Improper Verification of Cryptographic Signature in RubyGems

CVE-2018-1000076 · HIGH Severity

AV:N/AC:L/AU:N/C:P/I:P/A:P

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.

Learn more about our Web Application Penetration Testing UK.