Description
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.
Remediation
References
Related Vulnerabilities
ownCloud Improper Access Control Vulnerability (CVE-2016-9467)
Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-3370)
MySQL CVE-2022-21632 Vulnerability (CVE-2022-21632)
Drupal Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2009-2372)
WordPress Plugin PictoBrowser Cross-Site Request Forgery (0.3.1)