Vulnerability CVE-2017-0903
Published: 2017-10-11   Modified: 2017-10-12

Description:
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

See advisories in our WLB2 database:
Topic
Author
Date
High
RubyGems Unsafe Object Deserialization Vulnerability
Aaron Patterson
10.10.2017

Type:

CWE-502

 (Deserialization of Untrusted Data)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Rubygems -> Rubygems 
Redhat -> Enterprise linux desktop 
Redhat -> Enterprise linux server 
Redhat -> Enterprise linux server aus 
Redhat -> Enterprise linux server eus 
Redhat -> Enterprise linux server tus 
Redhat -> Enterprise linux workstation 
Debian -> Debian linux 
Canonical -> Ubuntu linux 

 References:
http://blog.rubygems.org/2017/10/09/2.6.14-released.html
http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
http://www.securityfocus.com/bid/101275
https://access.redhat.com/errata/RHSA-2017:3485
https://access.redhat.com/errata/RHSA-2018:0378
https://access.redhat.com/errata/RHSA-2018:0583
https://access.redhat.com/errata/RHSA-2018:0585
https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49
https://hackerone.com/reports/274990
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
https://usn.ubuntu.com/3553-1/
https://usn.ubuntu.com/3685-1/
https://www.debian.org/security/2017/dsa-4031
Copyright 2024, cxsecurity.com

 

Back to Top