9.8

CVE-2017-0903

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rubygems ≫ Rubygems Version2.0.0
Rubygems ≫ Rubygems Version2.0.0 Updatepreview2
Rubygems ≫ Rubygems Version2.0.0 Updatepreview2.1
Rubygems ≫ Rubygems Version2.0.0 Updatepreview2.2
Rubygems ≫ Rubygems Version2.0.0 Updaterc1
Rubygems ≫ Rubygems Version2.0.0 Updaterc2
Rubygems ≫ Rubygems Version2.0.1
Rubygems ≫ Rubygems Version2.0.2
Rubygems ≫ Rubygems Version2.0.3
Rubygems ≫ Rubygems Version2.0.4
Rubygems ≫ Rubygems Version2.0.5
Rubygems ≫ Rubygems Version2.0.6
Rubygems ≫ Rubygems Version2.0.7
Rubygems ≫ Rubygems Version2.0.8
Rubygems ≫ Rubygems Version2.0.9
Rubygems ≫ Rubygems Version2.0.10
Rubygems ≫ Rubygems Version2.0.11
Rubygems ≫ Rubygems Version2.0.12
Rubygems ≫ Rubygems Version2.0.13
Rubygems ≫ Rubygems Version2.0.14
Rubygems ≫ Rubygems Version2.0.15
Rubygems ≫ Rubygems Version2.0.16
Rubygems ≫ Rubygems Version2.0.17
Rubygems ≫ Rubygems Version2.1.0
Rubygems ≫ Rubygems Version2.1.0.rc.1
Rubygems ≫ Rubygems Version2.1.0.rc.2
Rubygems ≫ Rubygems Version2.1.1
Rubygems ≫ Rubygems Version2.1.2
Rubygems ≫ Rubygems Version2.1.3
Rubygems ≫ Rubygems Version2.1.4
Rubygems ≫ Rubygems Version2.1.5
Rubygems ≫ Rubygems Version2.1.6
Rubygems ≫ Rubygems Version2.1.7
Rubygems ≫ Rubygems Version2.1.8
Rubygems ≫ Rubygems Version2.1.9
Rubygems ≫ Rubygems Version2.1.10
Rubygems ≫ Rubygems Version2.1.11
Rubygems ≫ Rubygems Version2.2.0
Rubygems ≫ Rubygems Version2.2.0.preiew.1
Rubygems ≫ Rubygems Version2.2.0.rc.1
Rubygems ≫ Rubygems Version2.2.1
Rubygems ≫ Rubygems Version2.2.2
Rubygems ≫ Rubygems Version2.2.3
Rubygems ≫ Rubygems Version2.2.4
Rubygems ≫ Rubygems Version2.2.5
Rubygems ≫ Rubygems Version2.3.0
Rubygems ≫ Rubygems Version2.4.0
Rubygems ≫ Rubygems Version2.4.1
Rubygems ≫ Rubygems Version2.4.2
Rubygems ≫ Rubygems Version2.4.3
Rubygems ≫ Rubygems Version2.4.4
Rubygems ≫ Rubygems Version2.4.5
Rubygems ≫ Rubygems Version2.4.6
Rubygems ≫ Rubygems Version2.4.7
Rubygems ≫ Rubygems Version2.4.8
Rubygems ≫ Rubygems Version2.5.0
Rubygems ≫ Rubygems Version2.5.1
Rubygems ≫ Rubygems Version2.5.2
Rubygems ≫ Rubygems Version2.6.0
Rubygems ≫ Rubygems Version2.6.1
Rubygems ≫ Rubygems Version2.6.2
Rubygems ≫ Rubygems Version2.6.3
Rubygems ≫ Rubygems Version2.6.4
Rubygems ≫ Rubygems Version2.6.5
Rubygems ≫ Rubygems Version2.6.6
Rubygems ≫ Rubygems Version2.6.7
Rubygems ≫ Rubygems Version2.6.8
Rubygems ≫ Rubygems Version2.6.9
Rubygems ≫ Rubygems Version2.6.10
Rubygems ≫ Rubygems Version2.6.11
Rubygems ≫ Rubygems Version2.6.12
Rubygems ≫ Rubygems Version2.6.13
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version17.10
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 15.85% 0.965
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://access.redhat.com/errata/RHSA-2018:0583
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
Third Party Advisory
Mailing List
https://access.redhat.com/errata/RHSA-2017:3485
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0378
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0585
Third Party Advisory
https://usn.ubuntu.com/3685-1/
Third Party Advisory
https://usn.ubuntu.com/3553-1/
Third Party Advisory
https://www.debian.org/security/2017/dsa-4031
Third Party Advisory
http://blog.rubygems.org/2017/10/09/2.6.14-released.html
Vendor Advisory
http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
Vendor Advisory
http://www.securityfocus.com/bid/101275
Third Party Advisory
VDB Entry
https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49
Patch
Third Party Advisory
https://hackerone.com/reports/274990
Third Party Advisory