3 ms·

Is there a more detailed description of the vulnerabilities somewhere?

• kichik 9y ago
  I think these are the commits, but not all of them contain a detailed description. https://github.com/rubygems/rubygems/commit/8d91516fb7037ecfb27622f605dc40245e0f8d32 https://github.com/rubygems/rubygems/commit/8d91516fb7037ecf... https://github.com/rubygems/rubygems/commit/8a38a4fc24c6591e6c8f43d1fadab6efeb4d6251 https://github.com/rubygems/rubygems/commit/8a38a4fc24c6591e... https://github.com/rubygems/rubygems/commit/44cc27cd6123b8eaafbcec5c8fe0dd0bc01d2a95 https://github.com/rubygems/rubygems/commit/44cc27cd6123b8ea... https://github.com/rubygems/rubygems/commit/ad5c0a53a86ca5b218c7976765c0365b91d22cb2 https://github.com/rubygems/rubygems/commit/ad5c0a53a86ca5b2...
  • arkadiyt 9y ago
    The last 2 commits you listed are actually both for the arbitrary file write issue, and there was a 5th commit for the ANSI issue: https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491 https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54... I went through all 4 issues and did a brief writeup for each of them. Only the first 2 issues are serious (and worth upgrading for). The last 2 issues are not really a big deal at all. 1) "a DNS request hijacking vulnerability" Rubygems supports a gem server discovery mechanism, where if you set your gem source as 'https://example.com' https://example.com', the gem client will do a SRV dns lookup on "_rubygems._tcp.example.com" to determine where it should send requests to. A MITM can intercept that dns request and return whatever server they want, forcing the gem client to download code from a malicious server. Fixed by: https://github.com/rubygems/rubygems/commit/8d91516fb7037ecfb27622f605dc40245e0f8d32 https://github.com/rubygems/rubygems/commit/8d91516fb7037ecf... Now the returned DNS record must be for a subdomain of the gem source (in this case it must point to a subdomain of "example.com"). 2) "a vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files" Gem contents could be unpacked in arbitrary file locations by setting the gem name to include file traversal characters like "../". Fixed by: https://github.com/rubygems/rubygems/commit/44cc27cd6123b8eaafbcec5c8fe0dd0bc01d2a95 https://github.com/rubygems/rubygems/commit/44cc27cd6123b8ea... https://github.com/rubygems/rubygems/commit/ad5c0a53a86ca5b218c7976765c0365b91d22cb2 https://github.com/rubygems/rubygems/commit/ad5c0a53a86ca5b2... Now gem names can only contain letters, numbers, underscore (_), dash (-), and dot (.). 3) "an ANSI escape sequence vulnerability" Text specified in a gemspec can be output on installation or displayed when showing information about the gem. Gem authors can inject terminal escape sequences into (for instance) the authors field of the gem, and this will mess with end users' terminals. Fixed by: https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491 https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54... Now ANSI control characters are scrubbed out of text fields. 4) "a DoS vulernerability in the query command" If someone provided an extremely large gem summary, rubygems would hang trying to process it. Fixed by: https://github.com/rubygems/rubygems/commit/8a38a4fc24c6591e6c8f43d1fadab6efeb4d6251 https://github.com/rubygems/rubygems/commit/8a38a4fc24c6591e... Now the summary is truncated to 100,000 characters. I'm a little surprised this was even triaged as a vulnerability.