve.now/CVE-2012-2126): RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a… - Severity: Unrated - Published: Oct 1, 2013 - Affected: fixed in 1.8.23. ### [CVE-2012-2125](https://cve.now/CVE-2012-2125): RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem… - Severity: Unrated - Published: Oct 1, 2013 - Affected: fixed in 1.8.23. ### [CVE-2007-0469](https://cve.now/CVE-2007-0469): The extract\_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which… - Severity: Unrated - Published: Jan 24, 2007 - Affected: fixed in 0.9.1. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/rubygems/rubygems-update Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.