Lucene search

DebianDEBIAN:DLA-1112-1:73A63

HistorySep 27, 2017 - 2:19 a.m.

[SECURITY] [DLA 1112-1] rubygems security update

2017-09-2702:19:34

lists.debian.org

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

9.8

Confidence

High

EPSS

0.023

Percentile

89.7%

JSON

Package : rubygems
Version : 1.8.24-1+deb7u1
CVE ID : CVE-2017-0900 CVE-2017-0901
Debian Bug : 873802

Some vulnerabilities were found in the Rubygems package that affects
the LTS distribution.

CVE-2017-0900

DOS vulernerability in the query command

CVE-2017-0901

gem installer allows a malicious gem to overwrite arbitrary files

For Debian 7 "Wheezy", these problems have been fixed in version
1.8.24-1+deb7u1.

We recommend that you upgrade your rubygems packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian9arm64ruby2.3-tcltk< 2.3.3-1+deb9u1ruby2.3-tcltk_2.3.3-1+deb9u1_arm64.deb
Debian7i386ruby1.9.1< 1.9.3.194-8.1+deb7u6ruby1.9.1_1.9.3.194-8.1+deb7u6_i386.deb
Debian9armelruby2.3-dev< 2.3.3-1+deb9u1ruby2.3-dev_2.3.3-1+deb9u1_armel.deb
Debian7allruby1.9.1< 1.9.3.194-8.1+deb7u6ruby1.9.1_1.9.3.194-8.1+deb7u6_all.deb
Debian9s390xruby2.3< 2.3.3-1+deb9u1ruby2.3_2.3.3-1+deb9u1_s390x.deb
Debian7armelruby1.9.1< 1.9.3.194-8.1+deb7u6ruby1.9.1_1.9.3.194-8.1+deb7u6_armel.deb
Debian9mipsruby2.3-tcltk< 2.3.3-1+deb9u1ruby2.3-tcltk_2.3.3-1+deb9u1_mips.deb
Debian9s390xruby2.3-tcltk-dbgsym< 2.3.3-1+deb9u1ruby2.3-tcltk-dbgsym_2.3.3-1+deb9u1_s390x.deb
Debian9ppc64ellibruby2.3< 2.3.3-1+deb9u1libruby2.3_2.3.3-1+deb9u1_ppc64el.deb
Debian9i386ruby2.3-tcltk-dbgsym< 2.3.3-1+deb9u1ruby2.3-tcltk-dbgsym_2.3.3-1+deb9u1_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	arm64	ruby2.3-tcltk	< 2.3.3-1+deb9u1	ruby2.3-tcltk_2.3.3-1+deb9u1_arm64.deb
Debian	7	i386	ruby1.9.1	< 1.9.3.194-8.1+deb7u6	ruby1.9.1_1.9.3.194-8.1+deb7u6_i386.deb
Debian	9	armel	ruby2.3-dev	< 2.3.3-1+deb9u1	ruby2.3-dev_2.3.3-1+deb9u1_armel.deb
Debian	7	all	ruby1.9.1	< 1.9.3.194-8.1+deb7u6	ruby1.9.1_1.9.3.194-8.1+deb7u6_all.deb
Debian	9	s390x	ruby2.3	< 2.3.3-1+deb9u1	ruby2.3_2.3.3-1+deb9u1_s390x.deb
Debian	7	armel	ruby1.9.1	< 1.9.3.194-8.1+deb7u6	ruby1.9.1_1.9.3.194-8.1+deb7u6_armel.deb
Debian	9	mips	ruby2.3-tcltk	< 2.3.3-1+deb9u1	ruby2.3-tcltk_2.3.3-1+deb9u1_mips.deb
Debian	9	s390x	ruby2.3-tcltk-dbgsym	< 2.3.3-1+deb9u1	ruby2.3-tcltk-dbgsym_2.3.3-1+deb9u1_s390x.deb
Debian	9	ppc64el	libruby2.3	< 2.3.3-1+deb9u1	libruby2.3_2.3.3-1+deb9u1_ppc64el.deb
Debian	9	i386	ruby2.3-tcltk-dbgsym	< 2.3.3-1+deb9u1	ruby2.3-tcltk-dbgsym_2.3.3-1+deb9u1_i386.deb