CVE-2018-1000076

CRITICAL

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.

Published: Mar 13, 2018 Modified: Jun 17, 2026

CWE-347

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (5)

Vendor	Product	Version
rubygems	rubygems	*
rubygems	rubygems	*
rubygems	rubygems	*
rubygems	rubygems	*
debian	debian_linux	7.0

GitHub Security Advisory GHSA-mc6j-h948-v2p6

RubyGems Improper Verification of Cryptographic Signature vulnerability

rubygems rubygems-update >= 2.2.0, < 2.7.6 Fixed: 2.7.6

maven org.jruby:jruby-stdlib < 9.1.16.0 Fixed: 9.1.16.0

References (36)

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 2.99%

Top 14% most likely to be exploited

Threat Score 40.1 / 100

Data Sources

NVD EPSS GitHub