Vulnerability CVE-2017-0901: Information

Description

RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2017-0901
Published: Aug. 31, 2017
Modified: Oct. 10, 2019
Error type identifier: CWE-20

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
rubysisyphus2.4.1-alt13.1.4-alt4.4ALT-PU-2017-2195-1187805Fixed
rubyp102.4.1-alt13.1.4-alt2.p10.1ALT-PU-2017-2195-1187805Fixed
rubyp92.4.1-alt12.5.9-alt1ALT-PU-2017-2195-1187805Fixed
rubyp82.4.2-alt0.M80P.12.5.1-alt0.M80P.1ALT-PU-2017-2276-1188260Fixed
rubyc10f12.4.1-alt12.7.4-alt2.2.1ALT-PU-2017-2195-1187805Fixed
rubyc9f22.4.1-alt12.7.6-alt0.1.c9f2ALT-PU-2017-2195-1187805Fixed
rubyc72.4.3-alt0.M70C.12.4.4-alt0.M70C.1ALT-PU-2018-1228-1200650Fixed
rubyp112.4.1-alt13.1.4-alt4.4ALT-PU-2017-2195-1187805Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://hackerone.com/reports/243156
  • Exploit
  • Patch
  • Third Party Advisory
https://github.com/rubygems/rubygems/commit/ad5c0a53a86ca5b218c7976765c0365b91d22cb2
  • Patch
  • Third Party Advisory
http://blog.rubygems.org/2017/08/27/2.6.13-released.html
  • Patch
  • Vendor Advisory
1039249
  • Third Party Advisory
  • VDB Entry
100580
  • Third Party Advisory
  • VDB Entry
42611
  • Exploit
  • Third Party Advisory
  • VDB Entry
GLSA-201710-01
  • Third Party Advisory
DSA-3966
  • Third Party Advisory
RHSA-2017:3485
  • Third Party Advisory
RHSA-2018:0378
  • Third Party Advisory
USN-3553-1
  • Third Party Advisory
RHSA-2018:0585
  • Third Party Advisory
RHSA-2018:0583
  • Third Party Advisory
USN-3685-1
  • Third Party Advisory
[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update
  • Mailing List
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*
      End including
      2.6.12

      Configuration 2

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*

      Configuration 4

      cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top