CVE-2018-1000076

GHSA-mc6j-h948-v2p6, CVE-2018-1000076

maven/org.jruby/jruby-stdlib

Improper Verification of Cryptographic Signature

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.

All versions before 9.1.16.0

Upgrade to version 9.1.16.0 or above.

2023-03-09