MediumFix available
jruby, rubygems — security advisory
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.
- Products
- jruby, rubygems
- Affected versions
- Not specified
- Fixed versions
- 3.2.0~rc.1-1, 9.1.17.0-1
- CVEs
- CVE-2018-1000079
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 01:28 UTC · Revision 1
Source evidence
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.
osv:DEBIAN-CVE-2018-1000079
jruby
Fixed versions: 9.1.17.0-1
jruby
Fixed versions: 9.1.17.0-1
jruby
Fixed versions: 9.1.17.0-1
rubygems
Fixed versions: 3.2.0~rc.1-1
rubygems
Fixed versions: 3.2.0~rc.1-1
rubygems
Fixed versions: 3.2.0~rc.1-1
Complete source record
{
"id": "8500a3a833c7383bf7853a83ae3775dcfcae0ff440ccfd559a7aac2b90429f9d",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000079",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2018-1000079",
"summary": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.",
"evidence": "osv:DEBIAN-CVE-2018-1000079",
"products": [
{
"name": {
"value": "jruby",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.1.17.0-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "jruby",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.1.17.0-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "jruby",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.1.17.0-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rubygems",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.2.0~rc.1-1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rubygems",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.2.0~rc.1-1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rubygems",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.2.0~rc.1-1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2018-1000079",
"aliases": [
"DEBIAN-CVE-2018-1000079"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.1.17.0-1"
}
]
}
],
"package": {
"name": "jruby",
"purl": "pkg:deb/debian/jruby?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1000079.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.1.17.0-1"
}
]
}
],
"package": {
"name": "jruby",
"purl": "pkg:deb/debian/jruby?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1000079.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.1.17.0-1"
}
]
}
],
"package": {
"name": "jruby",
"purl": "pkg:deb/debian/jruby?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1000079.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.0~rc.1-1"
}
]
}
],
"package": {
"name": "rubygems",
"purl": "pkg:deb/debian/rubygems?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1000079.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.0~rc.1-1"
}
]
}
],
"package": {
"name": "rubygems",
"purl": "pkg:deb/debian/rubygems?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1000079.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.0~rc.1-1"
}
]
}
],
"package": {
"name": "rubygems",
"purl": "pkg:deb/debian/rubygems?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1000079.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T18:04:46.461118437Z",
"provider": "osv",
"upstream": [
"CVE-2018-1000079"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2018-1000079"
]
},
"related_cves": [
{
"value": "CVE-2018-1000079",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 423666,
"published_at": "2018-03-13T15:29:00.783+00:00"
}