CVE-2017-0899 RubyGems Code Injection vulnerability
CriticalCVSS 9.8
EPSS 11.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems-update(RubyGems) | < 2.6.13 | 2.6.13 |
| rubygems-update(RubyGems) | = 0.8.10 | No fix listed |
| rubygems-update(RubyGems) | = 0.8.11 | No fix listed |
| rubygems-update(RubyGems) | = 0.8.3 | No fix listed |
| rubygems-update(RubyGems) | = 0.8.4 | No fix listed |
| rubygems-update(RubyGems) | = 0.8.5 | No fix listed |
| rubygems-update(RubyGems) | = 0.8.6 | No fix listed |
| rubygems-update(RubyGems) | = 0.8.8 | No fix listed |
| rubygems-update(RubyGems) | = 0.9.0 | No fix listed |
| rubygems-update(RubyGems) | = 0.9.1 | No fix listed |
| rubygems-update(RubyGems) | = 0.9.2 | No fix listed |
| rubygems-update(RubyGems) | = 0.9.3 | No fix listed |
| rubygems-update(RubyGems) | = 0.9.4 | No fix listed |
| rubygems-update(RubyGems) | = 0.9.5 | No fix listed |
| rubygems-update(RubyGems) | = 1.0.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.0.1 | No fix listed |
| rubygems-update(RubyGems) | = 1.1.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.1.1 | No fix listed |
| rubygems-update(RubyGems) | = 1.2.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.3.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.3.1 | No fix listed |
| rubygems-update(RubyGems) | = 1.3.2 | No fix listed |
| rubygems-update(RubyGems) | = 1.3.3 | No fix listed |
| rubygems-update(RubyGems) | = 1.3.4 | No fix listed |
| rubygems-update(RubyGems) | = 1.3.5 | No fix listed |
Show 158 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems-update(RubyGems) | = 1.3.6 | No fix listed |
| rubygems-update(RubyGems) | = 1.3.7 | No fix listed |
| rubygems-update(RubyGems) | = 1.4.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.4.1 | No fix listed |
| rubygems-update(RubyGems) | = 1.4.2 | No fix listed |
| rubygems-update(RubyGems) | = 1.5.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.5.2 | No fix listed |
| rubygems-update(RubyGems) | = 1.5.3 | No fix listed |
| rubygems-update(RubyGems) | = 1.6.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.6.1 | No fix listed |
| rubygems-update(RubyGems) | = 1.6.2 | No fix listed |
| rubygems-update(RubyGems) | = 1.7.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.7.1 | No fix listed |
| rubygems-update(RubyGems) | = 1.7.2 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.1 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.10 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.11 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.12 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.13 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.14 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.15 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.16 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.17 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.18 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.19 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.2 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.20 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.21 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.22 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.23 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.23.2 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.24 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.25 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.26 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.27 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.28 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.29 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.3 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.30 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.4 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.5 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.6 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.7 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.8 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.9 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.0.preview2 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.0.preview2.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.0.preview2.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.0.rc.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.0.rc.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.10 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.11 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.12 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.13 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.14 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.15 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.16 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.17 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.3 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.4 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.5 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.6 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.7 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.8 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.9 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.0.rc.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.0.rc.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.10 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.11 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.3 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.4 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.5 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.6 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.7 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.8 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.9 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.0.rc.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.3 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.4 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.5 | No fix listed |
| rubygems-update(RubyGems) | = 2.3.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.3 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.4 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.5 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.6 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.7 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.8 | No fix listed |
| rubygems-update(RubyGems) | = 2.5.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.5.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.5.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.10 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.11 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.12 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.3 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.4 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.5 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.6 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.7 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.8 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.9 | No fix listed |
| debian/rubygems(Debian:12) | < 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
| debian/rubygems(Debian:13) | < 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
| debian/rubygems(Debian:14) | < 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
| rubygems | <= 2.6.12 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.4 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| alpine/ruby(Alpine:v3.10) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.11) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.12) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.13) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.14) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.15) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.16) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.17) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.18) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.19) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.20) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.21) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.22) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.23) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.24) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.3) | < 2.2.8-r0 | 2.2.8-r0 |
| alpine/ruby(Alpine:v3.4) | < 2.3.5-r0 | 2.3.5-r0 |
| alpine/ruby(Alpine:v3.5) | < 2.3.5-r0 | 2.3.5-r0 |
| alpine/ruby(Alpine:v3.6) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.7) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.8) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.9) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby2.2(Alpine:v3.5) | < 2.2.8-r0 | 2.2.8-r0 |
| alpine/ruby2.2(Alpine:v3.6) | < 2.2.8-r0 | 2.2.8-r0 |
| ubuntu/jruby(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/jruby(Ubuntu:26.10) | All versions | No fix listed |
| HackerOne RubyGems | = Versions before 2.6.13 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- hackerone.com exploit patch third-party-advisory
- RHSA-2017:3485 third-party-advisory vendor-advisory
- RHSA-2018:0378 third-party-advisory vendor-advisory
- RHSA-2018:0583 third-party-advisory vendor-advisory
- RHSA-2018:0585 third-party-advisory vendor-advisory
- [debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update mailing-list third-party-advisory
- GLSA-201710-01 third-party-advisory vendor-advisory
- DSA-3966 third-party-advisory vendor-advisory
- blog.rubygems.org patch vendor-advisory
- web.archive.org
- web.archive.org
- github.com
- github.com product
- Debian Security Tracker CVE-2017-0899 vendor-advisory
- 100576 third-party-advisory vdb-entry
- 1039249 third-party-advisory vdb-entry
- security.alpinelinux.org vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-3439-1 vendor-advisory
- USN-3685-1 vendor-advisory
- www.cve.org