Vulnerability CVE-2017-0899: Information

Description

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2017-0899
Published: Aug. 31, 2017
Modified: Oct. 10, 2019
Error type identifier: CWE-94

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
rubysisyphus2.4.1-alt13.1.4-alt4.4ALT-PU-2017-2195-1187805Fixed
rubyp102.4.1-alt13.1.4-alt2.p10.1ALT-PU-2017-2195-1187805Fixed
rubyp92.4.1-alt12.5.9-alt1ALT-PU-2017-2195-1187805Fixed
rubyp82.4.2-alt0.M80P.12.5.1-alt0.M80P.1ALT-PU-2017-2276-1188260Fixed
rubyc10f12.4.1-alt12.7.4-alt2.2.1ALT-PU-2017-2195-1187805Fixed
rubyc9f22.4.1-alt12.7.6-alt0.1.c9f2ALT-PU-2017-2195-1187805Fixed
rubyc72.4.3-alt0.M70C.12.4.4-alt0.M70C.1ALT-PU-2018-1228-1200650Fixed
rubyp112.4.1-alt13.1.4-alt4.4ALT-PU-2017-2195-1187805Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://hackerone.com/reports/226335
  • Exploit
  • Patch
  • Third Party Advisory
https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491
  • Patch
  • Third Party Advisory
https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1
  • Patch
  • Third Party Advisory
http://blog.rubygems.org/2017/08/27/2.6.13-released.html
  • Patch
  • Vendor Advisory
1039249
  • Third Party Advisory
  • VDB Entry
100576
  • Third Party Advisory
  • VDB Entry
GLSA-201710-01
  • Third Party Advisory
DSA-3966
  • Third Party Advisory
RHSA-2017:3485
  • Third Party Advisory
RHSA-2018:0378
  • Third Party Advisory
RHSA-2018:0585
  • Third Party Advisory
RHSA-2018:0583
  • Third Party Advisory
[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update
  • Mailing List
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*
      End including
      2.6.12

      Configuration 2

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top