CVE-2018-1000079
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem…
Does this matter?
Lower severity and a low EPSS score (2.78%). Track it; it rarely justifies an emergency change on its own.
Description
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.
- CVSS 3.0
- 5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- EPSS
- 2.78% probability · 86th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- rubygems/rubygems
- Source
- cve@mitre.org
EPSS moved from 3.9% on 21 September 2026 to 2.8% on 27 October 2026.
References
- http://blog.rubygems.org/2018/02/15/2.7.6-released.htmlVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
- https://access.redhat.com/errata/RHSA-2018:3729
- https://access.redhat.com/errata/RHSA-2018:3730
- https://access.redhat.com/errata/RHSA-2018:3731
- https://access.redhat.com/errata/RHSA-2019:2028
- https://access.redhat.com/errata/RHSA-2020:0542
- https://access.redhat.com/errata/RHSA-2020:0591
- https://access.redhat.com/errata/RHSA-2020:0663
- https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099Patch, Third Party Advisory
- https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://usn.ubuntu.com/3621-1/
- https://www.debian.org/security/2018/dsa-4219
- https://www.debian.org/security/2018/dsa-4259
- http://blog.rubygems.org/2018/02/15/2.7.6-released.htmlVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
- https://access.redhat.com/errata/RHSA-2018:3729
- https://access.redhat.com/errata/RHSA-2018:3730
- https://access.redhat.com/errata/RHSA-2018:3731
- https://access.redhat.com/errata/RHSA-2019:2028
- https://access.redhat.com/errata/RHSA-2020:0542
- https://access.redhat.com/errata/RHSA-2020:0591
- https://access.redhat.com/errata/RHSA-2020:0663
- https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099Patch, Third Party Advisory
- https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://usn.ubuntu.com/3621-1/
- https://www.debian.org/security/2018/dsa-4219
- https://www.debian.org/security/2018/dsa-4259
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.