RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution. The issue has been patched in 2.6.14.
blog.rubygems.org/2017/10/09/2.6.14-released.html
blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
access.redhat.com/errata/RHSA-2017:3485
access.redhat.com/errata/RHSA-2018:0378
access.redhat.com/errata/RHSA-2018:0583
access.redhat.com/errata/RHSA-2018:0585
github.com/rubygems/rubygems
github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49
hackerone.com/reports/274990
lists.debian.org/debian-lts-announce/2018/07/msg00012.html
nvd.nist.gov/vuln/detail/CVE-2017-0903
usn.ubuntu.com/3553-1
usn.ubuntu.com/3685-1
web.archive.org/web/20200227143351/www.securityfocus.com/bid/101275
www.debian.org/security/2017/dsa-4031