Debian: DLA-1796-1 Moderate: Jruby Code Execution and XSS Issues

debian lts

May 20, 2019

Multiple vulnerabilities have been discovered in jruby, Java implementation of the Ruby programming language

Topics Covered

security advisory code execution XSS debian input validation infinite loop jruby

Summary

CVE-2018-1000074

Deserialization of Untrusted Data vulnerability in owner command
that can result in code execution. This attack appear to be
exploitable via victim must run the `gem owner` command on a gem
with a specially crafted YAML file

CVE-2018-1000075

an infinite loop caused by negative size vulnerability in ruby gem
package tar header that can result in a negative size could cause an
infinite loop

CVE-2018-1000076

Improper Verification of Cryptographic Signature vulnerability in
package.rb that can result in a mis-signed gem could be installed,
as the tarball would contain multiple gem signatures.

CVE-2018-1000077

Improper Input Validation vulnerability in ruby gems specification
homepage attribute that can result in a malicious gem could set an
invalid homepage URL

CVE-2018-1000078

Cross Site Scripting (XSS) vulnerability in gem server display of
homepage attribute that can result in XSS. This attack appear to be