RubyGems Improper Verification of Cryptographic Signature vulnerability

緊急 9.8CVE-2018-1000076 · GHSA-mc6j-h948-v2p6 · 13/03/2018 公開 · 17/06/2026 更新

要点

CVE-2018-1000076 は org.jruby:jruby-stdlib, rubygems-update, rubygems (rubygems) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.9%（全脆弱性の 87.1% より高い）。
対処：9.1.16.0, 2.7.6 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jruby:jruby-stdlib Maven	`< 9.1.16.0`	`9.1.16.0`
rubygems-update RubyGems	`≥ 2.2.0, < 2.7.6`	`2.7.6`
rubygems rubygems	`≤ 2.2.9≤ 2.3.6≤ 2.4.3≤ 2.5.0`	修正版なし

概要

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, and Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contain an Improper Verification of Cryptographic Signature vulnerability in package.rb. This can result in a mis-signed gem being installed, as the tarball would contain multiple gem signatures. This vulnerability has been fixed in 2.7.6.

NVD の説明

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.