9.8

CVE-2017-0903

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

Data is provided by the National Vulnerability Database (NVD)
Rubygems ≫ Rubygems Version2.0.0
Rubygems ≫ Rubygems Version2.0.0 Updatepreview2
Rubygems ≫ Rubygems Version2.0.0 Updatepreview2.1
Rubygems ≫ Rubygems Version2.0.0 Updatepreview2.2
Rubygems ≫ Rubygems Version2.0.0 Updaterc1
Rubygems ≫ Rubygems Version2.0.0 Updaterc2
Rubygems ≫ Rubygems Version2.0.1
Rubygems ≫ Rubygems Version2.0.2
Rubygems ≫ Rubygems Version2.0.3
Rubygems ≫ Rubygems Version2.0.4
Rubygems ≫ Rubygems Version2.0.5
Rubygems ≫ Rubygems Version2.0.6
Rubygems ≫ Rubygems Version2.0.7
Rubygems ≫ Rubygems Version2.0.8
Rubygems ≫ Rubygems Version2.0.9
Rubygems ≫ Rubygems Version2.0.10
Rubygems ≫ Rubygems Version2.0.11
Rubygems ≫ Rubygems Version2.0.12
Rubygems ≫ Rubygems Version2.0.13
Rubygems ≫ Rubygems Version2.0.14
Rubygems ≫ Rubygems Version2.0.15
Rubygems ≫ Rubygems Version2.0.16
Rubygems ≫ Rubygems Version2.0.17
Rubygems ≫ Rubygems Version2.1.0
Rubygems ≫ Rubygems Version2.1.0.rc.1
Rubygems ≫ Rubygems Version2.1.0.rc.2
Rubygems ≫ Rubygems Version2.1.1
Rubygems ≫ Rubygems Version2.1.2
Rubygems ≫ Rubygems Version2.1.3
Rubygems ≫ Rubygems Version2.1.4
Rubygems ≫ Rubygems Version2.1.5
Rubygems ≫ Rubygems Version2.1.6
Rubygems ≫ Rubygems Version2.1.7
Rubygems ≫ Rubygems Version2.1.8
Rubygems ≫ Rubygems Version2.1.9
Rubygems ≫ Rubygems Version2.1.10
Rubygems ≫ Rubygems Version2.1.11
Rubygems ≫ Rubygems Version2.2.0
Rubygems ≫ Rubygems Version2.2.0.preiew.1
Rubygems ≫ Rubygems Version2.2.0.rc.1
Rubygems ≫ Rubygems Version2.2.1
Rubygems ≫ Rubygems Version2.2.2
Rubygems ≫ Rubygems Version2.2.3
Rubygems ≫ Rubygems Version2.2.4
Rubygems ≫ Rubygems Version2.2.5
Rubygems ≫ Rubygems Version2.3.0
Rubygems ≫ Rubygems Version2.4.0
Rubygems ≫ Rubygems Version2.4.1
Rubygems ≫ Rubygems Version2.4.2
Rubygems ≫ Rubygems Version2.4.3
Rubygems ≫ Rubygems Version2.4.4
Rubygems ≫ Rubygems Version2.4.5
Rubygems ≫ Rubygems Version2.4.6
Rubygems ≫ Rubygems Version2.4.7
Rubygems ≫ Rubygems Version2.4.8
Rubygems ≫ Rubygems Version2.5.0
Rubygems ≫ Rubygems Version2.5.1
Rubygems ≫ Rubygems Version2.5.2
Rubygems ≫ Rubygems Version2.6.0
Rubygems ≫ Rubygems Version2.6.1
Rubygems ≫ Rubygems Version2.6.2
Rubygems ≫ Rubygems Version2.6.3
Rubygems ≫ Rubygems Version2.6.4
Rubygems ≫ Rubygems Version2.6.5
Rubygems ≫ Rubygems Version2.6.6
Rubygems ≫ Rubygems Version2.6.7
Rubygems ≫ Rubygems Version2.6.8
Rubygems ≫ Rubygems Version2.6.9
Rubygems ≫ Rubygems Version2.6.10
Rubygems ≫ Rubygems Version2.6.11
Rubygems ≫ Rubygems Version2.6.12
Rubygems ≫ Rubygems Version2.6.13
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version17.10
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 4.9% 0.891
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://usn.ubuntu.com/3685-1/
Third Party Advisory
https://usn.ubuntu.com/3553-1/
Third Party Advisory
http://www.securityfocus.com/bid/101275
Third Party Advisory
VDB Entry