Vulnerability CVE-2017-0900: Information

Description

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2017-0900
Published: Aug. 31, 2017
Modified: May 13, 2019
Error type identifier: CWE-20

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
rubysisyphus2.4.1-alt13.1.4-alt4.4ALT-PU-2017-2195-1187805Fixed
rubyp102.4.1-alt13.1.4-alt2.p10.1ALT-PU-2017-2195-1187805Fixed
rubyp92.4.1-alt12.5.9-alt1ALT-PU-2017-2195-1187805Fixed
rubyp82.4.2-alt0.M80P.12.5.1-alt0.M80P.1ALT-PU-2017-2276-1188260Fixed
rubyc10f12.4.1-alt12.7.4-alt2.2.1ALT-PU-2017-2195-1187805Fixed
rubyc9f22.4.1-alt12.7.6-alt0.1.c9f2ALT-PU-2017-2195-1187805Fixed
rubyc72.4.3-alt0.M70C.12.4.4-alt0.M70C.1ALT-PU-2018-1228-1200650Fixed
rubyp112.4.1-alt13.1.4-alt4.4ALT-PU-2017-2195-1187805Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://hackerone.com/reports/243003
  • Exploit
  • Third Party Advisory
https://github.com/rubygems/rubygems/commit/8a38a4fc24c6591e6c8f43d1fadab6efeb4d6251
  • Patch
  • Third Party Advisory
http://blog.rubygems.org/2017/08/27/2.6.13-released.html
  • Patch
  • Vendor Advisory
1039249
  • Third Party Advisory
  • VDB Entry
100579
  • Third Party Advisory
  • VDB Entry
GLSA-201710-01
  • Third Party Advisory
DSA-3966
  • Third Party Advisory
RHSA-2017:3485
  • Third Party Advisory
RHSA-2018:0378
  • Third Party Advisory
RHSA-2018:0585
  • Third Party Advisory
RHSA-2018:0583
  • Third Party Advisory
[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update
  • Mailing List
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*
      End including
      2.6.12

      Configuration 2

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top