Insecure digital certificates In rubygems-update
Description
RubyGems Improper Verification of Cryptographic Signature vulnerability RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, and Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contain an Improper Verification of Cryptographic Signature vulnerability in package.rb. This can result in a mis-signed gem being installed, as the tarball would contain multiple gem signatures. This vulnerability has been fixed in 2.7.6.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 rubygems | 2.7.6 | ||
 maven | 9.1.16.0 | ||
 debian 12 | 3.2.0~rc.1-1 | ||
debian 14 | 3.2.0~rc.1-1 | ||
debian 13 | 9.1.17.0-1 | ||
debian 11 | 3.2.0~rc.1-1 | ||
debian 12 | 9.1.17.0-1 | ||
debian 14 | 9.1.17.0-1 | ||
debian 13 | 3.2.0~rc.1-1 | ||
 rpm rhel7 | 0:2.0.0.648-36.el7 |
1-10 of 13
10
Aliases
References