CVE-2017-0903 — Deserialization of Untrusted Data in Rubygems

CWE-502 — Deserialization of Untrusted DataCWE-20 — Improper Input Validation16 documents8 sources
Severity
9.8CRITICALNVD
OSV9.1OSV7.5
EPSS
5.5%
top 9.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
RubygemsHackerone RubygemsCanonical Ubuntu Linux+7 more
Timeline
PublishedOct 11
Latest updateMay 13

Description

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages6 packages

▶Debianrubygems/rubygems< 3.2.0~rc.1-1+3
▶NVDrubygems/rubygems67 versions+66
▶CVEListV5hackerone/rubygemsVersions >= 2.0.0

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 14.04, 16.04, 17.10, Enterprise Linux 7.4, 7.6, 7.5

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

7
GHSA
RubyGems vulnerable to Deserialization of Untrusted Data↗2022-05-13
▶
OSV
RubyGems vulnerable to Deserialization of Untrusted Data↗2022-05-13
▶
OSV
ruby2.0 regression↗2021-03-25
▶
OSV
ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities↗2018-06-13
▶
OSV
ruby2.3 vulnerabilities↗2018-01-31
▶

📋Vendor Advisories

5
Ubuntu
Ruby regression↗2021-03-25
▶
Ubuntu
Ruby vulnerabilities↗2018-06-13
▶
Ubuntu
Ruby vulnerabilities↗2018-01-31
▶
Red Hat
rubygems: Unsafe object deserialization through YAML formatted gem specifications↗2017-10-10
▶
Debian
CVE-2017-0903: rubygems - RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote c...↗2017
▶

💬Community

3
Bugzilla
CVE-2017-0903 ruby: rubygems: Unsafe object deserialization through YAML formatted gem specifications [fedora-all]↗2017-10-11
▶
Bugzilla
CVE-2017-0903 rubygems: Unsafe object deserialization through YAML formatted gem specifications [fedora-all]↗2017-10-10
▶
Bugzilla
CVE-2017-0903 rubygems: Unsafe object deserialization through YAML formatted gem specifications↗2017-10-10
▶
CVE-2017-0903 — Deserialization of Untrusted Data | cvebase