rubygems-update (RubyGems)
Advisories
41
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.0.3 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update rubygems-update # Gemfile: gem "rubygems-update", ">= 3.0.3"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-228f-g3h7-3fj3 RubyGems HTTPS to HTTP redirect |
Medium EPSS 2.47% |
< 1.8.23 | 1.8.23 |
| GHSA-5mgj-mvv8-46mw RubyGems does not verify SSL certificate |
Medium EPSS 1.36% |
< 1.8.23 | 1.8.23 |
| GHSA-qv62-xfj6-32xm RubyGems Improper Input Validation vulnerability |
Medium EPSS 3.46% |
>= 2.1.0.rc.1, < 2.2.5 | 2.2.5 |
| GHSA-9qvm-2vhf-q649 RubyGems Regular Expression Denial of Service |
Medium EPSS 1.69% |
>= 1.8.24, < 1.8.27 | 1.8.27 |
| GHSA-qv62-xfj6-32xm RubyGems Improper Input Validation vulnerability |
Medium EPSS 3.46% |
>= 2.3.0, < 2.4.8 | 2.4.8 |
| GHSA-qv62-xfj6-32xm RubyGems Improper Input Validation vulnerability |
Medium EPSS 3.46% |
< 2.0.17 | 2.0.17 |
| GHSA-9qvm-2vhf-q649 RubyGems Regular Expression Denial of Service |
Medium EPSS 1.69% |
>= 2.1.0, < 2.1.5 | 2.1.5 |
| GHSA-9qvm-2vhf-q649 RubyGems Regular Expression Denial of Service |
Medium EPSS 1.69% |
< 1.8.23.2 | 1.8.23.2 |
| GHSA-9qvm-2vhf-q649 RubyGems Regular Expression Denial of Service |
Medium EPSS 1.69% |
>= 2.0.0, < 2.0.10 | 2.0.10 |
| GHSA-8qxg-mff5-j3wc RubyGems Path Traversal vulnerability |
Medium EPSS 2.78% |
< 2.7.6 | 2.7.6 |
| GHSA-wp3j-rvfp-624h RubyGems vulnerable to DNS hijack attack |
High EPSS 8.87% |
>= 2.0.0, < 2.0.16 | 2.0.16 |
| GHSA-wp3j-rvfp-624h RubyGems vulnerable to DNS hijack attack |
High EPSS 8.87% |
>= 2.2.0, < 2.2.4 | 2.2.4 |
| GHSA-wp3j-rvfp-624h RubyGems vulnerable to DNS hijack attack |
High EPSS 8.87% |
>= 2.4.0, < 2.4.7 | 2.4.7 |
| GHSA-9j7m-rjqx-48vh RubyGems Regular Expression Denial of Service vulnerability |
Medium EPSS 3.33% |
< 1.8.23.1 | 1.8.23.1 |
| GHSA-9j7m-rjqx-48vh RubyGems Regular Expression Denial of Service vulnerability |
Medium EPSS 3.33% |
>= 2.1.0.rc.1, < 2.1.0 | 2.1.0 |
| GHSA-9j7m-rjqx-48vh RubyGems Regular Expression Denial of Service vulnerability |
Medium EPSS 3.33% |
>= 2.0.0, < 2.0.8 | 2.0.8 |
| GHSA-9j7m-rjqx-48vh RubyGems Regular Expression Denial of Service vulnerability |
Medium EPSS 3.33% |
>= 1.8.24, < 1.8.26 | 1.8.26 |
| GHSA-p7f2-rr42-m9xm RubyGems Improper Input Validation vulnerability |
High EPSS 8.49% |
< 2.6.13 | 2.6.13 |
| GHSA-mc6j-h948-v2p6 RubyGems Improper Verification of Cryptographic Signature vulnerability |
Critical EPSS 2.93% |
>= 2.2.0, < 2.7.6 | 2.7.6 |
| GHSA-qj2w-mw2r-pv39 RubyGems Deserialization of Untrusted Data vulnerability |
High EPSS 2.88% |
< 2.7.6 | 2.7.6 |
| GHSA-87qx-g5wg-mwmj RubyGems Cross-site Scripting vulnerability |
Medium EPSS 2.75% |
< 2.7.6 | 2.7.6 |
| GHSA-gv86-43rv-79m2 RubyGems Improper Input Validation vulnerability |
Medium EPSS 3.60% |
< 2.7.6 | 2.7.6 |
| GHSA-74pv-v9gh-h25p RubyGems Infinite Loop vulnerability |
High EPSS 4.74% |
< 2.7.6 | 2.7.6 |
| GHSA-mqwr-4qf2-2hcv RubyGems vulnerable to Deserialization of Untrusted Data |
Critical EPSS 15.85% |
>= 2.0.0, < 2.6.14 | 2.6.14 |
| GHSA-pm9x-4392-2c2p RubyGems may allow a maliciously crafted gem to overwrite files |
High EPSS 29.44% |
< 2.6.13 | 2.6.13 |
| GHSA-7gcp-2gmq-w3xh RubyGems Code Injection vulnerability |
Critical EPSS 11.10% |
< 2.6.13 | 2.6.13 |
| GHSA-73w7-6w9g-gc8w RubyGems has Origin Validation Error vulnerability |
High EPSS 4.75% |
< 2.6.13 | 2.6.13 |
| GHSA-gx69-6cp4-hxrj RubyGems Link Following vulnerability |
High EPSS 4.91% |
< 2.7.6 | 2.7.6 |
| GHSA-95vx-q4c2-64gr RubyGems file overwrite vulnerability |
Medium EPSS 4.86% |
< 0.9.1 | 0.9.1 |
| GHSA-4wm8-fjv7-j774 RubyGems Escape sequence injection in errors |
High EPSS 3.28% |
>= 2.6.0, < 2.7.9 | 2.7.9 |
| GHSA-4wm8-fjv7-j774 RubyGems Escape sequence injection in errors |
High EPSS 3.28% |
>= 3.0.0, < 3.0.2 | 3.0.2 |
| GHSA-5x32-c9mf-49cc RubyGems Delete directory using symlink when decompressing tar |
High EPSS 4.19% |
>= 2.7.6, < 2.7.9 | 2.7.9 |
| GHSA-5x32-c9mf-49cc RubyGems Delete directory using symlink when decompressing tar |
High EPSS 4.19% |
>= 3.0.0, < 3.0.3 | 3.0.3 |
| GHSA-76wm-422q-92mq Code injection in RubyGems |
High EPSS 3.22% |
>= 2.6.0, < 2.7.9 | 2.7.9 |
| GHSA-76wm-422q-92mq Code injection in RubyGems |
High EPSS 3.22% |
>= 3.0.0, < 3.0.2 | 3.0.2 |
| GHSA-fr32-gr5c-xq5c RubyGems Escape sequence injection vulnerability in verbose |
High EPSS 3.28% |
>= 2.6.0, < 2.7.9 | 2.7.9 |
| GHSA-fr32-gr5c-xq5c RubyGems Escape sequence injection vulnerability in verbose |
High EPSS 3.28% |
>= 3.0.0, < 3.0.2 | 3.0.2 |
| GHSA-mh37-8c3g-3fgc RubyGems Escape sequence injection vulnerability in gem owner |
High EPSS 3.28% |
>= 3.0.0, < 3.0.2 | 3.0.2 |
| GHSA-mh37-8c3g-3fgc RubyGems Escape sequence injection vulnerability in gem owner |
High EPSS 3.28% |
>= 2.6.0, < 2.7.9 | 2.7.9 |
| GHSA-3h4r-pjv6-cph9 RubyGems Escape sequence injection vulnerability in api response handling |
High EPSS 3.28% |
>= 2.6.0, < 2.7.9 | 2.7.9 |
| GHSA-3h4r-pjv6-cph9 RubyGems Escape sequence injection vulnerability in api response handling |
High EPSS 3.28% |
>= 3.0.0, < 3.0.2 | 3.0.2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor