Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-1000052 State: PUBLISHED Published: 2018-02-09T23:00:00 Last Updated: 2024-08-05T12:33:48.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: fmtlib version prior to version 4.1.0 (before commit 0555cea5fc0bf890afe0071a558e44625a34ba85) contains a Memory corruption (SIGSEGV), CWE-134 vulnerability in fmt::print() library function that can result in Denial of Service. This attack appear to be exploitable via Specifying an invalid format specifier in the fmt::print() function results in a SIGSEGV (memory corruption, invalid write). This vulnerability appears to have been fixed in after commit 8cf30aa2be256eba07bb1cefb998c52326e846e7. Additional Analyst Notes: - CVE
ity appears to have been fixed in after commit 8cf30aa2be256eba07bb1cefb998c52326e846e7. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fmtlib/fmt/commit/8cf30aa2be256eba07bb1cefb998c52326e846e7 - https://github.com/fmtlib/fmt/issues/642
CVE ID: CVE-2018-1000053 State: PUBLISHED Published: 2018-02-09T23:00:00 Last Updated: 2024-08-05T12:33:48.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Theme Uninstallation that can result in CSRF causing LimeSurvey admins to delete all their themes, rendering the website unusable. This attack appear to be exploitable via Simple HTML markup can be used to send a GET request to the affected endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LimeSurvey/LimeSurvey/commit/1e440208a8d8bfd71ad7802e6369a136e8bba3dd
CVE ID: CVE-2018-1000054 State: PUBLISHED Published: 2018-02-09T23:00:00 Last Updated: 2024-08-05T12:33:48.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-05/
CVE ID: CVE-2018-1000055 State: PUBLISHED Published: 2018-02-09T23:00:00 Last Updated: 2024-08-05T12:33:48.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-05/
CVE ID: CVE-2018-1000056 State: PUBLISHED Published: 2018-02-09T23:00:00 Last Updated: 2024-08-05T12:33:49.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-05/
CVE ID: CVE-2018-1000057 State: PUBLISHED Published: 2018-02-09T23:00:00 Last Updated: 2024-08-05T12:33:48.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided password values, e.g. replacing environment variable references, which could result in values different from but similar to configured passwords being provided to the build. Those values are not subject to masking, and could allow unauthorized users to recover the original password. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/secur
recover the original password. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-05/
CVE ID: CVE-2018-1000058 State: PUBLISHED Published: 2018-02-09T23:00:00 Last Updated: 2024-08-05T12:33:49.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java deserialization like readResolve implemented in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles. Additional Analyst Notes: - CVE Program Container: R
, or by trusted committers to repositories containing Jenkinsfiles. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-05/ - http://www.securityfocus.com/bid/103034
CVE ID: CVE-2018-1000059 State: PUBLISHED Published: 2018-02-09T23:00:00Z Last Updated: 2024-09-17T04:19:05.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: ValidFormBuilder version 4.5.4 contains a PHP Object Injection vulnerability in Valid Form unserialize method that can result in Possible to execute unauthorised system commands remotely and disclose file contents in file system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/validformbuilder/validformbuilder/issues/126
CVE ID: CVE-2018-1000060 State: PUBLISHED Published: 2018-02-09T23:00:00 Last Updated: 2024-08-05T12:33:49.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redact_sensitive() that can result in sensitive configuration data (e.g. passwords) may be logged in clear-text. This attack appear to be exploitable via victims with configuration matching a specific pattern will observe sensitive data outputted in their service log files. This vulnerability appears to have been fixed in 1.2.1 and later, after commit 46ff10023e8cbf1b69788
service log files. This vulnerability appears to have been fixed in 1.2.1 and later, after commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sensu/sensu/pull/1810 - https://access.redhat.com/errata/RHSA-2018:0616 - https://github.com/sensu/sensu/issues/1804 - https://access.redhat.com/errata/RHSA-2018:1606 - https://access.redhat.com/errata/RHSA-2018:1112
CVE ID: CVE-2018-1000061 State: REJECTED Published: 2018-02-09T23:00:00 Last Updated: 2019-03-25T20:22:27 Description: No description available.
CVE ID: CVE-2018-1000062 State: PUBLISHED Published: 2018-02-09T23:00:00Z Last Updated: 2024-09-17T01:52:01.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction(), 'svg' => 'image/svg+xml' that can result in An attacker can execute arbitrary script on an unsuspecting user's browser. This attack appear to be exploitable via Crafted SVG File. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/robiso/wondercms/issues/56 - https://github.com/robiso/wondercms/blob/ea640a02b4b8d88835d2e01600d24b23176fb665/index.php#L737
CVE ID: CVE-2018-1000063 State: REJECTED Published: 2018-02-16T14:00:00 Last Updated: 2018-02-16T13:57:01 Description: No description available.
CVE ID: CVE-2018-1000064 State: REJECTED Published: 2018-02-16T14:00:00 Last Updated: 2018-02-16T13:57:01 Description: No description available.
CVE ID: CVE-2018-1000065 State: REJECTED Published: 2018-02-16T14:00:00 Last Updated: 2018-02-16T13:57:01 Description: No description available.
CVE ID: CVE-2018-1000066 State: REJECTED Published: 2018-02-16T14:00:00 Last Updated: 2018-02-16T13:57:01 Description: No description available.
CVE ID: CVE-2018-1000067 State: PUBLISHED Published: 2018-02-16T00:00:00 Last Updated: 2024-08-05T12:33:48.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuapr2022.html - https://jenkins.io/security/advisory/2018-02-14/#SECURITY-506
CVE ID: CVE-2018-1000068 State: PUBLISHED Published: 2018-02-16T00:00:00 Last Updated: 2024-08-05T12:33:49.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitive file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103101 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://jenkins.io/security/advisory/2018-02-14/#SECU
/103101 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://jenkins.io/security/advisory/2018-02-14/#SECURITY-717
CVE ID: CVE-2018-1000069 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/03/msg00019.html - https://www.debian.org/security/2018/dsa-4175 - https://www.youtube.com/watch?v=
an-lts-announce/2018/03/msg00019.html - https://www.debian.org/security/2018/dsa-4175 - https://www.youtube.com/watch?v=7IXtiTNilAI - https://www.freeplane.org/wiki/index.php/XML_External_Entity_vulnerability_in_map_parser
CVE ID: CVE-2018-1000070 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:48.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitmessage PyBitmessage version v0.6.2 (and introduced in or after commit 8ce72d8d2d25973b7064b1cf76a6b0b3d62f0ba0) contains a Eval injection vulnerability in main program, file src/messagetypes/__init__.py function constructObject that can result in Code Execution. This attack appears to be exploitable via remote attacker using a malformed message which must be processed by the victim - e.g. arrive from any sender on bitmessage network. This vulnerability appears to have been fixed in v0.6.3. Additional Analyst Notes: - CV
ny sender on bitmessage network. This vulnerability appears to have been fixed in v0.6.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Bitmessage/PyBitmessage/commit/3a8016d31f517775d226aa8b902480f4a3a148a9#comments
CVE ID: CVE-2018-1000071 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References: - https://www.legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt - https://github.com/roundcube/roundcubemail/issues/6173
CVE ID: CVE-2018-1000072 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in Beta: 0.9.8-BETA1, Stable: 0.9.7. Additional Analyst Notes: - CVE Program Container: References: - http://legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt - https://bitb
gram Container: References: - http://legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt - https://bitbucket.org/zhb/iredmail/issues/130/multiple-security-issues-with-default
CVE ID: CVE-2018-1000073 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/d
fixed in 2.7.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4219 - https://usn.ubuntu.com/3621-1/ - https://access.redhat.com/errata/RHSA-2018:3729 - https://access.redhat.com/errata/RHSA-2018:3730 - https://access.redhat.com/errata/RHSA-2018:3731 - https://github.com/rubygems/rubygems/commit/1b931fc03b819b9a0214be3eaca844ef534175e2 - https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html - https://www.debian.org/security/2018/dsa-4259 - http://blog.rubygems.org/2018/02/15/2.7.6-released.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://access.redhat.com/errata/RHSA-2019:2028
//lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://access.redhat.com/errata/RHSA-2019:2028 - https://access.redhat.com/errata/RHSA-2020:0542 - https://access.redhat.com/errata/RHSA-2020:0591 - https://access.redhat.com/errata/RHSA-2020:0663
CVE ID: CVE-2018-1000074 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6. Additional Analyst Notes: - CVE Program Conta
crafted YAML file. This vulnerability appears to have been fixed in 2.7.6. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3685-1/ - https://usn.ubuntu.com/3621-2/ - https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d - https://lists.debian.org/debian-lts-announce/2018/04/msg00017.html - https://www.debian.org/security/2018/dsa-4219 - https://usn.ubuntu.com/3621-1/ - https://access.redhat.com/errata/RHSA-2018:3729 - https://access.redhat.com/errata/RHSA-2018:3730 - https://access.redhat.com/errata/RHSA-2018:3731 - https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html - https://www.debian.org/security/2018/d
-2018:3731 - https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html - https://www.debian.org/security/2018/dsa-4259 - http://blog.rubygems.org/2018/02/15/2.7.6-released.html - https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://access.redhat.com/errata/RHSA-2019:2028 - https://access.redhat.com/errata/RHSA-2020:0542 - https://access.redhat.com/errata/RHSA-2020:0591 - https://access.redhat.com/errata/RHSA-2020:0663
CVE ID: CVE-2018-1000075 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4219 - https://u
ditional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4219 - https://usn.ubuntu.com/3621-1/ - https://access.redhat.com/errata/RHSA-2018:3729 - https://github.com/rubygems/rubygems/commit/92e98bf8f810bd812f919120d4832df51bc25d83 - https://access.redhat.com/errata/RHSA-2018:3730 - https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html - https://access.redhat.com/errata/RHSA-2018:3731 - https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html - https://www.debian.org/security/2018/dsa-4259 - http://blog.rubygems.org/2018/02/15/2.7.6-released.html - https:
.html - https://www.debian.org/security/2018/dsa-4259 - http://blog.rubygems.org/2018/02/15/2.7.6-released.html - https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html - https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://access.redhat.com/errata/RHSA-2019:2028 - https://access.redhat.com/errata/RHSA-2020:0542 - https://access.redhat.com/errata/RHSA-2020:0591 - https://access.redhat.com/errata/RHSA-2020:0663
CVE ID: CVE-2018-1000076 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian
appears to have been fixed in 2.7.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4219 - https://usn.ubuntu.com/3621-1/ - https://access.redhat.com/errata/RHSA-2018:3729 - https://access.redhat.com/errata/RHSA-2018:3730 - https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html - https://access.redhat.com/errata/RHSA-2018:3731 - https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html - https://www.debian.org/security/2018/dsa-4259 - http://blog.rubygems.org/2018/02/15/2.7.6-released.html - https://github.com/rubygems/rubygems/commit/f5042b8792
-4259 - http://blog.rubygems.org/2018/02/15/2.7.6-released.html - https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693 - https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html - https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://access.redhat.com/errata/RHSA-2019:2028 - https://access.redhat.com/errata/RHSA-2020:0542 - https://access.redhat.com/errata/RHSA-2020:0591 - https://access.redhat.com/errata/RHSA-2020:0663
CVE ID: CVE-2018-1000077 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4219 - ht
7.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4219 - https://usn.ubuntu.com/3621-1/ - https://access.redhat.com/errata/RHSA-2018:3729 - https://access.redhat.com/errata/RHSA-2018:3730 - https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html - https://access.redhat.com/errata/RHSA-2018:3731 - https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html - https://www.debian.org/security/2018/dsa-4259 - https://github.com/rubygems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964 - http://blog.rubygems.org/2018/02/15/2.7.6-released.html -
ems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964 - http://blog.rubygems.org/2018/02/15/2.7.6-released.html - https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html - https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://access.redhat.com/errata/RHSA-2019:2028 - https://access.redhat.com/errata/RHSA-2020:0542 - https://access.redhat.com/errata/RHSA-2020:0591 - https://access.redhat.com/errata/RHSA-2020:0663
CVE ID: CVE-2018-1000078 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6. Additional Analyst Notes: - CVE Program Container:
gem server. This vulnerability appears to have been fixed in 2.7.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4219 - https://usn.ubuntu.com/3621-1/ - https://access.redhat.com/errata/RHSA-2018:3729 - https://access.redhat.com/errata/RHSA-2018:3730 - https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html - https://access.redhat.com/errata/RHSA-2018:3731 - https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html - https://www.debian.org/security/2018/dsa-4259 - http://blog.rubygems.org/2018/02/15/2.7.6-released.html - https://github.com/rub
www.debian.org/security/2018/dsa-4259 - http://blog.rubygems.org/2018/02/15/2.7.6-released.html - https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb - https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html - https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://access.redhat.com/errata/RHSA-2019:2028 - https://access.redhat.com/errata/RHSA-2020:0542 - https://access.redhat.com/errata/RHSA-2020:0591 - https://access.redhat.com/errata/RHSA-2020:0663