CVE-2017-0903 RubyGems vulnerable to Deserialization of Untrusted Data
CriticalCVSS 9.8
EPSS 15.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems-update(RubyGems) | >= 2.0.0, < 2.6.14 | 2.6.14 |
| rubygems-update(RubyGems) | = 2.0.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.10 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.11 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.12 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.13 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.14 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.15 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.16 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.17 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.3 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.4 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.5 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.6 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.7 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.8 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.9 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.0.rc.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.0.rc.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.10 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.11 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.2 | No fix listed |
Show 132 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems-update(RubyGems) | = 2.1.3 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.4 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.5 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.6 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.7 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.8 | No fix listed |
| rubygems-update(RubyGems) | = 2.1.9 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.0.rc.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.3 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.4 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.5 | No fix listed |
| rubygems-update(RubyGems) | = 2.3.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.3 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.4 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.5 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.6 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.7 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.8 | No fix listed |
| rubygems-update(RubyGems) | = 2.5.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.5.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.5.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.10 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.11 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.12 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.13 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.3 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.4 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.5 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.6 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.7 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.8 | No fix listed |
| rubygems-update(RubyGems) | = 2.6.9 | No fix listed |
| debian/rubygems(Debian:12) | < 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
| debian/rubygems(Debian:13) | < 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
| debian/rubygems(Debian:14) | < 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
| rubygems | = 2.0.0 | No fix listed |
| rubygems | = 2.0.0-preview2 | No fix listed |
| rubygems | = 2.0.0-preview2.1 | No fix listed |
| rubygems | = 2.0.0-preview2.2 | No fix listed |
| rubygems | = 2.0.0-rc1 | No fix listed |
| rubygems | = 2.0.0-rc2 | No fix listed |
| rubygems | = 2.0.1 | No fix listed |
| rubygems | = 2.0.2 | No fix listed |
| rubygems | = 2.0.3 | No fix listed |
| rubygems | = 2.0.4 | No fix listed |
| rubygems | = 2.0.5 | No fix listed |
| rubygems | = 2.0.6 | No fix listed |
| rubygems | = 2.0.7 | No fix listed |
| rubygems | = 2.0.8 | No fix listed |
| rubygems | = 2.0.9 | No fix listed |
| rubygems | = 2.0.10 | No fix listed |
| rubygems | = 2.0.11 | No fix listed |
| rubygems | = 2.0.12 | No fix listed |
| rubygems | = 2.0.13 | No fix listed |
| rubygems | = 2.0.14 | No fix listed |
| rubygems | = 2.0.15 | No fix listed |
| rubygems | = 2.0.16 | No fix listed |
| rubygems | = 2.0.17 | No fix listed |
| rubygems | = 2.1.0 | No fix listed |
| rubygems | = 2.1.0.rc.1 | No fix listed |
| rubygems | = 2.1.0.rc.2 | No fix listed |
| rubygems | = 2.1.1 | No fix listed |
| rubygems | = 2.1.2 | No fix listed |
| rubygems | = 2.1.3 | No fix listed |
| rubygems | = 2.1.4 | No fix listed |
| rubygems | = 2.1.5 | No fix listed |
| rubygems | = 2.1.6 | No fix listed |
| rubygems | = 2.1.7 | No fix listed |
| rubygems | = 2.1.8 | No fix listed |
| rubygems | = 2.1.9 | No fix listed |
| rubygems | = 2.1.10 | No fix listed |
| rubygems | = 2.1.11 | No fix listed |
| rubygems | = 2.2.0 | No fix listed |
| rubygems | = 2.2.0.preiew.1 | No fix listed |
| rubygems | = 2.2.0.rc.1 | No fix listed |
| rubygems | = 2.2.1 | No fix listed |
| rubygems | = 2.2.2 | No fix listed |
| rubygems | = 2.2.3 | No fix listed |
| rubygems | = 2.2.4 | No fix listed |
| rubygems | = 2.2.5 | No fix listed |
| rubygems | = 2.3.0 | No fix listed |
| rubygems | = 2.4.0 | No fix listed |
| rubygems | = 2.4.1 | No fix listed |
| rubygems | = 2.4.2 | No fix listed |
| rubygems | = 2.4.3 | No fix listed |
| rubygems | = 2.4.4 | No fix listed |
| rubygems | = 2.4.5 | No fix listed |
| rubygems | = 2.4.6 | No fix listed |
| rubygems | = 2.4.7 | No fix listed |
| rubygems | = 2.4.8 | No fix listed |
| rubygems | = 2.5.0 | No fix listed |
| rubygems | = 2.5.1 | No fix listed |
| rubygems | = 2.5.2 | No fix listed |
| rubygems | = 2.6.0 | No fix listed |
| rubygems | = 2.6.1 | No fix listed |
| rubygems | = 2.6.2 | No fix listed |
| rubygems | = 2.6.3 | No fix listed |
| rubygems | = 2.6.4 | No fix listed |
| rubygems | = 2.6.5 | No fix listed |
| rubygems | = 2.6.6 | No fix listed |
| rubygems | = 2.6.7 | No fix listed |
| rubygems | = 2.6.8 | No fix listed |
| rubygems | = 2.6.9 | No fix listed |
| rubygems | = 2.6.10 | No fix listed |
| rubygems | = 2.6.11 | No fix listed |
| rubygems | = 2.6.12 | No fix listed |
| rubygems | = 2.6.13 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.4 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| HackerOne RubyGems | = Versions >= 2.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- hackerone.com third-party-advisory
- RHSA-2017:3485 third-party-advisory vendor-advisory
- RHSA-2018:0378 third-party-advisory vendor-advisory
- RHSA-2018:0583 third-party-advisory vendor-advisory
- RHSA-2018:0585 third-party-advisory vendor-advisory
- [debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update mailing-list third-party-advisory
- USN-3553-1 third-party-advisory vendor-advisory
- USN-3685-1 third-party-advisory vendor-advisory
- DSA-4031 third-party-advisory vendor-advisory
- blog.rubygems.org vendor-advisory
- blog.rubygems.org vendor-advisory
- web.archive.org
- github.com
- github.com product
- Debian Security Tracker CVE-2017-0903 vendor-advisory
- 101275 third-party-advisory vdb-entry