CVE-2018-1000073 json
RubyGems Link Following vulnerability
published 2018-03-13 8 y ago modified 2026-06-17 4 mo ago also GHSA-gx69-6cp4-hxrj , EUVD-2022-4029
- cvss
- 7.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.9%
- EPSS 4.9% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.
Patch / fix
- rubygems rubygems-update 2.7.6
- maven org.jruby:jruby-stdlib 9.1.16.0
- jruby Debian 14, Debian 13, Debian 12 9.1.17.0-2.1
- rubygems Debian 14, Debian 13, Debian 12 3.2.0~rc.1-1
debian advisories DEBIAN-CVE-2018-1000073
- ruby2.0 Ubuntu 14.04 LTS 2.0.0.484-1ubuntu2.6
- ruby2.3 Ubuntu 16.04 LTS 2.3.1-2~16.04.7
ubuntu advisories UBUNTU-CVE-2018-1000073
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- ruby RHEL 7 2.0.0.648-36.el7
- ruby-irb RHEL 7 2.0.0.648-36.el7
- rubygems RHEL 7 2.0.14.1-36.el7
- ruby-libs RHEL 7 2.0.0.648-36.el7
- ruby-tcltk RHEL 7 2.0.0.648-36.el7
- rubygem-json RHEL 7 1.7.7-36.el7
- rubygem-rake RHEL 7 0.9.6-36.el7
- rubygem-rdoc RHEL 7 4.0.0-36.el7
red hat advisories RHSA-2020:0663RHSA-2020:0591RHSA-2020:0542RHSA-2019:2028RHSA-2018:3729RHSA-2018:3730
- ruby2.1 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +14 more 2.1.9-19.3.2
- yast2-ruby-bindings SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +1 more 3.1.53-9.8.1
- ruby2.5 SLE Module for Basesystem 15 SP1, SLE Module for Basesystem 15 2.5.5-4.3.1
suse advisories SUSE-SU-2020:1570-1SUSE-SU-2019:1804-1
- ruby2.5 openSUSE Leap 15.1, openSUSE Leap 15.0 2.5.5-lp151.4.3.1
- ruby-bundled-gems-rpmhelper openSUSE Leap 15.1, openSUSE Leap 15.0 0.0.2-lp151.2.1
opensuse advisories openSUSE-SU-2019:1771-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2018-1000073 updated cvss 5.5
rubygems: Path traversal when writing to a symlinked basedir outside of the root
-
Red Hat Enterprise Linux 6 rubygems Red Hat Enterprise MRG 2 rubygems Red Hat Fuse 7 jruby jruby Red Hat JBoss A-MQ 6 jruby-3977 jruby-3977, jruby-4198 jruby-4198affected: no fix planned “Will not fix”
-
Red Hat JBoss Enterprise Application Platform 5 jruby jrubyaffected: no fix planned “Out of support scope”
-
Red Hat JBoss Fuse 6 jruby-3977 jruby-3977, jruby-4198 jruby-4198affected: no fix planned “Will not fix”
-
Red Hat JBoss Fuse Service Works 6 jruby jrubyaffected: no fix planned “Out of support scope”
-
Red Hat Satellite 6 rubygems Red Hat Subscription Asset Manager ruby193-rubygemsaffected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux Client (v. 7) ruby 2.0.0.648-36.el7, rubygems 2.0.14.1-36.el7, ruby-irb 2.0.0.648-36.el7, rubygem-json 1.7.7-36.el7, rubygem-rdoc 4.0.0-36.el7, ruby-libs 2.0.0.648-36.el7, +3 more Red Hat Enterprise Linux Client Optional (v. 7) rubygem-rake 0.9.6-36.el7, ruby-tcltk 2.0.0.648-36.el7, rubygem-minitest 4.3.2-36.el7 Red Hat Enterprise Linux ComputeNode (v. 7) ruby 2.0.0.648-36.el7, rubygems 2.0.14.1-36.el7, ruby-irb 2.0.0.648-36.el7, rubygem-json 1.7.7-36.el7, rubygem-rdoc 4.0.0-36.el7, ruby-libs 2.0.0.648-36.el7, +3 morefixed: vendor fix RHSA-2019:2028
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) ruby 2.0.0.648-35.el7_5, rubygems 2.0.14.1-35.el7_5, ruby-irb 2.0.0.648-35.el7_5, rubygem-json 1.7.7-35.el7_5, rubygem-rdoc 4.0.0-35.el7_5, ruby-libs 2.0.0.648-35.el7_5, +3 morefixed: vendor fix RHSA-2020:0542
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) ruby 2.0.0.648-36.el7_6, rubygems 2.0.14.1-36.el7_6, ruby-irb 2.0.0.648-36.el7_6, rubygem-json 1.7.7-36.el7_6, rubygem-rdoc 4.0.0-36.el7_6, ruby-libs 2.0.0.648-36.el7_6, +3 morefixed: vendor fix RHSA-2020:0663
show 14 moreshow fewer
-
Red Hat Enterprise Linux ComputeNode Optional (v. 7) rubygem-rake 0.9.6-36.el7, ruby-tcltk 2.0.0.648-36.el7, rubygem-minitest 4.3.2-36.el7fixed: vendor fix RHSA-2019:2028
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) rubygem-rake 0.9.6-35.el7_5, ruby-tcltk 2.0.0.648-35.el7_5, rubygem-minitest 4.3.2-35.el7_5fixed: vendor fix RHSA-2020:0542
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) rubygem-rake 0.9.6-36.el7_6, ruby-tcltk 2.0.0.648-36.el7_6, rubygem-minitest 4.3.2-36.el7_6 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) ruby 2.0.0.648-36.el7_6, rubygems 2.0.14.1-36.el7_6, ruby-irb 2.0.0.648-36.el7_6, rubygem-json 1.7.7-36.el7_6, rubygem-rdoc 4.0.0-36.el7_6, ruby-libs 2.0.0.648-36.el7_6, +3 more Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) rubygem-rake 0.9.6-36.el7_6, ruby-tcltk 2.0.0.648-36.el7_6, rubygem-minitest 4.3.2-36.el7_6fixed: vendor fix RHSA-2020:0663
-
Red Hat Enterprise Linux Server (v. 7) ruby 2.0.0.648-36.el7, rubygems 2.0.14.1-36.el7, ruby-irb 2.0.0.648-36.el7, rubygem-json 1.7.7-36.el7, rubygem-rdoc 4.0.0-36.el7, ruby-libs 2.0.0.648-36.el7, +3 morefixed: vendor fix RHSA-2019:2028
-
Red Hat Enterprise Linux Server AUS (v. 7.4) ruby 2.0.0.648-35.el7_4, rubygems 2.0.14.1-35.el7_4, ruby-irb 2.0.0.648-35.el7_4, rubygem-json 1.7.7-35.el7_4, rubygem-rdoc 4.0.0-35.el7_4, ruby-libs 2.0.0.648-35.el7_4, +3 more Red Hat Enterprise Linux Server E4S (v. 7.4) ruby 2.0.0.648-35.el7_4, rubygems 2.0.14.1-35.el7_4, ruby-irb 2.0.0.648-35.el7_4, rubygem-json 1.7.7-35.el7_4, rubygem-rdoc 4.0.0-35.el7_4, ruby-libs 2.0.0.648-35.el7_4, +3 morefixed: vendor fix RHSA-2020:0591
-
Red Hat Enterprise Linux Server EUS (v. 7.5) ruby 2.0.0.648-35.el7_5, rubygems 2.0.14.1-35.el7_5, ruby-irb 2.0.0.648-35.el7_5, rubygem-json 1.7.7-35.el7_5, rubygem-rdoc 4.0.0-35.el7_5, ruby-libs 2.0.0.648-35.el7_5, +3 morefixed: vendor fix RHSA-2020:0542
-
Red Hat Enterprise Linux Server EUS (v. 7.6) ruby 2.0.0.648-36.el7_6, rubygems 2.0.14.1-36.el7_6, ruby-irb 2.0.0.648-36.el7_6, rubygem-json 1.7.7-36.el7_6, rubygem-rdoc 4.0.0-36.el7_6, ruby-libs 2.0.0.648-36.el7_6, +3 morefixed: vendor fix RHSA-2020:0663
-
Red Hat Enterprise Linux Server Optional (v. 7) rubygem-rake 0.9.6-36.el7, ruby-tcltk 2.0.0.648-36.el7, rubygem-minitest 4.3.2-36.el7fixed: vendor fix RHSA-2019:2028
-
Red Hat Enterprise Linux Server Optional AUS (v. 7.4) rubygem-rake 0.9.6-35.el7_4, ruby-tcltk 2.0.0.648-35.el7_4, rubygem-minitest 4.3.2-35.el7_4 Red Hat Enterprise Linux Server Optional E4S (v. 7.4) rubygem-rake 0.9.6-35.el7_4, ruby-tcltk 2.0.0.648-35.el7_4, rubygem-minitest 4.3.2-35.el7_4fixed: vendor fix RHSA-2020:0591
-
Red Hat Enterprise Linux Server Optional EUS (v. 7.5) rubygem-rake 0.9.6-35.el7_5, ruby-tcltk 2.0.0.648-35.el7_5, rubygem-minitest 4.3.2-35.el7_5fixed: vendor fix RHSA-2020:0542
-
Red Hat Enterprise Linux Server Optional EUS (v. 7.6) rubygem-rake 0.9.6-36.el7_6, ruby-tcltk 2.0.0.648-36.el7_6, rubygem-minitest 4.3.2-36.el7_6fixed: vendor fix RHSA-2020:0663
-
Red Hat Enterprise Linux Server Optional TUS (v. 7.4) rubygem-rake 0.9.6-35.el7_4, ruby-tcltk 2.0.0.648-35.el7_4, rubygem-minitest 4.3.2-35.el7_4 Red Hat Enterprise Linux Server TUS (v. 7.4) ruby 2.0.0.648-35.el7_4, rubygems 2.0.14.1-35.el7_4, ruby-irb 2.0.0.648-35.el7_4, rubygem-json 1.7.7-35.el7_4, rubygem-rdoc 4.0.0-35.el7_4, ruby-libs 2.0.0.648-35.el7_4, +3 morefixed: vendor fix RHSA-2020:0591
-
Red Hat Enterprise Linux Workstation (v. 7) ruby 2.0.0.648-36.el7, rubygems 2.0.14.1-36.el7, ruby-irb 2.0.0.648-36.el7, rubygem-json 1.7.7-36.el7, rubygem-rdoc 4.0.0-36.el7, ruby-libs 2.0.0.648-36.el7, +3 more Red Hat Enterprise Linux Workstation Optional (v. 7) rubygem-rake 0.9.6-36.el7, ruby-tcltk 2.0.0.648-36.el7, rubygem-minitest 4.3.2-36.el7fixed: vendor fix RHSA-2019:2028
-
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-ruby23-ruby 2.3.8-69.el6, rh-ruby24-ruby 2.4.5-91.el6, rh-ruby23-ruby-irb 2.3.8-69.el6, rh-ruby24-ruby-irb 2.4.5-91.el6, rh-ruby23-ruby-libs 2.3.8-69.el6, rh-ruby24-ruby-libs 2.4.5-91.el6, +27 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ruby25-ruby 2.5.3-6.el7, rh-ruby23-ruby 2.3.8-69.el7, rh-ruby24-ruby 2.4.5-91.el7, rh-ruby25-ruby-irb 2.5.3-6.el7, rh-ruby25-rubygems 2.7.6-6.el7, rh-ruby23-ruby-irb 2.3.8-69.el7, +44 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-ruby25-ruby 2.5.3-6.el7, rh-ruby23-ruby 2.3.8-69.el7, rh-ruby24-ruby 2.4.5-91.el7, rh-ruby25-ruby-irb 2.5.3-6.el7, rh-ruby25-rubygems 2.7.6-6.el7, rh-ruby23-ruby-irb 2.3.8-69.el7, +44 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-ruby25-ruby 2.5.3-6.el7, rh-ruby23-ruby 2.3.8-69.el7, rh-ruby24-ruby 2.4.5-91.el7, rh-ruby25-ruby-irb 2.5.3-6.el7, rh-ruby25-rubygems 2.7.6-6.el7, rh-ruby23-ruby-irb 2.3.8-69.el7, +44 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-ruby25-ruby 2.5.3-6.el7, rh-ruby23-ruby 2.3.8-69.el7, rh-ruby24-ruby 2.4.5-91.el7, rh-ruby25-ruby-irb 2.5.3-6.el7, rh-ruby25-rubygems 2.7.6-6.el7, rh-ruby23-ruby-irb 2.3.8-69.el7, +44 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-ruby23-ruby 2.3.8-69.el6, rh-ruby24-ruby 2.4.5-91.el6, rh-ruby23-ruby-irb 2.3.8-69.el6, rh-ruby24-ruby-irb 2.4.5-91.el6, rh-ruby23-ruby-libs 2.3.8-69.el6, rh-ruby24-ruby-libs 2.4.5-91.el6, +27 morefixed: vendor fix RHSA-2018:3729
+1 more productsfewer
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ruby25-ruby 2.5.3-6.el7, rh-ruby23-ruby 2.3.8-69.el7, rh-ruby24-ruby 2.4.5-91.el7, rh-ruby25-ruby-irb 2.5.3-6.el7, rh-ruby25-rubygems 2.7.6-6.el7, rh-ruby23-ruby-irb 2.3.8-69.el7, +44 more
1 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
4.91% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | rubygems-update | <2.7.6 |
2.7.6 |
| maven | org.jruby:jruby-stdlib | <9.1.16.0 |
9.1.16.0 |
Classification
- Weakness
-
- CWE-59 Improper Link Resolution Before File Access
References
-
github.com
/rubygems/rubygems/commit/1b931fc03b819b9a0214be3eaca844ef534175e2
web, patch, third-party-advisory
-
github.com
/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7
web
-
debian.org
/security/2018/dsa-4219
vendor-advisory, web
-
usn.ubuntu.com
/3621-1/
vendor-advisory
-
access.redhat.com
/errata/RHSA-2018:3729
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2018:3730
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2018:3731
vendor-advisory, web
-
debian.org
/security/2018/dsa-4259
vendor-advisory, web
-
lists.opensuse.org
/opensuse-security-announce/2019-07/msg00036.html
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2019:2028
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2020:0542
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2020:0591
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2020:0663
vendor-advisory, web
-
blog.rubygems.org
/2018/02/15/2.7.6-released.html
web, vendor-advisory
-
lists.debian.org
/debian-lts-announce/2018/08/msg00028.html
mailing-list, web
-
nvd.nist.gov
/vuln/detail/CVE-2018-1000073
advisory
-
usn.ubuntu.com
/3621-1
web
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2018-1000073.yml
web
-
github.com
/rubygems/rubygems
package
-
bugs.debian.org
/cgi-bin/bugreport.cgi?bug=925986
web
Sources
- CVE List CVE-2018-1000073
- GitHub Advisory GHSA-gx69-6cp4-hxrj
- NVD CVE-2018-1000073
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.