CVE-2017-0903
- Source
- https://cve.org/CVERecord?id=CVE-2017-0903
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0903.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2017-0903
- Aliases
- Downstream
- Related
- Published
- 2017-10-11T18:29:00Z
- Modified
- 2026-08-27T03:45:31Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "14.04" }, { "last_affected": "14.04" }, { "introduced": "16.04" }, { "last_affected": "16.04" }, { "introduced": "17.10" }, { "last_affected": "17.10" } ], "source": "CPE_STRING", "vendor_product": "canonical:ubuntu_linux" }, { "cpes": [ "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "8.0" }, { "last_affected": "8.0" }, { "introduced": "9.0" }, { "last_affected": "9.0" } ], "source": "CPE_STRING", "vendor_product": "debian:debian_linux" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "7.0" }, { "last_affected": "7.0" } ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_desktop" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "7.0" }, { "last_affected": "7.0" } ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_server" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "7.4" }, { "last_affected": "7.4" }, { "introduced": "7.6" }, { "last_affected": "7.6" } ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_server_aus" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "7.4" }, { "last_affected": "7.4" }, { "introduced": "7.5" }, { "last_affected": "7.5" }, { "introduced": "7.6" }, { "last_affected": "7.6" } ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_server_eus" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "7.4" }, { "last_affected": "7.4" }, { "introduced": "7.6" }, { "last_affected": "7.6" } ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_server_tus" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "7.0" }, { "last_affected": "7.0" } ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_workstation" }, { "cpes": [ "cpe:2.3:a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.0.preiew.1:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "2.0.0-rc1" }, { "last_affected": "2.0.0-rc1" }, { "introduced": "2.0.0-rc2" }, { "last_affected": "2.0.0-rc2" }, { "introduced": "2.2.0.preiew.1" }, { "last_affected": "2.2.0.preiew.1" } ], "source": "CPE_STRING", "vendor_product": "rubygems:rubygems" } ] }- References
-
- http://blog.rubygems.org/2017/10/09/2.6.14-released.html
- http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
- http://www.securityfocus.com/bid/101275
- https://access.redhat.com/errata/RHSA-2017:3485
- https://access.redhat.com/errata/RHSA-2018:0378
- https://access.redhat.com/errata/RHSA-2018:0583
- https://access.redhat.com/errata/RHSA-2018:0585
- https://hackerone.com/reports/274990
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://usn.ubuntu.com/3553-1/
- https://usn.ubuntu.com/3685-1/
- https://www.debian.org/security/2017/dsa-4031
- https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49
Affected packages
Git / github.com/ruby/rubygems
Affected ranges
- Type
- GIT
- Repo
- https://github.com/ruby/rubygems
- Events
-
IntroducedLast AffectedFixed
- Database specific
-
Show details
{ "cpe": [ "cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.10:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.11:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.12:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.13:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.14:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.15:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.16:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.0.17:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.0.rc.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.0.rc.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.9:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.10:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.1.11:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.0.rc.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.8:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.9:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.10:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.11:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.12:*:*:*:*:*:*:*", "cpe:2.3:a:rubygems:rubygems:2.6.13:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "2.0.0" }, { "last_affected": "2.0.0" }, { "introduced": "2.0.0-preview2" }, { "last_affected": "2.0.0-preview2" }, { "introduced": "2.0.0-preview2\\.1" }, { "last_affected": "2.0.0-preview2\\.1" }, { "introduced": "2.0.0-preview2\\.2" }, { "last_affected": "2.0.0-preview2\\.2" }, { "introduced": "2.0.1" }, { "last_affected": "2.0.1" }, { "introduced": "2.0.2" }, { "last_affected": "2.0.2" }, { "introduced": "2.0.3" }, { "last_affected": "2.0.3" }, { "introduced": "2.0.4" }, { "last_affected": "2.0.4" }, { "introduced": "2.0.5" }, { "last_affected": "2.0.5" }, { "introduced": "2.0.6" }, { "last_affected": "2.0.6" }, { "introduced": "2.0.7" }, { "last_affected": "2.0.7" }, { "introduced": "2.0.8" }, { "last_affected": "2.0.8" }, { "introduced": "2.0.9" }, { "last_affected": "2.0.9" }, { "introduced": "2.0.10" }, { "last_affected": "2.0.10" }, { "introduced": "2.0.11" }, { "last_affected": "2.0.11" }, { "introduced": "2.0.12" }, { "last_affected": "2.0.12" }, { "introduced": "2.0.13" }, { "last_affected": "2.0.13" }, { "introduced": "2.0.14" }, { "last_affected": "2.0.14" }, { "introduced": "2.0.15" }, { "last_affected": "2.0.15" }, { "introduced": "2.0.16" }, { "last_affected": "2.0.16" }, { "introduced": "2.0.17" }, { "last_affected": "2.0.17" }, { "introduced": "2.1.0" }, { "last_affected": "2.1.0" }, { "introduced": "2.1.0.rc.1" }, { "last_affected": "2.1.0.rc.1" }, { "introduced": "2.1.0.rc.2" }, { "last_affected": "2.1.0.rc.2" }, { "introduced": "2.1.1" }, { "last_affected": "2.1.1" }, { "introduced": "2.1.2" }, { "last_affected": "2.1.2" }, { "introduced": "2.1.3" }, { "last_affected": "2.1.3" }, { "introduced": "2.1.4" }, { "last_affected": "2.1.4" }, { "introduced": "2.1.5" }, { "last_affected": "2.1.5" }, { "introduced": "2.1.6" }, { "last_affected": "2.1.6" }, { "introduced": "2.1.7" }, { "last_affected": "2.1.7" }, { "introduced": "2.1.8" }, { "last_affected": "2.1.8" }, { "introduced": "2.1.9" }, { "last_affected": "2.1.9" }, { "introduced": "2.1.10" }, { "last_affected": "2.1.10" }, { "introduced": "2.1.11" }, { "last_affected": "2.1.11" }, { "introduced": "2.2.0" }, { "last_affected": "2.2.0" }, { "introduced": "2.2.0.rc.1" }, { "last_affected": "2.2.0.rc.1" }, { "introduced": "2.2.1" }, { "last_affected": "2.2.1" }, { "introduced": "2.2.2" }, { "last_affected": "2.2.2" }, { "introduced": "2.2.3" }, { "last_affected": "2.2.3" }, { "introduced": "2.2.4" }, { "last_affected": "2.2.4" }, { "introduced": "2.2.5" }, { "last_affected": "2.2.5" }, { "introduced": "2.3.0" }, { "last_affected": "2.3.0" }, { "introduced": "2.4.0" }, { "last_affected": "2.4.0" }, { "introduced": "2.4.1" }, { "last_affected": "2.4.1" }, { "introduced": "2.4.2" }, { "last_affected": "2.4.2" }, { "introduced": "2.4.3" }, { "last_affected": "2.4.3" }, { "introduced": "2.4.4" }, { "last_affected": "2.4.4" }, { "introduced": "2.4.5" }, { "last_affected": "2.4.5" }, { "introduced": "2.4.6" }, { "last_affected": "2.4.6" }, { "introduced": "2.4.7" }, { "last_affected": "2.4.7" }, { "introduced": "2.4.8" }, { "last_affected": "2.4.8" }, { "introduced": "2.5.0" }, { "last_affected": "2.5.0" }, { "introduced": "2.5.1" }, { "last_affected": "2.5.1" }, { "introduced": "2.5.2" }, { "last_affected": "2.5.2" }, { "introduced": "2.6.0" }, { "last_affected": "2.6.0" }, { "introduced": "2.6.1" }, { "last_affected": "2.6.1" }, { "introduced": "2.6.2" }, { "last_affected": "2.6.2" }, { "introduced": "2.6.3" }, { "last_affected": "2.6.3" }, { "introduced": "2.6.4" }, { "last_affected": "2.6.4" }, { "introduced": "2.6.5" }, { "last_affected": "2.6.5" }, { "introduced": "2.6.6" }, { "last_affected": "2.6.6" }, { "introduced": "2.6.7" }, { "last_affected": "2.6.7" }, { "introduced": "2.6.8" }, { "last_affected": "2.6.8" }, { "introduced": "2.6.9" }, { "last_affected": "2.6.9" }, { "introduced": "2.6.10" }, { "last_affected": "2.6.10" }, { "introduced": "2.6.11" }, { "last_affected": "2.6.11" }, { "introduced": "2.6.12" }, { "last_affected": "2.6.12" }, { "introduced": "2.6.13" }, { "last_affected": "2.6.13" } ], "source": [ "CPE_STRING", "REFERENCES" ] }
Affected versions
2.*
2.0.0
2.0.0-preview2
2.0.0-preview2\.1
2.0.0-preview2\.2
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0.rc.1
2.1.0.rc.2
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.0.rc.1
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.13
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.0.rc.1
v2.1.0.rc.2
v2.1.1
v2.1.2
v2.1.3
v2.2.0.preview.1
v2.2.0.rc.1
v2.2.1
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.5.0
v2.5.1
v2.5.2
v2.6.0
v2.6.1
v2.6.10
v2.6.11
v2.6.12
v2.6.13
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.6.7
v2.6.8
v2.6.9