| Package | Affected versions | Patched versions |
|---|---|---|
| org.jruby:jruby-stdlib | < 9.1.16.0 | 9.1.16.0 |
| rubygems-update | ≥ 2.2.0, < 2.7.6 | 2.7.6 |
| rubygems | ≤ 2.2.9≤ 2.3.6≤ 2.4.3≤ 2.5.0 |
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, and Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contain an Improper Verification of Cryptographic Signature vulnerability in package.rb. This can result in a mis-signed gem being installed, as the tarball would contain multiple gem signatures. This vulnerability has been fixed in 2.7.6.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free