CVE ID:	CVE-2018-1000079
Description:	RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.
Test IDs:	None available
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2018-1000079 Debian Security Information: DSA-4219 (Google Search) https://www.debian.org/security/2018/dsa-4219 Debian Security Information: DSA-4259 (Google Search) https://www.debian.org/security/2018/dsa-4259 http://blog.rubygems.org/2018/02/15/2.7.6-released.html https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099 https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759 https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html RedHat Security Advisories: RHSA-2018:3729 https://access.redhat.com/errata/RHSA-2018:3729 RedHat Security Advisories: RHSA-2018:3730 https://access.redhat.com/errata/RHSA-2018:3730 RedHat Security Advisories: RHSA-2018:3731 https://access.redhat.com/errata/RHSA-2018:3731 RedHat Security Advisories: RHSA-2019:2028 https://access.redhat.com/errata/RHSA-2019:2028 RedHat Security Advisories: RHSA-2020:0542 https://access.redhat.com/errata/RHSA-2020:0542 RedHat Security Advisories: RHSA-2020:0591 https://access.redhat.com/errata/RHSA-2020:0591 RedHat Security Advisories: RHSA-2020:0663 https://access.redhat.com/errata/RHSA-2020:0663 SuSE Security Announcement: openSUSE-SU-2019:1771 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html https://usn.ubuntu.com/3621-1/