HackeroneCVELIST:CVE-2017-0903CVE-2017-0903
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
CNA Affected
[
{
"product": "RubyGems",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "Versions >= 2.0.0"
}
]
}
]References
blog.rubygems.org/2017/10/09/2.6.14-released.html
blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
www.securityfocus.com/bid/101275
access.redhat.com/errata/RHSA-2017:3485
access.redhat.com/errata/RHSA-2018:0378
access.redhat.com/errata/RHSA-2018:0583
access.redhat.com/errata/RHSA-2018:0585
github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49
hackerone.com/reports/274990
lists.debian.org/debian-lts-announce/2018/07/msg00012.html
usn.ubuntu.com/3553-1/
usn.ubuntu.com/3685-1/
www.debian.org/security/2017/dsa-4031
Related
