CVE-2017-0903
- Source
- https://cve.org/CVERecord?id=CVE-2017-0903
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-0903.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2017-0903
- Aliases
- Downstream
- Related
- Published
- 2017-10-11T18:29:00.583Z
- Modified
- 2026-05-18T11:54:57.382994634Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
- Database specific
{ "unresolved_ranges": [ { "source": "CPE_FIELD", "vendor_product": "canonical:ubuntu_linux", "extracted_events": [ { "last_affected": "14.04" }, { "last_affected": "16.04" }, { "last_affected": "17.10" } ], "cpes": [ "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*" ] }, { "cpes": [ "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" ], "vendor_product": "debian:debian_linux", "extracted_events": [ { "last_affected": "8.0" }, { "last_affected": "9.0" } ], "source": "CPE_FIELD" }, { "source": "CPE_FIELD", "vendor_product": "redhat:enterprise_linux_desktop", "extracted_events": [ { "last_affected": "7.0" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*" ] }, { "source": "CPE_FIELD", "vendor_product": "redhat:enterprise_linux_server", "extracted_events": [ { "last_affected": "7.0" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*" ] }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*" ], "vendor_product": "redhat:enterprise_linux_server_aus", "extracted_events": [ { "last_affected": "7.4" }, { "last_affected": "7.6" } ], "source": "CPE_FIELD" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*" ], "vendor_product": "redhat:enterprise_linux_server_eus", "extracted_events": [ { "last_affected": "7.4" }, { "last_affected": "7.5" }, { "last_affected": "7.6" } ], "source": "CPE_FIELD" }, { "source": "CPE_FIELD", "vendor_product": "redhat:enterprise_linux_server_tus", "extracted_events": [ { "last_affected": "7.4" }, { "last_affected": "7.6" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*" ] }, { "source": "CPE_FIELD", "vendor_product": "redhat:enterprise_linux_workstation", "extracted_events": [ { "last_affected": "7.0" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*" ] }, { "cpes": [ "cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.10:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.11:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.12:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.13:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.14:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.15:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.16:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.17:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.0.rc.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.0.rc.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.10:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.11:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.9:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.0.preiew.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.0.rc.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.10:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.11:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.12:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.13:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.8:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.9:*:*:*:*:*:*:*" ], "vendor_product": "rubygems:rubygems", "extracted_events": [ { "last_affected": "2.0.0" }, { "last_affected": "2.0.0-preview2" }, { "last_affected": "2.0.0-preview2\\.1" }, { "last_affected": "2.0.0-preview2\\.2" }, { "last_affected": "2.0.0-rc1" }, { "last_affected": "2.0.0-rc2" }, { "last_affected": "2.0.1" }, { "last_affected": "2.0.2" }, { "last_affected": "2.0.3" }, { "last_affected": "2.0.4" }, { "last_affected": "2.0.5" }, { "last_affected": "2.0.6" }, { "last_affected": "2.0.7" }, { "last_affected": "2.0.8" }, { "last_affected": "2.0.9" }, { "last_affected": "2.0.10" }, { "last_affected": "2.0.11" }, { "last_affected": "2.0.12" }, { "last_affected": "2.0.13" }, { "last_affected": "2.0.14" }, { "last_affected": "2.0.15" }, { "last_affected": "2.0.16" }, { "last_affected": "2.0.17" }, { "last_affected": "2.1.0" }, { "last_affected": "2.1.0.rc.1" }, { "last_affected": "2.1.0.rc.2" }, { "last_affected": "2.1.1" }, { "last_affected": "2.1.2" }, { "last_affected": "2.1.3" }, { "last_affected": "2.1.4" }, { "last_affected": "2.1.5" }, { "last_affected": "2.1.6" }, { "last_affected": "2.1.7" }, { "last_affected": "2.1.8" }, { "last_affected": "2.1.9" }, { "last_affected": "2.1.10" }, { "last_affected": "2.1.11" }, { "last_affected": "2.2.0" }, { "last_affected": "2.2.0.preiew.1" }, { "last_affected": "2.2.0.rc.1" }, { "last_affected": "2.2.1" }, { "last_affected": "2.2.2" }, { "last_affected": "2.2.3" }, { "last_affected": "2.2.4" }, { "last_affected": "2.2.5" }, { "last_affected": "2.3.0" }, { "last_affected": "2.4.0" }, { "last_affected": "2.4.1" }, { "last_affected": "2.4.2" }, { "last_affected": "2.4.3" }, { "last_affected": "2.4.4" }, { "last_affected": "2.4.5" }, { "last_affected": "2.4.6" }, { "last_affected": "2.4.7" }, { "last_affected": "2.4.8" }, { "last_affected": "2.5.0" }, { "last_affected": "2.5.1" }, { "last_affected": "2.5.2" }, { "last_affected": "2.6.0" }, { "last_affected": "2.6.1" }, { "last_affected": "2.6.2" }, { "last_affected": "2.6.3" }, { "last_affected": "2.6.4" }, { "last_affected": "2.6.5" }, { "last_affected": "2.6.6" }, { "last_affected": "2.6.7" }, { "last_affected": "2.6.8" }, { "last_affected": "2.6.9" }, { "last_affected": "2.6.10" }, { "last_affected": "2.6.11" }, { "last_affected": "2.6.12" }, { "last_affected": "2.6.13" } ], "source": "CPE_FIELD" } ] }- References
-
- http://blog.rubygems.org/2017/10/09/2.6.14-released.html
- http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
- http://www.securityfocus.com/bid/101275
- https://access.redhat.com/errata/RHSA-2017:3485
- https://access.redhat.com/errata/RHSA-2018:0378
- https://access.redhat.com/errata/RHSA-2018:0583
- https://access.redhat.com/errata/RHSA-2018:0585
- https://hackerone.com/reports/274990
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://usn.ubuntu.com/3553-1/
- https://usn.ubuntu.com/3685-1/
- https://www.debian.org/security/2017/dsa-4031
- https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49
Affected packages
Git / github.com/ruby/rubygems
Affected versions
v1.*
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.8.0
v1.8.1
v1.8.2
v2.*
v2.0.0
v2.0.0.preview2
v2.0.0.preview2.1
v2.0.0.preview2.2
v2.0.0.rc.1
v2.0.0.rc.2
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.0.rc.1
v2.1.0.rc.2
v2.1.1
v2.1.2
v2.1.3
v2.2.0.preview.1
v2.2.0.rc.1
v2.2.1
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.5.0
v2.5.1
v2.5.2
v2.6.0
v2.6.1
v2.6.10
v2.6.11
v2.6.12
v2.6.13
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.6.7
v2.6.8
v2.6.9