CVE-2023-40165 (rubygems.org) | allinfosecnews.com

Aug. 17, 2023, 6:15 p.m. |

National Vulnerability Database web.nvd.nist.gov

rubygems.org is the Ruby community's primary gem (library) hosting service. Insufficient input validation allowed malicious actors to replace any uploaded gem version that had a platform, version number, or gem name matching `/-\d/`, permanently replacing the legitimate upload in the canonical gem storage bucket, and triggering an immediate CDN purge so that the malicious gem would be served immediately. The maintainers have checked all gems matching the `/-\d/` pattern and can confirm that no unexpected `.gem`s were found. As a …

canonical cdn community cve gem hosting hosting service input input validation library malicious malicious actors name org platform ruby rubygems service storage upload validation version

More from web.nvd.nist.gov / National Vulnerability Database

CVE-2023-45955 (lightstrip_firmware) 5 months, 3 weeks ago | web.nvd.nist.gov

attackers cve denial of service issue +1

CVE-2023-40101 (android) 5 months, 3 weeks ago | web.nvd.nist.gov

android check collapse cve +7

CVE-2023-21377 (android) 5 months, 3 weeks ago | web.nvd.nist.gov

android bypass cve disclosure +8

CVE-2023-21380 (android) 5 months, 3 weeks ago | web.nvd.nist.gov

android bluetooth buffer buffer overflow +9

CVE-2023-21382 (android) 5 months, 3 weeks ago | web.nvd.nist.gov

access android check cve +11

CVE-2023-21381 (android) 5 months, 3 weeks ago | web.nvd.nist.gov

android arbitrary code code code execution +10

CVE-2023-21385 (android) 5 months, 3 weeks ago | web.nvd.nist.gov

android corruption cve disclosure +7

CVE-2023-21387 (android) 5 months, 3 weeks ago | web.nvd.nist.gov

android backup bypass cve +11

CVE-2023-21389 (android) 5 months, 3 weeks ago | web.nvd.nist.gov

android bypass check cve +10

SOC 2 Manager, Audit and Certification

@ Deloitte | US and CA Multiple Locations

View on infosec-jobs.com

Open-Source Intelligence (OSINT) Policy Analyst (TS/SCI)

@ WWC Global | Reston, Virginia, United States

View on infosec-jobs.com

Security Architect (DevSecOps)

@ EUROPEAN DYNAMICS | Brussels, Brussels, Belgium

View on infosec-jobs.com

Infrastructure Security Architect

@ Ørsted | Kuala Lumpur, MY

View on infosec-jobs.com

Contract Penetration Tester

@ Evolve Security | United States - Remote

View on infosec-jobs.com

Senior Penetration Tester

@ DigitalOcean | Canada

View on infosec-jobs.com