CVE-2017-0903
CVE-2017-0903
This page contains facts from public vulnerability sources. Check the original advisory before updating.
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
CVSS 9.8 · Critical · EPSS 15.9% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
rubygems
- Versions
- Versions >= 2.0.0: Affected
No fix published
rubygems Debian:12
- Affected ranges
- ECOSYSTEM: < 3.2.0~rc.1-1
Update to 3.2.0~rc.1-1
rubygems Debian:13
- Affected ranges
- ECOSYSTEM: < 3.2.0~rc.1-1
Update to 3.2.0~rc.1-1
rubygems Debian:14
- Affected ranges
- ECOSYSTEM: < 3.2.0~rc.1-1
Update to 3.2.0~rc.1-1
ruby2.0 Ubuntu:14.04:LTS
- Versions
- 2.0.0.299-2
- 2.0.0.343-1
- 2.0.0.343-1ubuntu1
- 2.0.0.353-1
- 2.0.0.353-1ubuntu1
- 2.0.0.484-1ubuntu1
- 2.0.0.484-1ubuntu2
- 2.0.0.484-1ubuntu2.1
- 2.0.0.484-1ubuntu2.2
- 2.0.0.484-1ubuntu2.4
- 2.0.0.484-1ubuntu2.5
- 2.0.0.484-1ubuntu2.6
- 2.0.0.484-1ubuntu2.8
- 2.0.0.484-1ubuntu2.9
- Affected ranges
- ECOSYSTEM: < 2.0.0.484-1ubuntu2.10
Update to 2.0.0.484-1ubuntu2.10
jruby Ubuntu:Pro:14.04:LTS
- Versions
- 1.5.6-5ubuntu1
- 1.5.6-6
- 1.5.6-7
- 1.5.6-9+deb8u2build0.14.04.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby2.3 Ubuntu:16.04:LTS
- Versions
- 2.3.0-1
- 2.3.0-2
- 2.3.0-4ubuntu2
- 2.3.0-4ubuntu3
- 2.3.0-5ubuntu1
- 2.3.1-2~16.04
- 2.3.1-2~16.04.2
- 2.3.1-2~16.04.4
- 2.3.1-2~16.04.5
- Affected ranges
- ECOSYSTEM: < 2.3.1-2~16.04.6
Update to 2.3.1-2~16.04.6
jruby Ubuntu:16.04:LTS
- Versions
- 1.7.21-2ubuntu4
- 1.7.22-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://usn.ubuntu.com/3685-1/
- https://usn.ubuntu.com/3553-1/
- https://access.redhat.com/errata/RHSA-2018:0585
- https://access.redhat.com/errata/RHSA-2018:0378
- https://hackerone.com/reports/274990
- https://www.debian.org/security/2017/dsa-4031
- https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49
- https://access.redhat.com/errata/RHSA-2017:3485
- http://blog.rubygems.org/2017/10/09/2.6.14-released.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://access.redhat.com/errata/RHSA-2018:0583
- http://www.securityfocus.com/bid/101275
- http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-0903