RubyGems.org gem replacement security vulnerability and mitigation

Big thanks to the authors of this post. It's written in such a way as the scope of the vulnerability is immediately clear and immediately actionable.

I appreciate the way this was disclosed, especially that the author was very clear. Often security vulnerability disclosers are hard to understand.

I just wrote a simple script to check the gems:<p><a href="https:&#x2F;&#x2F;gist.github.com&#x2F;dcu&#x2F;3c06e4ab0e98158c5742c4fd2b31523d" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;dcu&#x2F;3c06e4ab0e98158c5742c4fd2b31523d</a>

The commit to fix this appears to be &quot;validate Version full_name&quot;:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;rubygems&#x2F;rubygems.org&#x2F;commit&#x2F;1067ab7e0871bf7b75832944d839c8e0495aeb92" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rubygems&#x2F;rubygems.org&#x2F;commit&#x2F;1067ab7e0871...</a><p>Cause: a &quot;full name&quot; is a dash-seperated join of its components, yet those components may themselves contain dashes :(

Great response. It&#x27;s still sad to me in 2016 we don&#x27;t have reliable build systems for otherwise such modern programming tools.<p>I understand <i>why</i>.. just sad. Great job on the investigation though.

Anyone know why the date listed for a gem listed on rubygems.org wouldn&#x27;t match the contents of the gem? I am guessing possible timezone differences. But some clarification would be nice.<p>For example:<p><pre><code> Listed for bundler -v 1.11.2 - December 16, 2015 (257 KB) $ tar tvf bundler-1.11.2.gem -r--r--r-- 0 wheel wheel 2161 Dec 15 19:12 metadata.gz -r--r--r-- 0 wheel wheel 257198 Dec 15 19:12 data.tar.gz -r--r--r-- 0 wheel wheel 267 Dec 15 19:12 checksums.yaml.gz</code></pre>

I worry for all the unmaintained but still available gems.

The manual verification steps are basically impossible for any non-trivial gem. I wonder if it would be possible to re-build (from git) the impacted gem versions and check their checksum against the downloaded version to detect differences?

To save app developers manually trawling dozens of gems and duplicating work, we need to have somewhere that people can publicly disclose gems they&#x27;ve found to be compromised.

The real WTF is that they only started checksumming the gems in 2015!