Vulnerability CVE-2017-0903: Information

Description

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2017-0903
Published: Oct. 11, 2017
Modified: Oct. 10, 2019
Error type identifier: CWE-502

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
rubysisyphus2.4.2-alt23.1.4-alt4.3ALT-PU-2017-2419-1190689Fixed
rubyp102.4.2-alt23.1.4-alt2.p10.1ALT-PU-2017-2419-1190689Fixed
rubyp92.4.2-alt22.5.9-alt1ALT-PU-2017-2419-1190689Fixed
rubyp82.4.2-alt1.M80P.12.5.1-alt0.M80P.1ALT-PU-2017-2422-1190716Fixed
rubyc10f12.4.2-alt22.7.4-alt2.2.1ALT-PU-2017-2419-1190689Fixed
rubyc9f22.4.2-alt22.7.6-alt0.1.c9f2ALT-PU-2017-2419-1190689Fixed
rubyc72.4.3-alt0.M70C.12.4.4-alt0.M70C.1ALT-PU-2018-1228-1200650Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://hackerone.com/reports/274990
  • Third Party Advisory
https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49
  • Patch
  • Third Party Advisory
http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
  • Vendor Advisory
http://blog.rubygems.org/2017/10/09/2.6.14-released.html
  • Vendor Advisory
101275
  • Third Party Advisory
  • VDB Entry
DSA-4031
  • Third Party Advisory
RHSA-2017:3485
  • Third Party Advisory
RHSA-2018:0378
  • Third Party Advisory
USN-3553-1
  • Third Party Advisory
RHSA-2018:0585
  • Third Party Advisory
RHSA-2018:0583
  • Third Party Advisory
USN-3685-1
  • Third Party Advisory
[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update
  • Mailing List
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:rubygems:rubygems:2.4.3:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.2.1:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.2.2:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.13:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.15:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.1.1:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.2.0:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.4.5:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.1.4:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.4.2:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.10:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.16:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.14:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.4.4:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.4.0:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.11:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.4.6:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.1.2:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.2.3:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.4.1:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.1.3:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.12:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.4.7:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.2.4:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.1.0:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.0.17:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.1.0.rc.1:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.1.0.rc.2:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.1.5:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.1.6:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.1.7:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.1.8:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.1.9:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.1.10:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.1.11:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.2.0.preiew.1:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.2.0.rc.1:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.2.5:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.3.0:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.4.8:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.5.0:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.5.1:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.5.2:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.6.0:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.6.1:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.6.2:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.6.3:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.6.4:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.6.5:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.6.6:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.6.7:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.6.8:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.6.9:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.6.10:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.6.11:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.6.12:*:*:*:*:*:*:*
      cpe:2.3:a:rubygems:rubygems:2.6.13:*:*:*:*:*:*:*

      Configuration 2

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*

      Configuration 4

      cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.4.2
Back to top