RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
References
| Link | Resource |
|---|---|
| http://blog.rubygems.org/2017/10/09/2.6.14-released.html | Vendor Advisory |
| http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html | Vendor Advisory |
| http://www.securityfocus.com/bid/101275 | Third Party Advisory VDB Entry |
| https://access.redhat.com/errata/RHSA-2017:3485 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2018:0378 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2018:0583 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2018:0585 | Third Party Advisory |
| https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49 | Patch Third Party Advisory |
| https://hackerone.com/reports/274990 | Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html | Mailing List Third Party Advisory |
| https://usn.ubuntu.com/3553-1/ | Third Party Advisory |
| https://usn.ubuntu.com/3685-1/ | Third Party Advisory |
| https://www.debian.org/security/2017/dsa-4031 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
No history.
Information
Published : 2017-10-11 18:29
Updated : 2019-10-09 23:21
NVD link : CVE-2017-0903
Mitre link : CVE-2017-0903
CVE.ORG link : CVE-2017-0903
JSON object : View
Products Affected
redhat
- enterprise_linux_server_aus
- enterprise_linux_server
- enterprise_linux_server_eus
- enterprise_linux_desktop
- enterprise_linux_workstation
- enterprise_linux_server_tus
rubygems
- rubygems
canonical
- ubuntu_linux
debian
- debian_linux
CWE
CWE-502
Deserialization of Untrusted Data
