CVE-2017-0903

EPSS 15.85%
Veröffentlicht 11.10.2017 18:29:00
Zuletzt bearbeitet 13.05.2026 00:24:29
Erkennungen
Login

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 16

NVD 87 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Rubygems ≫ Rubygems Version 2.0.0

Rubygems ≫ Rubygems Version 2.0.0 Update preview2

Rubygems ≫ Rubygems Version 2.0.0 Update preview2.1

Rubygems ≫ Rubygems Version 2.0.0 Update preview2.2

Rubygems ≫ Rubygems Version 2.0.0 Update rc1

Rubygems ≫ Rubygems Version 2.0.0 Update rc2

Rubygems ≫ Rubygems Version 2.0.1

Rubygems ≫ Rubygems Version 2.0.2

Rubygems ≫ Rubygems Version 2.0.3

Rubygems ≫ Rubygems Version 2.0.4

Rubygems ≫ Rubygems Version 2.0.5

Rubygems ≫ Rubygems Version 2.0.6

Rubygems ≫ Rubygems Version 2.0.7

Rubygems ≫ Rubygems Version 2.0.8

Rubygems ≫ Rubygems Version 2.0.9

Rubygems ≫ Rubygems Version 2.0.10

Rubygems ≫ Rubygems Version 2.0.11

Rubygems ≫ Rubygems Version 2.0.12

Rubygems ≫ Rubygems Version 2.0.13

Rubygems ≫ Rubygems Version 2.0.14

Rubygems ≫ Rubygems Version 2.0.15

Rubygems ≫ Rubygems Version 2.0.16

Rubygems ≫ Rubygems Version 2.0.17

Rubygems ≫ Rubygems Version 2.1.0

Rubygems ≫ Rubygems Version 2.1.0.rc.1

Rubygems ≫ Rubygems Version 2.1.0.rc.2

Rubygems ≫ Rubygems Version 2.1.1

Rubygems ≫ Rubygems Version 2.1.2

Rubygems ≫ Rubygems Version 2.1.3

Rubygems ≫ Rubygems Version 2.1.4

Rubygems ≫ Rubygems Version 2.1.5

Rubygems ≫ Rubygems Version 2.1.6

Rubygems ≫ Rubygems Version 2.1.7

Rubygems ≫ Rubygems Version 2.1.8

Rubygems ≫ Rubygems Version 2.1.9

Rubygems ≫ Rubygems Version 2.1.10

Rubygems ≫ Rubygems Version 2.1.11

Rubygems ≫ Rubygems Version 2.2.0

Rubygems ≫ Rubygems Version 2.2.0.preiew.1

Rubygems ≫ Rubygems Version 2.2.0.rc.1

Rubygems ≫ Rubygems Version 2.2.1

Rubygems ≫ Rubygems Version 2.2.2

Rubygems ≫ Rubygems Version 2.2.3

Rubygems ≫ Rubygems Version 2.2.4

Rubygems ≫ Rubygems Version 2.2.5

Rubygems ≫ Rubygems Version 2.3.0

Rubygems ≫ Rubygems Version 2.4.0

Rubygems ≫ Rubygems Version 2.4.1

Rubygems ≫ Rubygems Version 2.4.2

Rubygems ≫ Rubygems Version 2.4.3

Rubygems ≫ Rubygems Version 2.4.4

Rubygems ≫ Rubygems Version 2.4.5

Rubygems ≫ Rubygems Version 2.4.6

Rubygems ≫ Rubygems Version 2.4.7

Rubygems ≫ Rubygems Version 2.4.8

Rubygems ≫ Rubygems Version 2.5.0

Rubygems ≫ Rubygems Version 2.5.1

Rubygems ≫ Rubygems Version 2.5.2

Rubygems ≫ Rubygems Version 2.6.0

Rubygems ≫ Rubygems Version 2.6.1

Rubygems ≫ Rubygems Version 2.6.2

Rubygems ≫ Rubygems Version 2.6.3

Rubygems ≫ Rubygems Version 2.6.4

Rubygems ≫ Rubygems Version 2.6.5

Rubygems ≫ Rubygems Version 2.6.6

Rubygems ≫ Rubygems Version 2.6.7

Rubygems ≫ Rubygems Version 2.6.8

Rubygems ≫ Rubygems Version 2.6.9

Rubygems ≫ Rubygems Version 2.6.10

Rubygems ≫ Rubygems Version 2.6.11

Rubygems ≫ Rubygems Version 2.6.12

Rubygems ≫ Rubygems Version 2.6.13

Debian ≫ Debian Linux Version 8.0

Debian ≫ Debian Linux Version 9.0

Canonical ≫ Ubuntu Linux Version 14.04 SwEdition lts

Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts

Canonical ≫ Ubuntu Linux Version 17.10

Redhat ≫ Enterprise Linux Desktop Version 7.0

Redhat ≫ Enterprise Linux Server Version 7.0

Redhat ≫ Enterprise Linux Server Aus Version 7.4

Redhat ≫ Enterprise Linux Server Aus Version 7.6

Redhat ≫ Enterprise Linux Server Eus Version 7.4

Redhat ≫ Enterprise Linux Server Eus Version 7.5

Redhat ≫ Enterprise Linux Server Eus Version 7.6

Redhat ≫ Enterprise Linux Server Tus Version 7.4

Redhat ≫ Enterprise Linux Server Tus Version 7.6

Redhat ≫ Enterprise Linux Workstation Version 7.0

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	15.85%	0.965

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://access.redhat.com/errata/RHSA-2018:0583

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html

Third Party Advisory

Mailing List

https://access.redhat.com/errata/RHSA-2017:3485

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0378

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0585

Third Party Advisory

https://usn.ubuntu.com/3685-1/

Third Party Advisory

https://usn.ubuntu.com/3553-1/

Third Party Advisory

https://www.debian.org/security/2017/dsa-4031

Third Party Advisory

http://blog.rubygems.org/2017/10/09/2.6.14-released.html

Vendor Advisory

http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html

Vendor Advisory

http://www.securityfocus.com/bid/101275

Third Party Advisory

VDB Entry

https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49

Patch

Third Party Advisory

https://hackerone.com/reports/274990

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2017-0903

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-0903

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-0903

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2017-0903