RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2018-03-13T15:00:00

Updated: 2024-08-05T12:33:49.167Z

Reserved: 2018-02-21T00:00:00

Link: CVE-2018-1000076

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-03-13T15:29:00.613

Modified: 2024-11-21T03:39:35.100

Link: CVE-2018-1000076

cve-icon Redhat

Severity : Moderate

Publid Date: 2018-02-15T00:00:00Z

Links: CVE-2018-1000076 - Bugzilla