A survey of recent RubyGems CVEs

on YouTube ↗31m

" summary

Survey of RubyGems CVEs lists concrete failures and fixes: early CVE-2007-0469 is directory traversal via tar entries, a 2013 incident exploits arbitrary YAML deserialization leading to remote code execution and massive rebuilds, and recurring bugs include symlink traversal, negative-length tar reads, REdoS, password reset bypasses and dependency/typo squatting. Response playbook uses S3 checksum comparisons against trusted mirrors, rollback/backport fixes, and audits (third‑party found ~30 issues); program statistics show 430 HackerOne reports with 64 real bugs fixed and ongoing work on sigstore and trusted publishing.

AI-written summary · about

" chapters (10)

1. 0:00RubyGems security intro
2. 1:59What is a CVE
3. 7:012007 RubyGems CVE
4. 10:582013 worst CVE
5. 16:48Common weaknesses
6. 20:49Bundler vulnerabilities
7. 22:17RubyGems.org security
8. 23:20Supply chain security
9. 26:55Vulnerability handling
10. 28:43Future improvements

" related talks

• 36mSecurity is hard, but we can't go shoppingAndre Arko · RailsConf 2013
• 40mSecurity Is Hard, But We Can't Go ShoppingAndre Arko · RedDotRuby 2015
• 29mGem install: What could go wrong?Ashley Ellis Pierce, Betty Li · RailsConf 2022
• 48mRuby & YouTerence Lee · Ancient City Ruby 2014
• 37mThe Evolution of Rails SecurityJustin Collins · RailsConf 2018
• 31mHacking with GemsBen Smith · Aloha RubyConf 2012
• 33mThe State of RubyGemsMarty Haught, Samuel Giddins, Martin Emde · RubyConf 2024
• 54mSecure Programming with Ruby on RailsMario Manno · FrOSCon 2015