CVE-2018-1000074: High severity Rubygems RubyGems vulnerability
Last updated 18 August 2025
Other sources
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the gem owner command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6.
— Launchpad
Unsafe object deserialization vulnerability in owner command was found allowing arbitrary code execution when gem owner is run on specially crafted YAML file.
Upstream fix:
https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d
External References:
https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000074?
The severity of CVE-2018-1000074 is medium with a severity value of 4.
Which versions of RubyGems are affected by CVE-2018-1000074?
RubyGems versions Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 are affected.
What is the impact of CVE-2018-1000074?
CVE-2018-1000074 allows an attacker to execute arbitrary code.
How can I fix CVE-2018-1000074?
To fix CVE-2018-1000074, update RubyGems to version 2.7.6 or newer.
Where can I find more information about CVE-2018-1000074?
You can find more information about CVE-2018-1000074 at the following references: [http://blog.rubygems.org/2018/02/15/2.7.6-released.html](http://blog.rubygems.org/2018/02/15/2.7.6-released.html), [https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d](https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d), [https://usn.ubuntu.com/3621-1/](https://usn.ubuntu.com/3621-1/).