CVE-2017-0899
published 2017-08-31CVE-2017-0899: RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem…
PriorityP353critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
10.81%
95.3th percentile
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | rubygems | < rubygems 3.2.0~rc.1-1 (bookworm) | rubygems 3.2.0~rc.1-1 (bookworm) |
| hackerone | rubygems | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| rubygems | rubygems | <= 2.6.12 | — |
| rubygems | rubygems | >= 0 < 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
| rubygems | rubygems | >= 0 < 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
| rubygems | rubygems | >= 0 < 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
| rubygems | rubygems | >= 0 < 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8LOW
vendor_redhat9.8CRITICAL
vendor_ubuntu9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Ruby vulnerabilities
vendor_ubuntu·2017-10-05·CVSS 9.1
CVE-2017-0898 [CRITICAL] Ruby vulnerabilities
Title: Ruby vulnerabilities
Summary: Several security issues were fixed in Ruby.
It was discovered that Ruby incorrectly handled certain inputs.
An attacker could use this to cause a buffer overrun.
(CVE-2017-0898)
Yusuke Endoh discovered that Ruby incorrectly handled certain files.
An attacker could use this to execute terminal escape sequences.
(CVE-2017-0899)
Yusuke Endoh discovered that Ruby incorrectly handled certain inputs.
An attacker could use this to cause a denial of service.
(CVE-2017-0900)
It was discovered that Ruby incorrectly handled certain files.
An attacker could use this to overwrite any file on the filesystem.
(CVE-2017-0901)
It was discovered that Ruby incorrectly handled certain inputs.
An attacker could use this to execute arbitrary code.
(CVE-2017-10784)
It
Red Hat
rubygems: Escape sequence in the "summary" field of gemspec
vendor_redhat·2017-08-31·CVSS 9.8
CVE-2017-0899 [CRITICAL] CWE-138 rubygems: Escape sequence in the "summary" field of gemspec
rubygems: Escape sequence in the "summary" field of gemspec
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
A vulnerability was found where rubygems did not properly sanitize gems' specification text. A specially crafted gem could interact with the terminal via the use of escape sequences.
Statement: This issue affects the versions of ruby as shipped with Red Hat Enterprise Linux 6, and 7 and the versions of rh-ruby22-ruby and rh-ruby23-ruby as shipped with Red Hat Software Collections. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, ref
Debian
CVE-2017-0899: rubygems - RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem spe...
vendor_debian·2017·CVSS 9.8
CVE-2017-0899 [CRITICAL] CVE-2017-0899: rubygems - RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem spe...
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
Scope: local
bookworm: resolved (fixed in 3.2.0~rc.1-1)
bullseye: resolved (fixed in 3.2.0~rc.1-1)
forky: resolved (fixed in 3.2.0~rc.1-1)
sid: resolved (fixed in 3.2.0~rc.1-1)
trixie: resolved (fixed in 3.2.0~rc.1-1)
GHSA
RubyGems Code Injection vulnerability
ghsa·2022-05-13
CVE-2017-0899 [CRITICAL] CWE-150 RubyGems Code Injection vulnerability
RubyGems Code Injection vulnerability
RubyGems prior to 2.6.13 is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
OSV
RubyGems Code Injection vulnerability
osv·2022-05-13
CVE-2017-0899 [CRITICAL] RubyGems Code Injection vulnerability
RubyGems Code Injection vulnerability
RubyGems prior to 2.6.13 is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
OSV
ruby1.9.1 vulnerabilities
osv·2017-10-05·CVSS 9.1
CVE-2017-0898 [CRITICAL] ruby1.9.1 vulnerabilities
ruby1.9.1 vulnerabilities
It was discovered that Ruby incorrectly handled certain inputs.
An attacker could use this to cause a buffer overrun.
(CVE-2017-0898)
Yusuke Endoh discovered that Ruby incorrectly handled certain files.
An attacker could use this to execute terminal escape sequences.
(CVE-2017-0899)
Yusuke Endoh discovered that Ruby incorrectly handled certain inputs.
An attacker could use this to cause a denial of service.
(CVE-2017-0900)
It was discovered that Ruby incorrectly handled certain files.
An attacker could use this to overwrite any file on the filesystem.
(CVE-2017-0901)
It was discovered that Ruby incorrectly handled certain inputs.
An attacker could use this to execute arbitrary code.
(CVE-2017-10784)
It was discovered that Ruby incorrectly handled certain inp
OSV
CVE-2017-0899: RubyGems version 2
osv·2017-08-31·CVSS 9.8
CVE-2017-0899 [CRITICAL] CVE-2017-0899: RubyGems version 2
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-0899 CVE-2017-0900 CVE-2017-0901 CVE-2017-0902 rubygems: various flaws [fedora-all]
bugzilla·2017-09-01·CVSS 9.8
CVE-2017-0899 [CRITICAL] CVE-2017-0899 CVE-2017-0900 CVE-2017-0901 CVE-2017-0902 rubygems: various flaws [fedora-all]
CVE-2017-0899 CVE-2017-0900 CVE-2017-0901 CVE-2017-0902 rubygems: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple sup
Bugzilla
CVE-2017-0899 rubygems: Escape sequence in the "summary" field of gemspec
bugzilla·2017-09-01·CVSS 9.8
CVE-2017-0899 [CRITICAL] CVE-2017-0899 rubygems: Escape sequence in the "summary" field of gemspec
CVE-2017-0899 rubygems: Escape sequence in the "summary" field of gemspec
RubyGems version 2.6.12 and earlier is vulnerable to maliciously
crafted gem specifications that include terminal escape characters.
Printing the gem specification would execute terminal escape
sequences.
Upstream patches:
https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1
https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491
Bug report:
https://hackerone.com/reports/226335
External References:
http://blog.rubygems.org/2017/08/27/2.6.13-released.html
Discussion:
Created ruby193-rubygems tracking bugs for this issue:
Affects: openshift-1 [bug 1487592]
Created rubygems tracking bugs for this issue:
Affects: fedora-all [bug 1487591]
Affects: o
Fortinet
The Analysis of Apache Struts 1 Form Field Input Validation Bypass (CVE-2015-0899)
blogs_fortinet·2017-10-25·CVSS 7.5
CVE-2015-0899 [HIGH] The Analysis of Apache Struts 1 Form Field Input Validation Bypass (CVE-2015-0899)
FORTIGUARD LABS THREAT RESEARCH
The Analysis of Apache Struts 1 Form Field Input Validation Bypass (CVE-2015-0899)
By Dehui Yin | October 25, 2017
Apache Struts 1 is a popularly used JAVA EE web application framework. It offers many kinds of validators to filter user input by using the Apache Common Validator library, which is both convenient and fast. However, a bug in Apache Struts can be used to easily bypass the input validation process, allowing an attacker to submit arbitrary dirty data to the database, possibly resulting in a cross-site scripting attack when the user views the JSP file that refers directly to the corrupted data.
This potential Input Validation Bypass vulnerability is caused by an error in both ValidatorForm.java and DynaValidatorForm.java when initializing the va
http://blog.rubygems.org/2017/08/27/2.6.13-released.htmlhttp://www.securityfocus.com/bid/100576http://www.securitytracker.com/id/1039249https://access.redhat.com/errata/RHSA-2017:3485https://access.redhat.com/errata/RHSA-2018:0378https://access.redhat.com/errata/RHSA-2018:0583https://access.redhat.com/errata/RHSA-2018:0585https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491https://hackerone.com/reports/226335https://lists.debian.org/debian-lts-announce/2018/07/msg00012.htmlhttps://security.gentoo.org/glsa/201710-01https://www.debian.org/security/2017/dsa-3966http://blog.rubygems.org/2017/08/27/2.6.13-released.htmlhttp://www.securityfocus.com/bid/100576http://www.securitytracker.com/id/1039249https://access.redhat.com/errata/RHSA-2017:3485https://access.redhat.com/errata/RHSA-2018:0378https://access.redhat.com/errata/RHSA-2018:0583https://access.redhat.com/errata/RHSA-2018:0585https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491https://hackerone.com/reports/226335https://lists.debian.org/debian-lts-announce/2018/07/msg00012.htmlhttps://security.gentoo.org/glsa/201710-01https://www.debian.org/security/2017/dsa-3966
2017-08-31
Published