Medium
Security advisory
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-1000079
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 10:20 UTC · Revision 1
Source evidence
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.
osv:CVE-2018-1000079
Complete source record
{
"id": "bf434747fa1fda1f05ec8908ec422e4f81801ea7f56a7d56bd6458aa93c60381",
"url": "https://osv.dev/vulnerability/CVE-2018-1000079",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-1000079",
"summary": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.",
"evidence": "osv:CVE-2018-1000079",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2018-1000079",
"aliases": [
"CVE-2018-1000079",
"GHSA-8qxg-mff5-j3wc"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/ruby/rubygems",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "30e740c073e954474b08aa05aaa951e9bb74791c"
},
{
"last_affected": "056f64c33a4f3783290b7c9c09d387213caf3c3d"
},
{
"last_affected": "744e413f556ead46aabc659408a99a4c318b6549"
},
{
"last_affected": "b6f3b5fac7ec01e5dcc57d6768a7e9b456feaea8"
},
{
"fixed": "666ef793cad42eed96f7aee1cdf77865db921099"
},
{
"fixed": "f83f911e19e27cbac1ccce7471d96642241dd759"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.2.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.3.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.4.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.5.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "666ef793cad42eed96f7aee1cdf77865db921099"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "f83f911e19e27cbac1ccce7471d96642241dd759"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v2.4.3",
"v2.4.2",
"v2.4.1",
"v2.4.0",
"v2.3.0",
"v2.2.1",
"v2.2.0.rc.1",
"v2.2.0.preview.1",
"v2.1.3",
"v2.1.2",
"v2.1.1",
"v2.1.0",
"v2.1.0.rc.2",
"v2.1.0.rc.1",
"v2.0.3",
"v2.0.2",
"v2.0.1",
"v2.0.0",
"v2.0.0.rc.2",
"v2.0.0.rc.1",
"v2.0.0.preview2.2",
"v2.0.0.preview2.1",
"v2.0.0.preview2",
"v1.8.2",
"v1.8.1",
"v1.8.0",
"v1.7.1",
"v1.7.0",
"v1.6.2",
"v1.6.1",
"v1.6.0",
"v1.5.2",
"v1.5.1",
"v1.5.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000079.json"
}
}
],
"modified": "2026-10-20T10:50:14.240616655Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html",
"https://usn.ubuntu.com/3621-1/",
"https://access.redhat.com/errata/RHSA-2018:3729",
"https://access.redhat.com/errata/RHSA-2018:3730",
"https://access.redhat.com/errata/RHSA-2018:3731",
"https://access.redhat.com/errata/RHSA-2019:2028",
"https://access.redhat.com/errata/RHSA-2020:0542",
"https://access.redhat.com/errata/RHSA-2020:0591",
"https://access.redhat.com/errata/RHSA-2020:0663",
"https://www.debian.org/security/2018/dsa-4219",
"https://www.debian.org/security/2018/dsa-4259",
"https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099",
"https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2018-1000079",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 381429,
"published_at": "2018-03-13T15:29:00.783+00:00"
}